Privacy Policy

1.1 Information You Provide Directly

Account registration: When you create an account, we collect your full name, email address, and a password. Passwords are hashed using industry-standard bcrypt encryption before storage. We never store plaintext passwords and cannot retrieve them.

Profile information: You may optionally provide your business name, shop name, and contact preferences used to personalize your dashboard and communications.

Support communications: If you contact us for support, we retain records of that correspondence, including any information you provide about your shop or account situation.

1.2 Information From TikTok

OAuth authorization tokens: When you connect your TikTok Shop, TikTok issues us an access token and refresh token. These tokens are encrypted and stored server-side. They are used exclusively to fetch data from TikTok on your behalf and are never exposed to your browser or shared with any third party.

Shop identity data: We receive and store your TikTok Shop ID, seller ID, shop name, and shop region from TikTok's API at the time of connection.

Product listing data: To perform compliance scans, we retrieve your product titles, descriptions, image URLs, categories, and associated metadata from TikTok's product API. This data is used exclusively for scanning and is not shared or sold.

Violation notices: If you provide violation notices you have received from TikTok, we store those to help generate appropriate appeal content.

1.3 Information Generated By Our Service

Scan results: When you run a compliance scan, we generate and store the results including which listings were scanned, which policy rules were checked, and any potential violations identified. Results are tied to your account and visible only to you.

Appeal drafts: When you use the AI Appeal Drafter, we store the input you provided and the AI-generated draft. You retain full control over whether to send any appeal.

Appeal outcomes: If you record the outcome of an appeal, we store that information to help improve our violation detection patterns in aggregated, anonymized form only.

1.4 Automatically Collected Information

Log data: Our servers automatically record your IP address, browser type and version, operating system, referring URL, pages visited, and time spent on pages.

Cookies and session data: We use essential cookies to maintain your login session. We do not use advertising or tracking cookies. You may disable cookies in your browser settings, but doing so will prevent you from using the Service.

Usage analytics: We collect anonymized data about how features are used to improve the Service. This data cannot be linked back to individual users.

1.5 Payment Information

Subscription payments are processed entirely by Stripe, a PCI DSS Level 1 certified payment processor. We never receive, see, or store your credit card number, CVV, or bank account details. We receive only a payment confirmation, your Stripe customer ID, and your subscription status. For questions about payment data, see Stripe's privacy policy at stripe.com/privacy.

We use the information we collect for the following purposes:

• Providing the Service: To create and manage your account, connect to your TikTok Shop, perform compliance scans, generate violation alerts, and produce AI-assisted appeal drafts.
• Authentication and security: To verify your identity, maintain session security, and detect and prevent fraudulent or unauthorized use.
• Payment processing: To manage your subscription, process renewals, handle failed payments, and issue refunds where applicable.
• Customer support: To respond to your questions and resolve issues.
• Service improvement: To analyze aggregated, anonymized usage patterns to identify bugs and improve features.
• Legal compliance: To comply with applicable laws and respond to lawful requests from authorities.
• Communications: To send transactional emails and, with your consent, product updates. You may unsubscribe from non-transactional emails at any time.

We do not: sell your personal information, use your listing content for advertising, share your shop data with TikTok competitors, or use your data to train AI models.

TikTok Shop Guard uses Claude, an AI model operated by Anthropic, PBC, to power the Appeal Drafter feature. When you request an appeal draft, we transmit the following to Anthropic's API:

• The product listing title and description you selected
• The violation type and policy category identified
• Any additional context you choose to provide in the appeal form

This data is transmitted over an encrypted connection. Anthropic processes it solely to generate the appeal response. We do not send personally identifiable information such as your name, email, or TikTok credentials to Anthropic. Per Anthropic's API terms, content submitted via the API is not used to train their models. See anthropic.com/privacy for more information.

AI-generated appeal drafts are suggestions only. You remain responsible for reviewing, editing, and approving any content before submitting it to TikTok.

We do not sell, rent, or trade your personal information. We share information only in the following limited circumstances:

4.1 Service Providers

• Supabase (Supabase, Inc.): Database, authentication, and backend infrastructure. Your data is stored with row-level security enforced. Hosted in the United States.
• TikTok Open Platform (ByteDance Ltd.): We make API calls to TikTok on your behalf using your OAuth tokens to retrieve shop and listing data for scanning.
• Anthropic, PBC: AI processing for the Appeal Drafter feature. See Section 3.
• Stripe, Inc.: Subscription billing and payment processing. PCI DSS Level 1 certified.
• Vercel, Inc.: Web hosting and deployment infrastructure.

4.2 Legal Requirements

We may disclose your information if required by law, to protect the rights or safety of Metamorphosis LLC or our users, or to investigate violations of our Terms of Service.

4.3 Business Transfers

If Metamorphosis LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

• Account and profile data: Retained while your account is active and for 90 days after deletion.
• Scan results and violation history: Retained while your account is active. You may delete individual scans at any time.
• Appeal drafts: Retained until you delete them or close your account.
• OAuth tokens: Immediately invalidated and deleted when you disconnect your shop, revoke access through TikTok, or delete your account.
• Payment records: Retained for 7 years to comply with financial record-keeping requirements.
• Server logs: Retained for 90 days for security monitoring, then automatically deleted.

To request full account deletion, email support@tiktokshopguard.com with the subject "Account Deletion Request." We will process your request within 30 days and confirm when deletion is complete.

• Encryption in transit: All data is encrypted using TLS 1.2 or higher between your browser and our servers.
• Encryption at rest: OAuth tokens and sensitive credentials are encrypted using AES-256 before storage.
• Password security: Passwords are hashed using bcrypt with a minimum cost factor of 12.
• Row-level security: Our database enforces policies that ensure your data is accessible only to your account.
• Token isolation: TikTok OAuth tokens are stored exclusively server-side and never transmitted to the client browser.
• Access controls: Internal access to production data requires multi-factor authentication and is restricted to essential personnel.

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at support@tiktokshopguard.com.

7.1 Access and Portability

You may request a copy of the personal information we hold about you by contacting support@tiktokshopguard.com. We will provide it in a machine-readable format within 30 days.

7.2 Correction

You may update your name, email, and profile information at any time through your account settings.

7.3 Deletion

You may delete individual scans and appeal drafts from your dashboard. To delete your entire account, email support@tiktokshopguard.com.

7.4 TikTok Connection

You may disconnect your TikTok Shop at any time from your account settings, which immediately revokes our access and deletes all stored OAuth tokens. You may also revoke access directly through TikTok under Connected Apps.

7.5 California Residents (CCPA/CPRA)

California residents have the right to know what personal information we collect and how we use it, request deletion, opt out of the sale or sharing of personal information (we do not sell or share your data), and not be discriminated against for exercising these rights. Contact support@tiktokshopguard.com to exercise these rights. We will respond within 45 days.

7.6 EEA, UK, and Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, you have rights under applicable data protection law including the right to object to processing, restrict processing, and lodge a complaint with your supervisory authority. Our legal bases for processing are your consent, contract performance, legal obligation, and legitimate interests. Contact us to exercise these rights.

We use essential cookies for authentication and session management. The Service cannot function without these. We do not use advertising cookies, tracking pixels, or third-party analytics that track you across websites.

TikTok Shop Guard is intended for adults aged 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a minor, we will delete it promptly. Contact support@tiktokshopguard.com if you believe a minor has provided us with personal information.

Metamorphosis LLC is based in the United States. If you access the Service from outside the United States, your information may be transferred to and processed in the United States. By using the Service, you consent to this transfer. We take reasonable steps to ensure your data is handled securely regardless of where it is processed.

When we make material changes to this policy, we will post the updated version here with a new effective date, send an email notification to your registered address, and display a notice within the Service for 30 days. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us:

We will respond to all privacy-related inquiries within 30 days. For urgent security concerns, include "URGENT" in the subject line.