Privacy Policy

1. Who we are

COTIKK is a TikTok marketing automation workspace that lets creators and teams plan, schedule and publish content. This policy applies to https://cotikk.com and the COTIKK application.

The data controller is MBFM Group LLC, 4283 Express Lane, ES5029, Sarasota, FL 34249, United States.

For privacy questions or requests, contact privacy@cotikk.com.

2. Information we collect

We collect only what the service needs to work:

• Account information — the name, email address, password hash and optional company name you provide when registering, or the profile basics returned by a social login provider you choose to use.
• Content you create — videos, images, captions, scheduling times, drafts and settings you upload or enter in order to publish.
• Connected TikTok account data — see section 3 below.
• Billing data — if you subscribe, our payment processor handles your card details. We never receive or store full card numbers; we store only the subscription status and identifiers needed for billing.
• Technical and usage data — IP address, browser and device type, pages viewed and errors encountered, used to keep the service secure and working.

3. TikTok data: what we access and why

When you connect a TikTok account, you are redirected to TikTok to log in and approve access. We never see your TikTok password. TikTok returns an access token that we store encrypted and use only to perform the actions you asked for.

Depending on the permissions you grant, we may access:

• Basic profile information — your TikTok display name, username, avatar and open ID, so you can tell connected accounts apart in the app.
• Content publishing — permission to upload and publish the videos or photo posts that you schedule in COTIKK, using the privacy level and settings you select before publishing.
• Post and account analytics — metrics such as views, likes, comments and shares for posts, shown back to you in the analytics screens.

We use TikTok data solely to provide these features to you. We do not sell it, do not use it for advertising, do not use it to train machine-learning models, and do not share it with other users. Our use of information received from TikTok APIs adheres to the TikTok Developer Terms of Service and Developer Policies, including their limited-use requirements.

You can disconnect a TikTok account at any time from the integrations screen in COTIKK, and you can revoke access from within your TikTok account settings. On disconnection we delete the stored access and refresh tokens.

4. How we use information

• To create and secure your account and authenticate you.
• To schedule, publish and report on the content you create.
• To provide customer support and respond to your requests.
• To process subscriptions and prevent fraud or abuse.
• To monitor reliability, debug errors and improve the product.
• To send service messages (for example, a failed publish or a billing notice). Marketing email, if any, is opt-in and can be unsubscribed at any time.

5. Legal bases (EEA/UK)

Where the GDPR applies, we process personal data to perform our contract with you (providing the service), on the basis of your consent (connecting a TikTok account and any optional marketing), for our legitimate interests (security, abuse prevention, product improvement), and to comply with legal obligations (such as tax and accounting records).

6. Sharing and subprocessors

We do not sell personal data and we do not share it for cross-context behavioural advertising. We share data only with service providers who process it on our behalf under contract:

• Cloud hosting and database providers that run the service.
• Our payment processor, for subscriptions.
• Error-monitoring and product-analytics providers, to keep the service reliable.
• Email delivery providers, for transactional messages.
• The social platforms you explicitly connect, in order to publish your content.

We may also disclose information if required by law, or to protect the rights, safety and security of our users and the service.

7. Retention and deletion

We keep personal data only as long as needed to provide the service, then delete or anonymise it. Specifically:

• TikTok access and refresh tokens are deleted as soon as you disconnect the account or delete your COTIKK account.
• Content you upload and scheduling history are retained while your account is active so the calendar and reporting work.
• When you delete your account, we delete your account data and connected-account tokens, and remove your uploaded media, within 30 days, except where we must retain limited records (for example, invoices) to meet legal obligations.
• Backups are rotated on a limited schedule and deleted data ages out of them.

To delete your account, use the account deletion option in Settings, or email privacy@cotikk.com and we will action it.

8. Your rights

Depending on where you live, you may have the right to access, correct, export, restrict or delete your personal data, to object to certain processing, and to withdraw consent at any time. You also have the right to complain to your local data protection authority.

Exercise any of these by emailing privacy@cotikk.com. We respond within the timeframes required by applicable law.

9. Security

We use encryption in transit (HTTPS), encrypt stored third-party access tokens, hash passwords, and restrict internal access to production data on a need-to-know basis. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant authorities as required by law.

10. International transfers

Our providers may process data in countries other than yours. Where personal data is transferred out of the EEA or UK, we rely on an approved transfer mechanism such as the European Commission’s Standard Contractual Clauses.

11. Cookies

We use strictly necessary cookies to keep you signed in and to remember basic preferences such as language. Where we use optional analytics, it is limited to understanding product usage and does not build advertising profiles. You can clear or block cookies in your browser, though the app will not function correctly without the necessary ones.

12. Children's privacy

COTIKK is not directed to children. You must be at least 18 years old, or the age of majority in your jurisdiction, to use the service. We do not knowingly collect personal data from children; if we learn that we have, we delete it.

13. Changes to this policy

We may update this policy as the product evolves. We will change the "last updated" date above and, for material changes, notify you in the app or by email before they take effect.

14. Contact

Privacy requests: privacy@cotikk.com. General support: support@cotikk.com.