1. Information we collect
Depending on your interaction, we may collect information you provide, such as your name, email address, business inquiry, account settings, content, or instructions. We may also receive account identifiers and other data from platforms you choose to connect.
2. Authentication and OAuth
When you authorize a connected platform, it may provide authorization tokens and account metadata. We use them only for authorized functions, such as identifying an account, reading permitted information, or posting content at the account owner's direction. We do not ask you to send platform passwords by email.
3. Token and credential handling
Authentication tokens and integration secrets are restricted information. We limit access, avoid exposing them in public interfaces and logs, and use technical safeguards appropriate to the service. Tokens may be refreshed, replaced, or deleted as required by the platform, a revocation request, or security needs.
4. Connected-platform data
With authorization, we may process profile or channel identifiers, display names, account metadata, content metadata, publication status, and other information permitted by the platform and requested feature. For TikTok, this may support account login and authorized content-posting workflows. The precise data depends on permissions granted.
5. Operational and log data
We may collect technical data needed to run and protect services, including timestamps, request status, diagnostic codes, device or session identifiers, browser and network information, security events, and audit records. We seek to exclude credentials and unnecessary sensitive content from logs.
6. How we use information
We use information to provide requested services, operate authorized integrations, authenticate users and devices, maintain security and reliability, troubleshoot, preserve audit history, communicate, comply with law, and improve projects. We do not sell personal information.
7. Storage and security
Information may be stored in systems operated by The Order HQ and service providers supporting hosting, communications, security, and integrations. We use access controls, credential isolation, encrypted transport where supported, and reasonable safeguards. No method can guarantee absolute security.
8. Third parties and sharing
We may share information with a connected platform when you request an action, with service providers acting for us, to protect rights and security, or as required by law. We do not authorize service providers to use personal information for unrelated purposes. Third parties process information under their own policies.
9. Retention
We retain information only as long as reasonably needed to provide services, maintain security and audit records, resolve disputes, and meet legal obligations. Periods vary by data and context. Limited records of deletion, revocation, or security actions may be retained where necessary.
10. Your rights and choices
Depending on applicable law, you may request access, correction, or deletion, or object to certain processing. You may disconnect an integration through its platform and contact us about account data. Some records may be retained for security, legal compliance, or legitimate operations.
11. Cookies and local storage
Our public informational site does not currently use advertising or analytics cookies. Applications may use cookies, session storage, or local storage when technically necessary for authentication, security, preferences, or requested functionality. Connected third-party pages may use their own technologies.
12. Children
Our services are not directed to children under 13, and we do not knowingly collect their personal information. Users must also meet any higher minimum age imposed by a connected platform or applicable law.
13. Changes
We may update this policy as services, practices, or legal obligations change. The effective date identifies the current version. Material changes will be presented through an appropriate notice when required.
14. Contact
Privacy questions and requests may be sent to [email protected]. Do not include passwords, access tokens, recovery codes, or payment details.