Privacy Policy

1.1 When someone else is responsible

• Business customers. When a business receives a creator's profile, application or campaign content, that business becomes an independent controller of what it receives and of how it is used in its own operations. It is bound by our Terms of Service and by its own GDPR obligations.
• Collabify as a processor. For data we process solely on a business customer's instructions — for example applications and campaign material inside that business's own workspace — we act as a processor under a data processing agreement.
• Connected platforms. TikTok, Shopify, WooCommerce and any other service you choose to connect are independent controllers of your accounts with them and process your data under their own privacy policies.
• A merchant's customers. If you bought something from an online store that uses Collabify, the store (the merchant) is the controller of your purchase; see the Shopify section below.

2.1 Data you give us

• Account data — name, email address, password (held by our authentication provider, never stored by us in clear text), two-factor settings and your role (business or creator).
• Business data — company name, organisation number, contact and billing details, brand names, logos, product catalogue, campaign briefs and budgets, and the people authorised to act for the business.
• Creator profile — display name, profile picture, biography, niches, location, links to your social accounts and the TikTok handle you enter.
• Campaign content — the videos, captions, hashtags and other material you upload, the business's review decisions and the messages exchanged inside a campaign.
• Delivery details — name and shipping address when a campaign involves a physical product being sent to you.
• Identity and signing data — see the BankID and personal identity number section below.
• Payment and payout data — invoices, payment history and customer references at our payment provider (businesses), and payout records and tax details at our payout partner (creators). Card and bank account details are entered directly with the payment or payout provider and are not stored in full by us.
• Support and consent records — support tickets, your acceptance of the terms and this policy, your cookie choices, your messaging preferences and every publish approval you give.

2.2 Data from services you connect

When you connect an account with another service (TikTok for creators; Shopify or WooCommerce for businesses) we receive the data described in the TikTok and other-integrations sections. A connection is never established automatically — it always starts with you approving it on that service's own consent screen.

2.3 Data collected automatically

• Usage data — which views and features are used and when, recorded in our own systems to operate, debug and improve the Service.
• Technical data — IP address, device and browser type, operating system, app version, and crash and error reports. Personal data is redacted at the application boundary before error reports leave our systems.
• Web performance and visit metrics — the page or route visited and anonymous performance metrics, through our hosting provider's built-in measurement.
• Push token — if you turn on push notifications in the app we store the device's push token so the notification can be delivered. A token unseen for about six months is purged as a dead device.
• Cookies — the website today sets strictly necessary cookies only; there are no analytics or marketing cookies to consent to. The app uses no cookies and no advertising identifiers. See the Cookie Policy.

We use no third-party advertising or tracking SDKs in the app, and we build no profiles for advertising purposes.

3.1 Automated decision-making and AI

Collabify ranks and suggests creators for a campaign using a scoring model that weighs niche, audience size and past performance, and can suggest a publishing time. The suggestions are shown to a person who makes the decision. We take no decision that produces legal effects concerning you or similarly significantly affects you based solely on automated processing within the meaning of Article 22.

Businesses can use AI assistance to draft campaign briefs, and a submitted campaign video can be checked by an AI model against the campaign brief as an advisory checklist for the reviewer. In those cases the brief, the draft or the video is sent to the AI provider listed in the sub-processor register, under terms that prohibit using the content for model training. It is always the business's reviewer — never the model — that approves or rejects content.

5.1 What we access, and why

When you connect, TikTok shows you the permissions ("scopes") we request and you decide on TikTok's own screen. We request these 5 permissions and no others:

If a campaign publishes through the TikTok inbox — the only way to attach a native commercial sound in TikTok's own editor — we additionally request the video.upload permission for that connection. It is not part of the standard set above and is never requested unnecessarily.

We also receive an access token and a refresh token that let our servers call TikTok on your behalf. The tokens are encrypted at rest, are used only by our servers, and are never shown to businesses or other users.

5.2 How publishing on your behalf works

Collabify never posts anything to TikTok automatically. Publishing always follows the same steps:

• You upload your campaign video in the Collabify app and the business approves it.
• You open the publish screen in the app. It fetches your current TikTok account information live from TikTok and shows the account (nickname and username) the video will be published to, a preview of the video, the final caption (which you can edit, apart from the paid-partnership disclosure and the campaign's required hashtags), who can see the video (you must choose — nothing is preselected), the commercial content disclosure (every Collabify post is labelled as a paid partnership), whether comments, duets and stitches are allowed (all off unless you turn them on), whether the video is AI-generated, and the exact date and time of publication.
• You confirm by pressing "Publicera" (Publish). In doing so you also accept TikTok's Branded Content Policy and Music Usage Confirmation, which are linked on that screen. We record your approval together with a fingerprint of the video, caption and settings you approved.
• At the time you chose, our servers check your TikTok account information again. If anything you approved is no longer permitted by TikTok (for example a privacy setting or an interaction you enabled), nothing is published and you are asked to review the post again. Otherwise we send exactly the approved video, caption and settings to TikTok's Content Posting API.
• You can cancel or change a scheduled post in the app at any time before it is published. After publication the post lives on your TikTok account and is under your control like any other post.

We do not add watermarks, logos or promotional text to your video, and we do not alter your video before sending it to TikTok.

5.3 What we share with TikTok, and where TikTok data is shown

When you publish, we send TikTok the video file, the caption and the settings you approved. When we read your profile or video statistics, we send TikTok your access token and the ids of the videos concerned. TikTok processes this as an independent controller under its own Privacy Policy and Terms of Service. TikTok's European operation is established in the United Kingdom and Ireland — see the section on international transfers.

• Your TikTok display name, username, profile picture, follower count and biography are shown on your Collabify creator profile, which businesses can see when recruiting for campaigns.
• Your TikTok statistics (followers, likes, video count, and average views and engagement across your ten most recent public videos) and those ten videos are shown on your own profile in the app and, as a snapshot taken at the moment you apply, to the business reviewing that application. We refresh them when you connect, when you apply, daily while your account is connected, and when you press "Uppdatera statistik". Collabify never shows businesses self-reported figures: a creator is either verified through TikTok or shown as unverified.
• The performance of a campaign video (views, likes, comments, shares) is shown to you and to the business running that campaign and is used to calculate campaign results, prize-pool shares and payouts. We store periodic snapshots of those numbers for the duration of the campaign and its settlement.
• We do not share your TikTok data with anyone else, and we never sell it.

5.4 Disconnecting and deleting TikTok data

You can disconnect TikTok at any time in the app (Profile → TikTok → Disconnect). When you do, we revoke our authorisation at TikTok and then delete your TikTok connection with us, including the access and refresh tokens. You can also remove Collabify from your TikTok account under Manage app permissions in TikTok's settings; we detect the revocation and treat the account as disconnected.

Disconnecting does not delete videos already published to your TikTok account — those are yours and you manage them on TikTok. Records of a campaign you took part in (which post was published, when, with which caption and settings, and how it performed) are kept for as long as the retention section says, because they document a paid collaboration and a payout. Deleting your Collabify account disconnects TikTok automatically.

6.1 Shopify and WooCommerce

When a business connects a Shopify or WooCommerce store we process the store domain, store name and store admin email address to link the store to the business's Collabify account and authenticate API calls, plus a mirror of product titles, images, prices and variants so campaigns can reference real products.

For discount codes minted for a campaign we process the code, the redemption count and the redemption timestamps, so that both the business and the creator can follow how the code performs. For orders attributed to a campaign code we process the order id, order totals, currency and the redeemed code, for commission settlement and fraud prevention. We receive this through Shopify's orders/* webhooks — we never query Shopify's Customer API for it. The buyer's email address is stored encrypted (AES-256-GCM with a keyed hash for lookup) and is automatically redacted by a weekly job after 18 months; the order record itself is kept as an accounting artefact.

Product samples in physical-product campaigns. When a creator accepts an offer for a physical product we create a zero-value order in the business's own Shopify store, carrying the creator's name and shipping address, so the business can send the sample. As soon as that order exists in the store, the business is an independent controller of it, exactly as for any other order in that store, and the creator's address is then also covered by the store's own privacy policy.

Uninstalling. When a store uninstalls the app its access token is wiped immediately and the connection itself is deleted 48 hours later, via Shopify's mandatory shop/redact webhook. The 48-hour window covers an accidental uninstall without leaving an unused token in place for longer than necessary.

If you are a customer of a merchant that uses Collabify, you exercise your rights through the merchant's and Shopify's own process, because the merchant — not Collabify — is the controller of your purchase. Shopify relays the request to every app installed on the store, including Collabify, through the mandatory customers/data_request and customers/redact webhooks. We act on them automatically, without you needing to contact Collabify directly.

6.2 Other social platforms

Collabify publishes to TikTok only. If we open a connection to another platform we will update this policy and the sub-processor register before it can be used, and you will approve the permissions yourself on that platform's own consent screen.

9.1 Exceptions to the right to erasure

Article 17(3)(b) GDPR carves out the right to erasure where processing is necessary to comply with a legal obligation. In Sweden that is primarily the Accounting Act and tax legislation. When you request erasure we therefore go through each data category and do one of the following:

• Delete the record where no legal obligation prevents it.
• Keep the record but minimise the personal data in it where it is an accounting or tax artefact: the amounts, dates and audit chain remain, while identifying fields are nulled or pseudonymised. Once the statutory period expires the record is deleted outright.
• Keep the record as evidence where the record itself is the proof of a compliance event — a consent granted or withdrawn, or the erasure request itself. Deleting it would defeat its only purpose.
• Assess the record case by case where erasure would touch someone else's data, for example in a conversation between two parties.

You are always told which categories were kept and on what basis. A small number of tables do not yet have a final retention decision; for those we apply a case-by-case assessment rather than automatic deletion or indefinite retention, and the decision is recorded in the retention schedule once it is made.

10.1 How to do it in practice

• Delete your account. The app has "Radera konto" (Delete account) under Settings. A request stays cancellable for 14 days; after that the deletion runs automatically, your connections to TikTok and other services are revoked, and your data is deleted or minimised according to the exceptions above. If the app shows that self-service deletion is not yet switched on for your account, we carry out the deletion on request to privacy@collabify.se within the same timeframe. Some live commitments — an active campaign or an unpaid payout — must be closed first, and the app tells you exactly what is blocking and where to resolve it.
• Access and portability. A self-service data export exists in the platform (/api/dsar/export) but is being rolled out in stages. Until it is switched on for your account, request your copy by writing to privacy@collabify.se and we will deliver it in a machine-readable format.
• Other rights. Write to privacy@collabify.se. Telling us which right you want to exercise saves us both a round of questions.
• Complaints. You can go to IMY without contacting us first.

We acknowledge your request within 72 hours and answer within one month of receiving it. Where a request is complex that period can be extended by two months, and we will tell you within the first month if it is (Art. 12(3)). We may need to verify your identity before disclosing data — we will not ask for more information than that requires.