Privacy notice

This notice says what personal data Tuneflock keeps, why, and what your rights are. The controller is Dipsy BV, Kerkstraat 4, 4901 JG Oosterhout, registered under number KVK 88734323. Questions about your data: [email protected].

1. What we keep

• Your account: your name, your work email, the name and country of your organisation, your role, when you logged in, and a hashed password (never the password itself). With Continue with Google: the name and email Google gives us, nothing else.
• What you add: tracks, artwork, lyrics, links to the official TikTok sound, videos you upload, the countries and budgets you choose, and the videos the platform makes from them.
• What happened: which videos were posted on which accounts and when, and the numbers TikTok reports for them. These are about the sheep, not about you.
• Billing: your invoices and what was paid. Card details go straight to our payment provider (Stripe); we never see or store a card number.
• Technical logs: the address your requests come from, the page, the time and the result, kept briefly (they rotate away within a few weeks) to keep the platform safe and to find faults. No tracking cookies, no advertising pixels, no third-party analytics: the only cookie is the one that keeps you logged in.
• Feedback and mail: the notes you leave on the platform and the mails you exchange with us.

2. Why, and on what ground

• To run your organisation, make and post the videos and show the results: performance of the agreement with you.
• To send the mails the service needs (a password reset, an invitation, a morning letter about your campaigns, a failed payment): performance of the agreement. We send no marketing mail unless you asked for it, and every such mail has an unsubscribe link.
• To keep the platform secure, to find and fix faults, and to improve the videos the platform makes: our legitimate interest, weighed against yours.
• To keep invoices and payment records: a legal obligation (tax law), 7 years.

3. Who else sees it

Your data stays on our own servers in the European Union (Germany), with nightly backups that are kept for 14 days. Some of it reaches partners that work for us, each only for its task and under a contract: the payment provider (Stripe) for payments and invoices; a transactional mail service for the mails above; the posting network that operates the TikTok accounts receives the videos and the sound links, never your account data; video editing and AI services receive the track, the artwork and the lyrics to make the videos and, when you ask for them, the lyrics in time with the music; a music data service receives the track's identifiers to find its official sound and its sound statistics. Where a partner processes data outside the European Economic Area we rely on the European Commission's standard contractual clauses or an adequacy decision. We never sell personal data, and we never hand it to anyone else unless the law obliges us.

4. How long

Your account and what you added stay as long as your organisation exists and for 12 months after it is closed, unless you ask for earlier deletion. Invoices stay 7 years. Logs rotate away within a few weeks; backups within 14 days.

5. Your rights

You can ask to see the data we hold about you, to correct it, to delete it, to receive it in a usable format (the platform has an export of your organisation's data), to limit or object to how we use it, and to withdraw a consent you gave. Mail [email protected]; we answer within a month. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

6. Changes

When this notice changes in a way that matters to you, we say so by email or on the platform before it applies. The date at the top is the date of the current text.