Legal

Privacy Policy

This Privacy Policy explains how Pikus Media AB processes personal data when you use PM Automatic TikTok Ads Manager (ATAM, the Service).

1. Data controller

2. Our role for B2C and B2B services

When an individual uses ATAM directly, Pikus Media AB normally acts as the controller for the account and Service data described below. When an agency or other Business Customer uses ATAM to manage personal data on behalf of its own client, that Business Customer may be the controller and Pikus Media AB may act as its processor for the instructed processing. Where required, this processing is governed by a separate data processing agreement. Pikus Media AB remains a controller for its own account administration, security, billing and legal-compliance processing.

3. Data we process

Depending on the features you use and permissions you grant, we may process:

• ATAM account information, such as name, email address, phone number, organization, user type, billing country, role and account status;
• TikTok identifiers, display name and profile image made available through authorized TikTok APIs;
• metadata for public TikTok videos authorized through the video.list permission, such as video identifier, title, cover image, URL, publication time and public metrics;
• TikTok for Business advertiser identifiers, campaign configuration, status, budget and performance data when an advertising integration is separately enabled and authorized;
• OAuth authorization data, including granted scopes, access tokens, refresh tokens and token-expiry information;
• ATAM configuration, including selected accounts, goals, targets, limits, workflow states and confirmations;
• technical and security data, such as timestamps, IP address, browser information, authentication events, audit records and error categories;
• subscription, invoice and payment-status information for Pikus Media AB services. Full card numbers and CVV codes are processed by the payment provider and are not stored by ATAM.

ATAM does not ask for or store your TikTok password or TikTok two-factor authentication code.

4. Sources of data

We receive data directly from you; from TikTok after you authorize specific permissions; from TikTok for Business after separate advertiser authorization; automatically from your use of ATAM for security and service operation; and from service providers used for hosting, authentication, billing or support.

5. Purposes and legal bases

We process personal data to:

• create and operate your ATAM account and provide requested features — performance of a contract;
• connect TikTok, display authorized profile and video information, and perform workflows you request — performance of a contract and your TikTok authorization;
• protect accounts, enforce limits, prevent fraud, investigate incidents and maintain audit logs — our legitimate interests in securing the Service and users;
• provide support and communicate about the Service — performance of a contract and legitimate interests;
• administer subscriptions, invoices, accounting and legal obligations — performance of a contract and compliance with law;
• improve reliability using aggregated or minimized operational information — legitimate interests;
• send optional marketing communications — consent where required.

You may withdraw optional consent at any time. Withdrawal does not affect processing already performed lawfully.

6. TikTok permissions and user control

ATAM requests only permissions needed for enabled features. The initial TikTok Login Kit integration uses user.info.basic to identify and display the connected TikTok account and video.list to display the connected user's public TikTok videos.

Approval of a scope for ATAM does not itself grant access to your data. Access begins only after you approve the requested permission in TikTok. You may deny optional permissions or revoke access later.

OAuth tokens are stored server-side in encrypted form and are not returned to the browser, included in public URLs or intentionally written to application logs.

7. Advertising data and automated actions

TikTok Login Kit does not by itself authorize advertising purchases. Any future advertising feature requires separate TikTok for Business authorization and clear in-product controls.

ATAM does not perform an enabled paid action unless the applicable account permissions, safety limits and workflow confirmations are satisfied. ATAM does not use solely automated decision-making that produces legal or similarly significant effects about an individual.

8. Sharing and processors

We disclose data only as necessary to TikTok when you request actions or data through TikTok services; hosting, infrastructure, security, authentication, support and billing providers acting under appropriate agreements; professional advisers and public authorities when required by law; or a successor in a merger, acquisition or restructuring, subject to applicable safeguards.

We do not sell TikTok user data or personal data. We do not share it for unrelated third-party advertising. If a provider processes data outside the EEA, we use a lawful transfer mechanism where required.

9. Retention and deletion

• Short-lived OAuth state and authorization codes are used only to complete and secure the authorization flow and then expire.
• TikTok access and refresh tokens are retained while the connection remains active and are deleted or rendered unusable after confirmed disconnection.
• Cached TikTok profile and video data is refreshed as needed and deleted within 30 days after account deletion or confirmed disconnection, unless a shorter period is required by TikTok.
• Security and audit logs are normally retained for up to 12 months unless needed longer for an active investigation or legal claim.
• Billing and accounting records are retained for the period required by applicable law.
• Backups are rotated and deleted according to the backup schedule, normally within 90 days.

When immediate deletion from an active backup is not technically possible, the data is isolated from normal use and deleted when that backup expires.

10. Security

We use measures appropriate to the risk, including encryption in transit, server-side token storage, encryption of sensitive authorization references, access controls, least privilege, rate limiting, CSRF protection, audit logging, network restrictions and safety switches for sensitive workflows.

No online service can guarantee absolute security. Contact hej@pikus.media immediately if you suspect unauthorized access.

11. Your rights

Subject to applicable law, you may have the right to access your personal data, correct inaccurate data, request deletion, restrict or object to processing, receive portable data where applicable, withdraw consent, and complain to a data-protection authority.

To exercise your rights, email hej@pikus.media. We may need to verify your identity. In Sweden, the supervisory authority is Integritetsskyddsmyndigheten (IMY).

12. United States privacy rights

Residents of certain U.S. states may have rights to request access, correction, deletion or a copy of personal data, and to appeal a denied request, subject to applicable law and exemptions. ATAM does not sell personal data and does not use or disclose it for unrelated cross-context behavioral advertising. We do not use sensitive personal data to infer characteristics about individuals. Requests and appeals may be sent to hej@pikus.media; an authorized agent may submit a request where applicable.

13. Children

ATAM is intended only for adults aged 18 or older, whether they use the Service as Consumers or for a business. We do not knowingly offer ATAM accounts to children.

14. Cookies

ATAM uses strictly necessary cookies or equivalent storage for authentication, session security, preferences and CSRF protection. Optional analytics or marketing technologies will not be activated without any consent required by law. Details will be presented in the live Service when such technologies are enabled.

The atam_lang preference cookie stores the language selected by the user (English or Polish) for up to 12 months. It contains no account identifier and is not used for analytics, advertising or cross-site tracking.

15. Changes

We may update this Privacy Policy to reflect legal, technical or service changes. The current version and effective date will remain available on the official ATAM website. We will provide additional notice where required.

16. Contact and complaints

Questions and privacy requests may be sent to hej@pikus.media or raised by phone at +46 73 975 65 50. You may also lodge a complaint with IMY or your local supervisory authority.