Privacy Policy
In short: we collect the minimum needed to send your media to TikTok as a draft: your TikTok open_id and display name, the access tokens TikTok issues to the App, and the media files you choose to send. We do not sell, rent or share your data for advertising. You can revoke access and ask for deletion at any time.
1. Controller
CheriffAI, an artificial intelligence company based in Brazil, is the controller of the personal data processed through CheriffAI Publisher (the “App”), under the Brazilian General Data Protection Law (Law 13.709/2018 — LGPD) and other applicable laws.
2. Data we collect
| Data | Source | Purpose |
|---|---|---|
TikTok open_id and display name (scope user.info.basic) | TikTok Login Kit, after you authorize | Identify which TikTok account is connected and show it in the App |
| Access token and refresh token issued by TikTok | TikTok OAuth | Call the Content Posting API on your behalf (scope video.upload) |
| Videos and photos you choose to send | You, inside the App | Upload them to your TikTok inbox as drafts |
| Technical logs (IP address, date/time, request, browser) | Automatically, by our hosting | Security, abuse prevention and troubleshooting |
We do not access your TikTok password, followers, messages, comments, analytics, or any data of other TikTok users. We do not use advertising or tracking cookies.
3. How we use TikTok data
Data obtained from TikTok is used only to provide the App’s features described above: showing the connected account and sending your chosen media to TikTok as drafts. It is never sold, never used for advertising or profiling, and never used to train AI models.
4. Legal bases
- Performance of the service you requested (LGPD art. 7, V) — connecting your account and sending drafts;
- Consent (art. 7, I) — given on TikTok’s authorization screen, revocable at any time;
- Legitimate interest (art. 7, IX) — security logs and abuse prevention.
5. Storage and security
Tokens are stored encrypted in Amazon Web Services (AWS Systems Manager Parameter Store, SecureString) and are never exposed in the browser or in public storage. Connections use HTTPS. Access to credentials is restricted.
6. Sharing
We share data only with the service providers needed to run the App: TikTok (the destination of your drafts, via its official API) and Amazon Web Services (hosting, located in the United States). This may involve international transfer under LGPD art. 33. We do not sell or rent personal data.
7. Retention and deletion
- Tokens: kept while your account is connected; deleted when you revoke access or request deletion.
- Media files: kept only as long as needed to deliver the draft to TikTok, and deleted on request.
- Technical logs: kept for a short period for security, then discarded.
How to revoke and delete: remove the App in TikTok (Settings → Security → Manage app permissions) and/or e-mail cheriffaiagent@gmail.com asking for deletion. We complete deletion within 15 days.
8. Your rights
You may request confirmation of processing, access, correction, anonymization, blocking or deletion, portability, information about sharing, and withdrawal of consent (LGPD art. 18; equivalent rights under GDPR/CCPA where applicable). You may also complain to Brazil’s data protection authority (ANPD).
9. Children
The App is not directed to anyone under 18, and we do not knowingly collect data from minors.
10. Changes
We may update this Policy. The date at the top shows the current version; material changes will be highlighted on this website.
11. Contact
Privacy requests: cheriffaiagent@gmail.com · WhatsApp +55 11 97029-7366. We usually reply within 15 days.