Privacy Policy

1. Who we are

SalesShortcut Inc. ("SalesShortcut", "we", "us") provides an online-presence management platform for small businesses. This policy explains what we collect, why, how we protect it, how long we keep it, and how you can have it deleted. You can reach us at support@salesshortcut.ai.

2. Information you give us directly

• Account information: your name, business name, and email address.
• Your password, stored only as a salted PBKDF2-HMAC-SHA256 hash. We never store or transmit it in readable form.
• Content you upload, such as video files and the captions, hashtags, and replies you write.

3. Information we obtain from TikTok

If you choose to connect a TikTok account, TikTok asks you to authorize SalesShortcut and then gives us access limited to the permissions you granted. We obtain and store the following:

• Account identity. Your TikTok account identifier, username, display name, profile image, whether the account is a business account, and follower count. We use this to show you which account is connected and to address publishing and replies to the correct destination.
• Posting settings. The privacy levels your account allows and whether comments, Duet, and Stitch may be enabled. We read these each time you open the publishing screen so the options we show you match what your account actually permits.
• Your own videos. Identifiers, captions, thumbnails, links, creation times, and comment counts for videos published by the account you connected. We use this to let you choose which of your posts to manage comments on.
• Comments on your own videos. The comment text, the commenter's username, display name and profile image, timestamps, like and reply counts, and any existing replies. We use this to show you your comment inbox and to draft suggested replies.
• OAuth access tokens and refresh tokens. These let us act on your account within the permissions you granted, without ever holding your TikTok password.

We do not collect TikTok direct messages, advertising data, audience analytics, or any data from accounts you have not connected. We do not scrape public TikTok content.

4. How we use this information

We use the information above only to provide the features you asked for: showing you which account is connected, publishing the video content you approve, retrieving comments on your own videos, drafting suggested replies for you to edit, and submitting the replies you approve. We do not sell your data, we do not use it for advertising, and we do not use it to train third-party models.

Comment text and the caption of the related video are sent to Google's Vertex AI to generate a suggested reply. That suggestion is shown to you as an editable draft; it is never sent to TikTok unless you press Send Reply.

5. How we secure it

• All traffic to SalesShortcut is served over HTTPS.
• TikTok access tokens and refresh tokens are encrypted at rest and are never displayed in the interface, written to logs, or stored in your browser.
• The credentials that identify our application to TikTok are held only on our servers and are never sent to a browser.
• Each customer's data is isolated: our database enforces at the schema level that a record can only belong to the account that created it.
• Access to production systems is limited to the employees who need it.
• Publishing actions and replies are recorded in an audit log so you can see what was done on your account and when.

6. Service providers

We use a small number of processors to run the service: Google Cloud (application hosting and the Vertex AI model that drafts reply suggestions), Cloudflare (media storage and content delivery), and Supabase (database hosting). They process data on our instructions and are not permitted to use it for their own purposes. All are located in the United States.

7. Retention

• Account information is kept while your account is open.
• TikTok tokens are kept only while the connection is active. Disconnecting deletes them immediately.
• Cached TikTok videos and comments are kept so your inbox works, and are deleted as soon as you use Delete TikTok data, or when you disconnect and delete.
• Uploaded video files are kept until you remove them, so you can reuse them across posts.
• Publishing and reply audit records are kept for up to 24 months so you have a record of what was published on your behalf.
• When you close your account, we delete your data within 30 days except where we must keep records to meet a legal obligation.

8. Your choices and how to delete your data

You are in control of the connection at all times. From Settings in your workspace you can:

• Disconnect TikTok. We ask TikTok to revoke our access, erase the stored tokens, and stop making any further requests to your account.
• Delete TikTok data. We erase the videos and comments we cached from your account.
• Remove uploaded media. We delete the video files you uploaded from our storage.

You can also revoke SalesShortcut's access from within TikTok's own settings at any time. To ask for anything else — a copy of your data, correction, or full account deletion — email support@salesshortcut.ai from your account address. Step-by-step instructions are on our data deletion page.

9. Cookies

We set one cookie, a signed session cookie that keeps you logged in and carries the token that protects your forms against cross-site request forgery. It is HttpOnly and Secure. We do not use advertising or third-party tracking cookies.

10. Children

SalesShortcut is a business product and is not directed to children. We do not knowingly collect information from anyone under 18.

11. Changes

If we change this policy we will update the date at the top of this page and, for material changes, notify account holders by email.

12. Contact

SalesShortcut Inc., support@salesshortcut.ai