Privacy Policy — Postiz Akorda

1. Who is responsible for your data

The data controller for this instance is Albert Álvarez Estellés, self-employed (autónomo) in Spain, based in Valencia (Spain), operating under the Akorda brand (akorda.es). Contact email: [email protected]. Phone: +34 624 724 746.

For any privacy question or request — including access, rectification, erasure, or the deletion of TikTok data described below — write to [email protected].

2. What this service is

Postiz Akorda is not a public SaaS product and does not offer open registration to the general public: access is restricted to authorized users, and the operator may disable public registration entirely. It is used to centrally prepare, schedule, publish and review content on social-media accounts that their owners have expressly authorized.

The application integrates TikTok through TikTok Login Kit (OAuth authorization) and the Content Posting API (uploading, scheduling and publishing videos and photos). It only ever accesses TikTok accounts whose holders have expressly authorized the application via OAuth.

3. Data the application receives from TikTok

When a TikTok account is connected, TikTok sends the application, via its official API, only the data needed to operate the integration:

• Basic profile data of the authorized account as returned by TikTok (account identifier such as open_id / business id, username or display name, profile image, and account statistics where the granted scopes include them).
• OAuth access and refresh tokens that allow the application to act on behalf of the authorized account (for example, to publish a scheduled post or refresh analytics).
• The list of permissions (scopes) granted by the account holder. Depending on the TikTok integration enabled on this instance, the application requests some or all of the following scopes: user.info.basic, user.info.profile / user.info.username, user.info.stats, video.list, video.upload, video.publish.
• Content and metadata strictly necessary to prepare, upload, schedule and publish posts (videos, photos, captions, posting settings such as privacy level or comments preferences, and scheduling information).
• Aggregated analytics returned by TikTok for the connected account and its posts (such as views, likes, comments, shares and follower counts), shown inside the application.

4. Account and technical data

In addition to the TikTok data above, the application stores the data needed to run the private service: name, email address and organization of authorized users; the posts, schedules and settings they create; and basic technical logs (such as IP address, browser type and timestamps) used for security and operation.

5. Purposes of processing

Personal data is processed exclusively for the following purposes:

• Operating the service: authenticating authorized users, storing and organizing their content, and publishing it to the connected TikTok accounts at the scheduled time.
• Showing analytics and publishing history for the connected accounts.
• Keeping the service secure (detecting abuse, failed logins and incidents) and providing support to authorized users.
• Complying with applicable legal obligations.

6. Legal basis

The legal basis is the express authorization (consent) given by the TikTok account holder when connecting the account through TikTok OAuth, which can be withdrawn at any time as described in section 10; the provision of the service to authorized users; and the legitimate interest of the operator in keeping the service secure.

7. What we never do with TikTok data

TikTok data is never sold, rented or shared for commercial purposes. It is never used for advertising, for creating profiles of individuals, or for any purpose other than providing the scheduling and publishing service described here.

8. Where data is stored and who receives it

This instance runs on its own server (Dokploy). Application data, including TikTok OAuth tokens and scheduled content, is stored in the instance PostgreSQL database, and uploaded media is stored on the server own storage volume. Connections to the service use HTTPS. No third-party analytics, advertising or email-marketing providers are enabled on this instance by default.

Data is disclosed only to: TikTok itself, when content is published to, or analytics are requested from, the connected TikTok account (TikTok own policies then apply to data on its platform); the hosting infrastructure strictly necessary to run the server; and public authorities where legally required.

9. Retention

Account data is kept while the user account is active. TikTok OAuth tokens are kept only while the TikTok integration remains connected or is otherwise still needed to provide the service. When a channel is deleted in Postiz, its access tokens are removed from the database and the channel record is marked as deleted and excluded from any further use. Disconnecting or disabling a channel without deleting it only pauses its use: the stored credentials are kept solely to allow reconnection and are not used for posting. Data is deleted sooner upon a verified erasure request sent to [email protected], except where the law requires longer retention.

10. How to revoke TikTok access

You can revoke the application access to your TikTok account at any time, with immediate effect for future posts:

• By deleting the TikTok channel inside Postiz Akorda (this removes its access tokens from our database; merely disconnecting or disabling the channel only pauses its use).
• Directly in your TikTok app, under settings for authorized third-party applications.
• By writing to [email protected] requesting disconnection and deletion of the associated data.

11. Your rights

Under the GDPR and the LOPDGDD you have the right to access your data, rectify inaccurate data, request erasure, object to or request restriction of processing, and request portability. To exercise any of these rights, write to [email protected] indicating your request. If you consider that your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (AEPD, aepd.es).

12. TikTok policies

TikTok is an independent service with its own rules. Use of TikTok through this application is also governed by the TikTok Terms of Service (https://www.tiktok.com/legal/terms-of-service) and the TikTok Privacy Policy (https://www.tiktok.com/legal/privacy-policy). TikTok acts as an independent controller for the data processed on its own platform.

13. Changes to this policy

This policy may be updated to reflect changes in the service or in the TikTok integration. The current version is always available at https://postiz.akorda.es/privacy-policy, with its effective and last-updated dates shown at the top.