This Privacy Policy explains how NaNaVid ("NaNaVid", "we", "us" or "our") collects, uses, stores, shares and protects personal data when you visit tiktok.dev.pro.vn or use the NaNaVid application and its integration with TikTok (together, the "Service"). It also explains the choices and rights you have. Please read it together with our Terms of Service.
In short: we only request the TikTok permissions needed to identify the connected account and publish videos to it. We do not sell personal data, we do not use it for advertising, and you can revoke access and ask us to delete your data at any time.
1. Scope of this policy
This policy applies to personal data that NaNaVid processes in connection with the Service, including data you provide directly, data generated when you use the website, and data we receive from TikTok when you authorize the NaNaVid application through TikTok Login Kit.
This policy does not cover how TikTok itself collects or uses your data. TikTok's processing is governed by the TikTok Privacy Policy. Likewise, third-party websites linked from the Service are governed by their own policies.
2. Who is responsible for your data
NaNaVid is the controller of the personal data described in this policy, meaning we decide why and how that data is processed. NaNaVid operates from Vietnam. If you have any question about this policy or about your data, you can reach us using the details in Section 17.
3. Data we collect
We follow the principle of data minimization: we collect only what is necessary to operate the Service.
3.1 Data you give us
- Contact information: your email address and the content of your message if you contact us for support, a privacy request or a business inquiry.
- Video content and metadata: videos, captions, hashtags and privacy settings selected for a post, when you use the Service to publish to a connected TikTok account.
3.2 Data collected automatically
- Server logs: when you visit the website, our web server records technical information such as IP address, browser type, requested page, referring URL and timestamp. These logs are used for security, troubleshooting and abuse prevention.
- Application logs: records of API calls made on behalf of a connected account (for example, the time of an upload and the status returned by TikTok), used to operate and debug the Service.
3.3 Data we do not collect
We do not collect your TikTok password, payment card details, precise location, contacts, private messages, or any special categories of personal data (such as health, biometric, religious or political information). We do not use the Service to track you across other websites.
4. Data we receive from TikTok
When you connect a TikTok account, TikTok shows you a consent screen listing the permissions ("scopes") NaNaVid requests. We only receive data covered by the scopes you approve.
| Scope | Data received or action allowed | Why we need it |
|---|---|---|
user.info.basic | Open ID, union ID, display name and avatar of the TikTok account. | To identify which account is connected and show it in the app. |
video.upload | Permission to upload video files as drafts to the connected account. | To send finished videos to TikTok for review before posting. |
video.publish | Permission to publish videos directly to the connected account, with the caption and privacy level chosen. | To post finished videos on the creator's instruction. |
In addition, TikTok issues an access token and a refresh token that allow the Service to call the TikTok API on behalf of the connected account, and returns post status information (such as publish ID and processing status) after an upload.
Our use of data received from TikTok APIs complies with the TikTok Developer Terms of Service. We use that data only to provide the features you authorized, and we do not use it to build user profiles, for advertising, or for any purpose unrelated to publishing your content.
5. How we use your data
We use personal data only for the following purposes:
- Providing the Service: authenticating the connected TikTok account, uploading and publishing videos, and showing the result of each post.
- Maintaining the Service: refreshing access tokens, monitoring performance, fixing bugs and keeping the Service compatible with changes to the TikTok API.
- Security and abuse prevention: detecting unauthorized access, preventing misuse, and protecting the Service, our users and TikTok's platform.
- Communication: responding to your questions and requests, and sending essential notices about the Service or this policy.
- Legal compliance: meeting obligations under applicable law, responding to lawful requests from authorities, and establishing or defending legal claims.
We do not use personal data for automated decision-making that produces legal or similarly significant effects on you, and we do not sell, rent or trade personal data.
6. Legal bases for processing
Where the law requires a legal basis for processing, we rely on the following:
- Consent: you consent when you authorize NaNaVid on the TikTok consent screen. You can withdraw consent at any time by revoking access (see Section 12). Withdrawal does not affect processing carried out before it.
- Performance of a contract: processing needed to provide the Service you asked for under our Terms of Service.
- Legitimate interests: keeping the Service secure, preventing abuse and improving reliability, where these interests are not overridden by your rights.
- Legal obligation: processing needed to comply with the law.
For users in Vietnam, we process personal data in accordance with the Law on Personal Data Protection and its implementing regulations, including the requirement to obtain the data subject's consent for the purposes stated in this policy.
7. How we share data
We share personal data only in the limited cases below:
- With TikTok: video files, captions and settings are sent to TikTok when you choose to upload or publish. Once posted, content is handled under TikTok's terms and policies.
- With service providers: we use infrastructure providers (such as server hosting and file storage) that process data only on our instructions, under confidentiality obligations, and only as needed to run the Service.
- For legal reasons: if required by law, court order or a lawful request from a competent authority, or to protect the rights, property or safety of NaNaVid, our users or the public.
- Business transfers: if NaNaVid is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction. We will notify you and the receiving party will remain bound by this policy or one at least as protective.
We never share data received from TikTok APIs with data brokers, advertising networks or analytics companies.
8. International transfers
The Service is hosted on servers located in Vietnam. TikTok may process data in other countries under its own policies. Where we transfer personal data across borders, we do so in line with applicable law and take reasonable steps to ensure the data receives an adequate level of protection.
9. Data retention
We keep personal data only for as long as it is needed for the purposes described in this policy.
| Data | Retention period |
|---|---|
| TikTok access and refresh tokens | Until you revoke access or ask us to delete them, or until they expire and are not renewed. |
| TikTok profile data (open ID, display name, avatar) | While the account remains connected; deleted within 30 days after disconnection. |
| Video files staged for upload | Deleted from our temporary storage after a successful upload, and in any case within 30 days. |
| Post status records | Up to 12 months, for troubleshooting and support. |
| Web server and application logs | Up to 90 days, unless needed longer to investigate a security incident. |
| Support correspondence | Up to 24 months after the request is closed. |
When data is no longer needed, we delete it or anonymize it so that it can no longer be linked to you.
10. Security
We use administrative, technical and organizational measures designed to protect personal data against loss, misuse and unauthorized access, disclosure, alteration or destruction. These include:
- encryption in transit using HTTPS/TLS for all pages and API calls;
- storing access tokens on the server only, never in the browser or in public code repositories;
- restricting server access to authorized personnel using strong authentication;
- applying the principle of least privilege to systems and accounts;
- keeping software and dependencies updated and reviewing logs for suspicious activity.
No method of transmission or storage is completely secure. While we work hard to protect your data, we cannot guarantee absolute security.
11. Your rights and choices
Depending on where you live, you may have some or all of the following rights regarding your personal data:
- Access: to know whether we process your data and to receive a copy of it.
- Correction: to ask us to correct inaccurate or incomplete data.
- Deletion: to ask us to delete your data, subject to legal exceptions.
- Restriction and objection: to ask us to limit or stop certain processing.
- Portability: to receive your data in a structured, commonly used format.
- Withdrawal of consent: to withdraw consent at any time, without affecting prior lawful processing.
- Complaint: to lodge a complaint with the data protection authority in your country.
To exercise any right, email us at the address in Section 17. We may need to verify your identity, for example by asking you to confirm ownership of the connected TikTok account. We will respond within 30 days, or within any shorter period required by applicable law. We will not discriminate against you for exercising your rights.
12. Revoking TikTok access and deletion
You can disconnect NaNaVid from your TikTok account at any time:
- Open the TikTok app and go to Profile.
- Tap the menu, then Settings and privacy → Security & permissions → Apps and services permissions.
- Select NaNaVid and tap Remove access.
After access is removed, our tokens stop working and we can no longer act on your account. We delete the stored tokens and profile data within 30 days. If you would like us to delete your data sooner, or to confirm deletion, email us. Videos already published to TikTok remain on TikTok until you delete them there.
13. Cookies and similar technologies
The NaNaVid website is a static website. It does not use advertising cookies, tracking pixels or third-party analytics. Pages load web fonts from Google Fonts, which may receive your IP address and browser information when the fonts are downloaded, under Google's Privacy Policy. If we add cookies in the future, we will update this policy and, where required, ask for your consent first.
14. Children's privacy
The Service is intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
15. Data breach notification
If we become aware of a security incident that affects your personal data and is likely to create a risk to your rights, we will notify affected users and the competent authorities within the time required by applicable law, describe what happened, and explain the steps we are taking in response.
16. Changes to this policy
We may update this Privacy Policy from time to time, for example to reflect changes to the Service, the TikTok API or the law. The "Last updated" date at the top of this page shows when it was last revised. If we make material changes, we will provide a prominent notice on the website before the changes take effect. Your continued use of the Service after that date means you accept the updated policy.
17. Contact us
If you have questions, requests or complaints about this Privacy Policy or our handling of personal data, please contact:
NaNaVid, Privacy
Email: support@dev.pro.vn
Website: https://tiktok.dev.pro.vn
We aim to acknowledge every request within 5 business days.