Privacy Policy

Last Updated: April 9, 2026

QIAYA Social Content Agent (the "Service") is operated by Qiaya ("we", "us", or "our"). We are committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, how we store and protect it, and your rights regarding your data.

1. Information We Collect

1.1 TikTok Account Information

When you connect your TikTok account via OAuth 2.0 authorization, we collect the following data based on the scopes you grant:

Data Category	Specific Data	Purpose	TikTok Scope
Basic Profile	Display name, avatar, Open ID	Identity verification & UI display	user.info.basic
Auth Credentials	Access Token, Refresh Token	Making API calls on your behalf	OAuth flow
Video Data	Published video IDs, titles, status	Publish management & tracking	video.publish
Engagement Metrics	Views, likes, comments, shares	Performance analytics	video.list

1.2 Service Usage Data

• Your activity within the Service (e.g., publish requests, data sync operations)
• AI-generated content (scripts, video metadata)
• Server logs for troubleshooting and performance optimization

1.3 Information We Do NOT Collect

2. How We Use Your Information

We use the collected information strictly for the following purposes:

• Providing Core Service — Video generation, content publishing, data synchronization.
• Analytics — Video performance tracking, content effectiveness analysis.
• Service Improvement — Improving AI-generated content quality and publishing strategies.
• Technical Operations — Troubleshooting, security monitoring, system optimization.

We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes.

3. Data Ownership

Your data belongs to you. In accordance with the TikTok for Developers Terms of Service, we acknowledge that all user data obtained through TikTok's APIs is owned by the respective users. We act solely as a data processor on your behalf and within the scope of your authorization.

4. Third-Party Services and Data Sharing

To provide the Service, we interact with the following third-party services:

Provider	Data Shared	Purpose
TikTok (ByteDance)	OAuth tokens, video content	Video publishing & data retrieval
DeepSeek	Brand info, content topics (no PII)	AI script generation
Alibaba Cloud DashScope	Video script descriptions (no PII)	AI video generation
Supabase	Business data (encrypted)	Cloud database storage

5. Data Storage and Security

• Your data is stored in Supabase-hosted PostgreSQL databases with TLS encryption in transit and AES-256 encryption at rest.
• OAuth tokens and other sensitive credentials are stored encrypted and are never exposed in logs or error messages.
• We implement reasonable technical and organizational measures including access controls, audit logging, and regular security reviews.
• Only authorized personnel with a legitimate need can access user data, and they are bound by confidentiality obligations.

6. Data Retention

Data Type	Retention Period	Deletion Trigger
OAuth Credentials	Until revoked or expired	Authorization revocation or token expiry
Video Publish Records	Duration of service use	Account deletion request
Analytics Data	Duration of service use	Account deletion request
Server Logs	Maximum 90 days	Automatic purge
AI-Generated Content	Duration of service use	Account deletion request

7. Your Rights

You have the following rights regarding your data:

• Right to Access — You may request a copy of all data we store about you.
• Right to Deletion — You may request deletion of all your data. We will process deletion requests within 30 calendar days and send a confirmation email upon completion.
• Right to Revoke Authorization — You may revoke TikTok OAuth authorization at any time through your TikTok settings.
• Right to Data Portability — You may request your data in a commonly used, machine-readable format (JSON or CSV).
• Right to Withdraw Consent — You may withdraw consent for any specific data processing at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at support@qiaya.net. We will respond within 15 business days.

8. Data Breach Notification

In the unlikely event of a data breach that may affect your personal data, we will:

• Notify affected users via email within 72 hours of discovering the breach.
• Provide details about what data was affected and what remedial steps we are taking.
• Report the breach to relevant regulatory authorities as required by applicable law.

9. Cookies and Local Storage

The Service's frontend pages may use browser local storage (localStorage) to maintain your session state. We do not use third-party tracking cookies or any cross-site tracking technologies.

10. Children's Privacy

The Service is not directed at individuals under the age of 18 (or the applicable age of majority). We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a minor, we will promptly delete such data.

11. International Data Transfers

Your data may be processed in jurisdictions outside of your country of residence due to our use of cloud-based third-party services. We ensure that appropriate safeguards are in place to protect your data in accordance with applicable data protection laws.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised "Last Updated" date. For material changes, we will notify you via email or prominent notice within the Service at least 15 days before the changes take effect.

13. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:

Email: support@qiaya.net

Website: www.qiaya.net

We aim to respond to all inquiries within 15 business days.