kreai-social
Effective date / Last updated: June 2026
The data controller is Kreai — Martin Monti, based in Italy. For any privacy-related request you can reach us at info@kreai.io.
This Privacy Policy is effective as of June 2026 and was last updated in June 2026.
When you connect a social media account through kreai-social, we collect and store only the minimum data needed to operate the service:
kreai_tt_session (HMAC-SHA256, marked httponly and secure) used only to keep you logged in to your dashboard.We do not collect your name, email address, contacts, demographic information, or any profile data beyond the items listed above.
Your data is used exclusively to publish and manage content on your own connected account through the official TikTok and Meta APIs, and only when you explicitly authorize such an action. We never sell your data and never share it with third parties for advertising or marketing purposes.
We process your data under Article 6(1)(b) GDPR (performance of the contract — providing the service you requested) and Article 6(1)(a) GDPR (your consent, given through the OAuth authorization flow).
We rely on the following sub-processors to deliver the service:
Your data is stored within the European Union (Google Cloud, region europe-west1). Should any transfer outside the EU occur through our sub-processors, it is covered by the European Commission's Standard Contractual Clauses (SCCs).
Your tokens are retained until you disconnect your account. They also expire automatically according to TikTok's policy: the access token after 24 hours and the refresh token after 365 days. After disconnection, stored tokens and your Open ID are deleted as described in section 11.
Access to stored data is restricted to the kreai-social service accounts only. Data is encrypted in transit and at rest. Our infrastructure runs on Google Cloud, which is ISO 27001 and SOC 2 certified.
You have the right to access, rectify, erase, port, object to, and restrict the processing of your personal data. You also have the right to lodge a complaint with your supervisory authority — in Italy, the Garante per la protezione dei dati personali. To exercise any of these rights, contact info@kreai.io.
You can delete your data at any time in one of two ways:
/tiktok/logout, which immediately removes your stored tokens.Deletion removes all of your tokens (access and refresh) and your Open ID from our Firestore database. Once deleted, the data cannot be recovered.
The only cookie we use is the signed session cookie kreai_tt_session described in section 3, which keeps you logged in to your dashboard. We do not use tracking, analytics, or advertising cookies of any kind.
kreai-social is a business tool and is not directed to anyone under the age of 16. We do not knowingly collect data from minors.
We may update this Privacy Policy from time to time. Any change will be reflected by updating the "Last updated" date at the top of this page.
kreai-social uses the TikTok API. Your use is also subject to TikTok's Privacy Policy.
For any privacy question or request, contact us at info@kreai.io. See also our Terms of Service.