Privacy Policy

Last updated: 16 August 2026

ShortSera (“we”, “us”) is operated by ShortSera, registered in the Netherlands under KVK number 99819600, at Hoge Hagt 73, 8162 CB Epe, Nederland. This policy explains what personal data we collect, why, and what you can do about it. For questions, contact help@shortsera.com.

Data we collect

• Account data. Your email address and an encrypted password hash, or a Google account identifier if you sign in with Google.
• TikTok connection data. When you connect a TikTok account we receive, from TikTok, an access token, a refresh token, your TikTok open ID, username, display name, avatar URL, and public profile counts (followers, following, likes, videos). We never receive or ask for your TikTok password.
• Content you upload. Video files, captions and hashtags you add to the library, and the publishing settings you choose per account.
• Metrics. Daily snapshots of your public TikTok profile counts and of your videos’ public view, like, comment and share counts, retrieved via TikTok’s API. We store these because TikTok’s API returns only current values and provides no history.
• Operational logs. Timestamps, error codes and outcomes of publishing attempts, retained so failed posts can be diagnosed and retried.

How we use it

Solely to run the service: authenticating you, publishing content to the TikTok accounts you have connected, showing you analytics over time, and diagnosing failures. We do not sell personal data, we do not use your content to train machine-learning models, and we do not share your data with advertisers.

TikTok data specifically

Data obtained through TikTok’s APIs is used only to provide features you have explicitly asked for, in line with TikTok’s Developer Terms of Service. Access and refresh tokens are encrypted at rest with AES-256-GCM and are never exposed to your browser or to other users. You can revoke our access at any time from TikTok: Profile → Settings and privacy → Security & permissions → Apps. Revoking immediately stops us being able to read data or publish on that account.

Sub-processors

• Supabase — database, authentication and file storage (EU region).
• Vercel — application hosting.
• TikTok / ByteDance — the destination platform, when you publish.

Retention

Account and content data is kept while your account is open. Delete your workspace and we remove your uploaded videos, captions, scheduled posts and TikTok tokens within 30 days. Operational logs are kept for 90 days. Aggregate, non-identifying usage counts may be kept longer.

Your rights

Under the GDPR you may request access to, correction of, export of, or erasure of your personal data, and you may object to processing. Email help@shortsera.com and we will respond within 30 days. You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens.

Security

Data is encrypted in transit with TLS and at rest. TikTok tokens receive an additional layer of application-level encryption. Access to production data is limited to those who need it to operate the service.

Children

ShortSera is not directed at anyone under 18 and we do not knowingly collect their data.

Changes

We will post material changes here and email you before they take effect.