PRIVACY POLICY
Last updated: 31 July 2026
TOMA is operated by Alex Latte Ltd, registered in England and Wales at 5th Floor, 167-169 Great Portland Street, London W1W 5PF. In this policy, "TOMA", "we" and "us" mean Alex Latte Ltd. We are registered with the Information Commissioner's Office under reference ZC194089.
Questions about anything on this page can go to info@bytoma.app.
Who controls the information
For our own account holders, our website, and the running of the service, we are the data controller.
Where a brand, venue or agency runs an event using TOMA, they decide who is invited, what is captured and what is done with it afterwards. In that situation they are the controller and we act on their instructions. A data processing agreement is available on request from info@bytoma.app.
What we collect
Organisers. When someone creates an account to run events, we hold their name, email address, and the events they create. Payment for content allowances is handled entirely by Apple. We receive a record that a purchase was made and what it contained. We never see card details.
Guests. Guests do not create an account and do not log in. To join an event, a guest gives a first name and enters the event code, and where the organiser has set one, an event password. We store that first name alongside an identifier generated by the device, which is what lets a guest return to their own images. No email address, phone number, or contact list is requested or collected.
Images. Images captured through TOMA are uploaded to private storage so the organiser can review them and so the person who captured them can see their own set. Each image carries the event it belongs to, the moment it was taken, and who captured it. Location data is not recorded.
Technical information. We record basic diagnostic information such as app version, device type, and errors, so we can keep the app working.
Notifications. If notifications are allowed, we hold a token issued by Apple so we can send alerts about an event.
Waitlist. If an email address is submitted through this website, we hold it so we can write about TOMA opening. It is never passed on, and it can be removed at any time by replying to any message or writing to info@bytoma.app.
Why we hold it
To run events, to let organisers review and share content, to let participants see their own set, to process purchases of content allowances, to keep the service secure and working, and to answer messages sent to support.
Our lawful basis is performance of a contract for the parts needed to deliver the service, and legitimate interests for security, diagnostics and preventing misuse. Notifications and the waitlist rely on consent, which can be withdrawn at any time.
How long we keep it
Images are held for the life of the event and its shared link. Once a link expires, every image in that event is permanently deleted, whether it was selected or not. Everyone receiving a set is told the expiry date and asked to save their own copy.
A guest's first name and device identifier are deleted with the event they belong to.
Account information is held while an account is open. When an account is deleted, the account and everything attached to it is removed. Records we are required to keep for tax and accounting are kept for as long as the law requires.
Cookies
The app uses no cookies of any kind.
This website is built on Wix, which sets a small number of cookies that are strictly necessary for the site to load, stay secure, and hold a session while someone is on it. We collect nothing else here beyond an email address given to the waitlist.
Nothing on this site is used for advertising, and we do not follow visitors across other websites. Because only strictly necessary cookies are set, no consent banner is shown. Cookies can be cleared or blocked through the browser at any time.
Who else is involved
We keep the number of companies touching this information as small as possible.
Supabase hosts our database, storage and server functions.
Apple provides the App Store, in app purchases, and push notifications.
Netlify hosts the page where finished sets are downloaded.
Wix hosts this website.
We do not sell personal information, and we do not share it for advertising.
Where information is held
Our database and image storage are located in the United Kingdom.
Some of our suppliers are based outside the United Kingdom and may process information in other countries, including the United States. Where that happens it is done under the safeguards allowed by UK data protection law, such as the International Data Transfer Addendum or an adequacy decision.
Security
Images and event data sit behind access rules that restrict every record to the event and the account it belongs to. Traffic is encrypted in transit. Shared links carry a token that cannot be guessed and stop working on expiry.
No system is beyond risk. If a breach occurs that is likely to affect the people involved, we will tell them and the Information Commissioner's Office within the time the law requires.
Rights
Anyone whose information we hold can ask for a copy of it, ask for it to be corrected, ask for it to be deleted, ask us to restrict how it is used, object to how it is used, or ask for it in a portable form. Requests go to info@bytoma.app and are answered within one month.
Where the information relates to an event run by a brand, venue or agency, we will pass the request to that organiser and support them in answering it.
A complaint can also be made to the Information Commissioner's Office at ico.org.uk.
Images of other people
Events are private, and everyone inside TOMA is there because they were invited. The organiser of an event is responsible for making sure participants understand that images are being captured and shared within that event, and for having a lawful basis to do so.
If something should not have been captured or shared, contact the organiser first, or write to us at info@bytoma.app and we will remove it.
Children
TOMA is not intended for anyone under 16. We do not knowingly collect information from anyone under 16. If we learn that we have, we delete it.
Changes
If this policy changes, the date at the top changes with it, and anyone with an account is told inside the app.