Privacy Policy

Effective date: July 15, 2026 · Last updated: October 9, 2026

1. What Data We Collect

We collect data only to the extent necessary to provide the Service (data minimization principle), primarily in the following categories:

We do not collect data unrelated to the Service: we do not collect sensitive personal information such as buyers' government ID numbers or bank card numbers, and we only access the data fields returned by the TikTok Shop platform to the extent necessary and authorized for functions such as order analysis.

2. Browser Extension (ReelFlock for Chrome)

ReelFlock offers an optional Chrome extension that executes publishing tasks you configure in your workspace. It uses TikTok Studio in your signed-in browser profile or, when you select Takeflow, your signed-in Takeflow account and configured publishing seat. These workflows process the media, account identifiers and publishing parameters needed for your task. Takeflow accepting a task does not by itself confirm that a TikTok post is publicly available.

What the extension stores on your device

The extension uses browser extension storage (chrome.storage.local and chrome.storage.session) for your ReelFlock Agent token, an instance identifier, account/seat identifiers, settings, execution context, recent task status, pending submission/results and diagnostic records. Pending records allow results and audit evidence to be reported after a connection failure or restart. Local extension storage is not an encrypted password vault; access also depends on the security of your browser profile and device. For TikTok Studio uploads, the extension downloads the assigned video to local disk and attempts to remove its temporary files during cleanup; interrupted cleanup may leave files in your downloads directory.

What the extension sends to us

Requests to the ReelFlock backend use your Agent token for authentication. Task reporting includes the instance and task identifiers, signed-in TikTok handle or relevant Takeflow seat identifiers, execution stages and results, publishing times, provider task/creation IDs, and post IDs or links when available. For troubleshooting and security auditing, the extension also reports task-related errors and response summaries, including error type/message/stack, command name, timestamps, elapsed time, retry count, extension version, HTTP status, response content type, provider status messages and provider log IDs when available. Diagnostic fields vary by extension version. Structured publishing audit records use bounded fields and redact recognized credential patterns; they do not intentionally include cookies, access tokens, complete request bodies or raw response bodies. Diagnostic builds can additionally store task-related page-state snapshots and execution details locally.

Publishing services and credentials

TikTok Studio publishing sends the task's video, caption, product-link information and publishing settings to TikTok. The browser supplies the existing session for these requests; the extension does not use the Chrome cookies API to extract your TikTok cookies or send those credentials to ReelFlock.

When you select Takeflow, the extension reads the access token already stored by Takeflow in that site's browser storage and uses it in the Takeflow page context to authenticate requests to saas.takeflows.com. It reads the seat information needed to match your task and sends media or existing media references, captions, product information and scheduling parameters to Takeflow. Where required, media is uploaded to the cloud storage designated by Takeflow using temporary COS credentials. Takeflow access tokens and temporary COS credentials are not copied to extension storage or sent to the ReelFlock backend. Takeflow's own login storage and the data it receives remain subject to its controls and privacy policy.

Optional public profile collection

You can select accounts in the extension and confirm a manual collection, or enable a daily schedule. The extension reads video IDs, links, captions, authors and available publication times from those public profiles and sends them to ReelFlock to match publishing records and fill missing video references. New Takeflow publishing tasks may include a system-generated unique tracking hashtag in the public caption. Collection settings and pending reports are stored on your device. Reports retry after network failures and are not forwarded to another organization when the Agent token changes. You can stop collection or disable its schedule; stopping does not retract reports already received.

What the extension does not do

• It does not collect your general browsing history or unrelated page content. Access to TikTok, Takeflow and media resources is limited to task execution, public profile collection you configure, account matching and troubleshooting.
• It does not enumerate your local directories to collect files. File assignment uses the video downloaded for the publishing task.
• It does not display advertising, sell user data or use task data for cross-site advertising profiles. Transfers to publishing and storage services are limited to the workflow you select.

Our use and transfer of information received through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use this information to provide, secure and troubleshoot the extension's user-facing publishing and publication matching functionality, not for unrelated purposes.

Removal

Uninstalling the extension removes its local extension storage, but does not automatically delete downloaded files, ReelFlock server records, Takeflow data or TikTok posts. Remove remaining downloaded files through your device's file controls. Revoking the Agent token prevents subsequent authenticated access to ReelFlock; it does not recall data already sent or cancel tasks already accepted by another service. Manage those tasks and content through the relevant service. You can request deletion of ReelFlock-held data using the contact details in this Policy.

3. Why We Collect This Data (Purposes)

• Providing core functionality: syncing your product, order, and analytics data through the official TikTok Shop API, generating commerce videos and image/text content, and executing publishing tasks through the selected publishing channel, including the optional browser extension and Takeflow workflow described in Section 2.
• Analytics and review: aggregating content performance and sales data to help you optimize your content strategy.
• Account and security: verifying identity, maintaining account security, preventing fraud and abuse, and conducting security audits.
• Service improvement and support: diagnosing faults, improving the product experience, and responding to your support requests.
• Legal compliance: fulfilling obligations required by applicable laws and regulations and by TikTok Shop platform policies.

Each official API authorization scope we request maps one-to-one to the purposes above, and we do not request scopes unrelated to our features; automated access used for publishing is likewise strictly limited to the operations necessary for publishing (data minimization principle). We will not use data for purposes beyond those stated in this Policy.

4. How Data Is Stored and Transmitted

• Storage location: data is stored in our production environment hosted with compliant cloud providers; data for the US market is managed separately in accordance with TikTok Shop US data security requirements.
• Encryption in transit: all data transmission uses TLS 1.2 or above.
• Encryption at rest: protected data (including OAuth access tokens) is stored encrypted with AES-256 or an algorithm of equivalent strength; keys are managed by a dedicated key management service and rotated periodically.
• Cross-border transfers: where personal data must be transferred across borders, we implement safeguards in accordance with applicable law (such as GDPR Standard Contractual Clauses).

5. Data Sharing and Third Parties

We do not sell your personal data. We share necessary data with third parties only in the following circumstances:

• TikTok Shop platform: necessary data interaction with the TikTok Shop platform to complete functions such as product and data syncing (through the official API) and content publishing.
• Takeflow and its designated media storage: when you select Takeflow publishing, media and task parameters are transmitted to Takeflow and, where required, its designated cloud storage; task and seat identifiers are returned to ReelFlock for tracking. These transfers are necessary to carry out your selected workflow, not for advertising or resale.
• Infrastructure service providers: providers of cloud computing, content delivery, AI model inference, etc., limited to the data necessary to perform the Service and bound by data processing agreements (DPAs).
• Legal requirements: lawful requests from competent authorities.

We conduct data security assessments of all subcontractors and vendors and require them to meet protection standards no lower than those in this Policy.

6. How Long We Keep Data (Retention and Deletion)

When you revoke this app's authorization in TikTok Shop Seller Center, disconnect the shop within the Service, or close your account, we will delete the relevant data within the periods above and retain deletion records for audit purposes.

Removing ReelFlock data does not automatically remove media or tasks already sent to Takeflow or TikTok. Their retention and deletion controls apply to their copies.

7. How We Protect Data (Security Measures)

• Role-based access control (RBAC) following least-privilege and need-to-know principles; access to protected data is logged, and access rights are reviewed at least annually;
• Multi-factor authentication (MFA) enforced for administrator accounts;
• Segregation of production, staging, and office networks, with intrusion detection and endpoint protection deployed;
• Regular vulnerability scanning and penetration testing, with a remediation SLA and tracking mechanism;
• A data security incident response process; in the event of a security incident that may affect your data, we will notify you and relevant regulators promptly as required by law, and inform the TikTok Shop platform accordingly.

8. Your Data Rights

Under applicable law (including the GDPR, CPRA, and China's Personal Information Protection Law), you have the right to:

• Access and obtain a copy: query and access the personal data we hold about you and obtain a copy (portability);
• Rectification: correct inaccurate or incomplete data;
• Deletion: request deletion of your personal data;
• Restriction and objection: restrict or object to our processing of your data in legally prescribed circumstances;
• Withdraw consent: revoke the API authorization in TikTok Shop Seller Center at any time, or disconnect the shop within the Service;
• Complaint: lodge a complaint with the data protection authority in your jurisdiction.

You can submit the above requests via the contact details at the bottom of this page. We will respond within 15 business days after verifying your identity (or a shorter period where required by law).

9. Minors

The Service is intended for businesses and adult creators, and is not directed to minors under 18. If we discover that we have inadvertently collected a minor's personal data, we will delete it immediately.

10. Cookies and Similar Technologies

We use cookies / local storage to maintain login state and ensure security, and for the analytics described below. We do not use third-party advertising tracking cookies. You can manage cookies through your browser settings, though this may affect some functionality.

Google Analytics. On reelflock.com (the website, the App's login and registration pages, and the signed-in App) we use Google Analytics, which sets first-party cookies (_ga, _ga_<ID>) to recognise your browser and visit. Our servers also report business events (such as signup, login, content generation and publishing results, and subscription purchase) to Google Analytics through its server-side Measurement Protocol, together with your internal ReelFlock user ID and your browser's Google Analytics identifiers. These reports do not include your name, email address or payment card details.

First-touch source. When you first visit, we store how you arrived — UTM source, medium and campaign, the referring site's origin (domain only) and the landing page path — in your browser's local storage. If you register within 90 days, it is saved with your account in our database and attached to the signup event sent to Google Analytics.

We use this data for product analytics and to attribute signups to marketing channels. To opt out of analytics for your account or to request deletion of this data, contact us at [email protected]. You can also block or clear cookies and local storage in your browser at any time.

11. Updates to This Policy

We may update this Policy from time to time. We will provide advance notice of material changes via in-app notification or email, and the updated Policy takes effect on the stated effective date. Continued use of the Service constitutes acceptance of the updated Policy.

12. Contact Us

Contact details for our Privacy Owner / DPO:

• Email: [email protected]
• Operating entity: Infinite Flow Labs

We will process and respond to your message as soon as possible.