Privacy Policy
Last updated: July 16, 2024
1. Information We Collect
ExportTok ("we", "our", or "us") collects information to provide and improve our TikTok comment export service. We act as the data controller for personal data processed in connection with the Service.
Information You Provide
- Account information: email address, password (hashed), display name
- Billing information: name, billing address, tax ID (if applicable) — collected and processed by our payment processor, not stored on our servers
- Support correspondence: any information you provide when contacting our support team
Information Collected Automatically
- Service usage data: video URLs submitted for export, export format selected, feature usage (AI analysis triggers), timestamps, and quota consumption
- Device and connection data: browser type, operating system, IP address, and device identifiers
- Cookies and tracking: session cookies for authentication, optional analytics cookies (see Section 5)
2. How We Use Your Information
We process your information for the following purposes:
- Providing and maintaining the ExportTok service, including account management and authentication
- Processing your subscription and payments through our payment processor
- Tracking usage and enforcing monthly quota limits
- Sending transactional emails (account verification, billing receipts, subscription status changes)
- Responding to your support requests
- Detecting and preventing fraud, abuse, or security incidents
- Complying with legal obligations
We will not use your personal data for any purpose incompatible with those listed above without your explicit consent.
3. Legal Basis for Processing
Under applicable data protection laws (including GDPR for users in the European Economic Area), we process your personal data on the following legal bases:
- Contract performance: Processing necessary to provide the Service to you under our Terms of Service
- Legitimate interests: Fraud prevention, security, and service improvement (balanced against your rights)
- Consent: Marketing communications; non-essential cookies (you can withdraw consent at any time)
- Legal compliance: Retaining payment records as required by applicable law
4. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy. The following table summarizes retention periods:
| Data Category | Retention Period | Deletion Method |
|---|---|---|
| Account data (email, name, password hash) | Until account deletion + 90 days | Secure overwrite |
| Export history / submitted URLs | 90 days after export | Permanent deletion |
| Usage records (API calls, timestamps) | 12 months | Permanent deletion |
| Payment and billing records | 7 years (per applicable tax law) | Permanent deletion |
| Support correspondence | 3 years after case closure | Permanent deletion |
| Inactive accounts (no login >2 years) | Immediately upon inactivity detection | Permanent deletion |
5. Cookies
We use cookies to operate the Service. You can control or disable cookies through your browser settings, but some features may not function properly without them.
| Cookie Type | Purpose | Duration | Required |
|---|---|---|---|
| Authentication | Keeps you logged in during your session | Session | Yes |
| Preferences | Remembers your UI preferences (e.g., theme) | 30 days | No |
| Analytics | Aggregated usage statistics (no personal data shared with third parties) | 12 months | No |
6. Third-Party Services and Data Processors
We share your data only with the following third-party service providers, each acting as a data processor under our instructions:
- Waffo Pancake (waffo.ai) — PCI-DSS-compliant payment processor and merchant of record. Handles payment card processing, tax collection, and invoice generation. We do not store your payment card details on our servers. Privacy Policy: waffo.ai/privacy
- DeepSeek — Third-party AI model provider powering our AI sentiment analysis and keyword extraction features. Processes data (TikTok video URLs and comment text) only for the purpose of generating AI analysis results.
- TikTok — Data source. ExportTok accesses only publicly available TikTok comment data at your request.
- ServerChan / SendGrid (or equivalent email provider) — Email delivery for transactional and notification emails.
We do not sell, rent, or trade your personal data to any other third parties.
7. Data Security
We implement appropriate technical and organizational security measures to protect your personal data, including:
- TLS/HTTPS encryption for all data in transit
- Encryption or hashing of sensitive data at rest (passwords, payment tokens)
- Access controls limiting data access to authorized personnel only
- Regular security reviews and monitoring
No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
8. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data. To exercise any of these rights, contact support@tiktokexport.tech.
| Right | Description | Response Time |
|---|---|---|
| Access | Request a copy of all personal data we hold about you | Within 30 days |
| Rectification | Request correction of inaccurate or incomplete data | Within 30 days |
| Erasure ("Right to be Forgotten") | Request deletion of your personal data (subject to legal retention requirements) | Within 30 days |
| Data Portability | Request your data in a structured, commonly used, machine-readable format | Within 30 days |
| Objection to Processing | Object to processing based on legitimate interests | Within 30 days |
| Withdraw Consent | Withdraw consent for optional processing (e.g., marketing) at any time | Immediate effect |
| Lodge a Complaint | File a complaint with your local data protection authority | N/A (contact authority directly) |
Users in the European Economic Area additionally have the right to request restriction of processing and the right to data portability. Contact support@tiktokexport.tech for any of these requests.
9. International Data Transfers
ExportTok is operated from a primary jurisdiction. Your data may be transferred to and processed in countries outside your own (including outside the EEA). When we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or equivalent legal mechanisms, in accordance with applicable data protection law.
10. Children's Privacy
ExportTok is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a minor, we will delete that data promptly. If you believe a minor's data has been collected, contact support@tiktokexport.tech.
11. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by applicable law (e.g., GDPR Article 33).
Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify affected users directly (at your registered email address) without undue delay, describing the nature of the breach, likely consequences, and the measures we have taken or propose to take.
12. Contact Us
For privacy-related questions, data subject rights requests, or breach notifications, contact:
- Email: support@tiktokexport.tech (include "Privacy Request" in the subject for data rights)
- Response time: We acknowledge all privacy requests within 2 business days and respond within 30 days
For additional information, see our FAQ, Terms of Service, and Acceptable Use Policy.