1. Who is responsible
Aiden Azraya, an individual based in Sweden is the controller of the personal data processed by CreatorFlow AI Studio, and decides why and how it is processed. Privacy requests, including access, export and erasure: aidenazraya@gmail.com. No data protection officer has been appointed; the processing described here does not meet the conditions in Article 37 GDPR that make one mandatory.
2. In short
- CreatorFlow never asks for or stores a TikTok password. Access to TikTok comes only from TikTok’s own authorisation screen.
- TikTok access tokens are encrypted before they reach the database and never appear in the interface, in exports or in logs.
- No data is sold, no advertising is shown, no profiling is done, and your content is not used to train machine-learning models.
- No decision about you is made automatically, and nothing is published without your approval.
- Disconnecting an account asks TikTok to revoke the token and deletes it locally.
- You can export everything and delete your account yourself, from Settings, without asking anyone.
- Everything CreatorFlow stores is held in the EEA. Publishing a post sends it to TikTok, and using the AI assistant sends your brief to the AI provider, which may process it elsewhere. Section 7 sets out both, and what has not been verified.
3. What CreatorFlow collects, and whether you have to provide it
Everything below is either given by you, generated by your use of the Service, or received from TikTok after you authorise it. Nothing is bought from anyone, and nothing is collected from other sites.
Registering and signing in
| Data | Where it comes from | Required? |
|---|---|---|
| Email address | You, at registration. Confirmed by opening a link sent to it. | Required — there is no account without it. |
| Password | You. It is sent through CreatorFlow’s server to the authentication provider, which stores only a cryptographic hash. CreatorFlow does not store it, does not log it and cannot read it back. It is sent again, the same way, when you confirm deletion of your account. | Required. |
| Your acceptance of the Terms and this policy | The tick box on the registration form. The date and the version you accepted are recorded with your sign-in identity. | Required — registration is refused without it. |
| Display name, workspace name | You, during first-run setup. | Required, to label your account and your workspace. |
| What you make, and what you want to use CreatorFlow for | You, during first-run setup. | Optional. They only change which hints the interface shows, and you can clear them in Settings. Nothing is withheld if you skip them. |
| Timezone | Your browser, offered as a default you can change. | Required in effect: dates and the calendar need one. A fixed default is used if it is not supplied. |
| Rate-limit counters derived from your IP address, your email address or your account identifier | Your request. The value is never stored: it is combined with a secret key, hashed, and only the hash becomes a counter. The hashes cannot be turned back into an address. | Required. Registration, sign-in, password reset, uploads and AI requests are refused without them, because they are what stops the Service being abused. |
Using the Service
- Workspace: workspace name, timezone, routine settings and each member’s role.
- Account records: for each TikTok account managed — nickname, niche, timezone, internal notes and the member designated as its owner. These exist before any TikTok connection and are your own records, not TikTok’s data.
- Content: uploaded videos and their technical metadata (duration, resolution, frame rate, codec, size), thumbnails generated from them, titles, rights and licence notes, content ideas, planned dates, scripts, captions and hashtags.
- Work records: onboarding checklists (your content ideas, your observations, your notes), timer sessions (start time, heartbeats, end time and the seconds counted), and post-publication review checklists and learnings.
- Publishing records: scheduled times, privacy and interaction choices, who approved a post and when, a snapshot of exactly what they approved, every status change, and each attempt sent to TikTok with any error returned.
- AI prompts and drafts: the brief you type in the Content Studio and the draft returned, stored with the model name, token counts and estimated cost.
- Imported metrics: any CSV of performance figures you upload, stored with its source recorded as a manual import.
- Notifications addressed to you inside the application.
- Audit log: an append-only record of significant actions in a workspace — who connected or disconnected an account, who approved, scheduled or cancelled a post, who changed a member’s role — with the actor, the target and the time. Secrets are stripped before anything is written to it.
- Technical logs: the application writes operational log lines with secrets removed. Separately, the hosting provider records requests, which can briefly include your IP address, as any web server does.
- Support messages: if you email the operator, that email and its contents.
Verification and password-reset emails are sent to the address on your account through the authentication provider’s email delivery. Which mail provider actually delivers them in production has not been confirmed, so none is named here — see section 15.
4. What CreatorFlow receives from TikTok
Data is received only after an account owner completes TikTok’s authorisation screen, and only for the permissions granted there.
This deployment currently requests these permissions:
| Permission | What it returns | Why it is requested |
|---|---|---|
user.info.basic | Your TikTok user identifier (open_id), display name and avatar image URL. | To confirm which account was authorised, show it in your account list, and stop the same TikTok account being linked to two records. |
Publishing is not enabled on this deployment, so the posting permissions video.publish and video.upload are removed from the authorisation request even if they are configured.
Where publishing is enabled, CreatorFlow also stores an access token, a refresh token and their expiry times, and the identifier TikTok assigns to each publishing attempt with its status. When an access token is close to expiry it is renewed automatically using the stored refresh token, through TikTok’s documented refresh grant; if that is no longer possible the account is marked as needing to be connected again. Webhook notifications from TikTok are stored with sensitive fields removed.
CreatorFlow does not request or receive your followers, your direct messages, your watch history, your feed, or data about other TikTok users.
5. What CreatorFlow sends to TikTok
Only when an account owner approves a specific post, and only for that post:
- the selected video file, uploaded to TikTok or fetched by TikTok from a verified address;
- the caption and hashtags written for it;
- the privacy level and the comment, Duet, Stitch, branded-content and AI-label settings chosen for it.
Before each post CreatorFlow asks TikTok for the creator’s current options so it never sends a setting TikTok would reject. Disconnecting an account sends a revocation request for the stored token. No other requests are made on your behalf.
6. Why your data is processed, and on what basis
| What is processed | Why | Legal basis (GDPR Article 6) |
|---|---|---|
| Email address, password, acceptance record, display name, workspace, timezone | To create and run your account and your workspace | Performance of a contract, Art. 6(1)(b). Necessary: there is no Service without it. |
| Ideas, drafts, uploaded videos and their metadata, planned dates, work records, publishing records, imported metrics | To provide the features you are using | Performance of a contract, Art. 6(1)(b) |
| What you make and what you want to use CreatorFlow for | To tailor the hints shown in the interface | Consent, Art. 6(1)(a). Optional, withdrawable by clearing them in Settings, and refusing changes nothing else. |
| Your brief, when you use the AI assistant | To generate the draft you asked for | Performance of a contract, Art. 6(1)(b), for a feature you choose to use each time. The rest of CreatorFlow works without it. |
| TikTok connection, stored tokens, and acting on a connected account | To connect your account and publish what you approve | Your authorisation given on TikTok’s screen, and your in-app approval of each post, Art. 6(1)(a) — withdrawable at any time, in either place |
| Rate-limit counters, the audit log, operational logs | To keep the Service available and secure, stop automated abuse of registration, sign-in, uploads and AI requests, and let members of a shared workspace see who did what in it | Legitimate interests, Art. 6(1)(f) — see the note below this table |
| Support messages you send | To answer you | Legitimate interests, Art. 6(1)(f), in responding to your own enquiry |
| Anything the law requires to be kept or disclosed | To meet a legal obligation | Legal obligation, Art. 6(1)(c) |
About the legitimate interests. They are specifically: keeping CreatorFlow available and secure; preventing automated abuse of registration, sign-in, password reset, uploads and AI generation, which would otherwise be free to run at the operator’s expense; and giving the members of a shared workspace an honest record of who changed what. The data used for them is deliberately minimal — rate limits keep only a keyed hash, never your address — and you can object to processing based on legitimate interests at any time (section 11). A written balancing assessment has not been produced yet; see section 15.
No special categories of data under Article 9 are asked for, and CreatorFlow is not designed to hold any. No automated decision-making or profiling within the meaning of Article 22 takes place: nothing about your account is decided by a machine, and the AI assistant drafts text for you to edit rather than deciding anything. Rate limits refuse a single request when a fixed count is exceeded and have no other effect.
7. Where your data is processed, and who processes it
Application servers: Vercel, arn1 (Stockholm, Sweden).
Database and uploaded files: Supabase, eu-central-1 (Frankfurt, Germany).
Both of those locations are inside the European Economic Area, as are the queue and the background worker named in the table below. Everything CreatorFlow stores about you — your account, your workspaces, your schedule, your uploaded videos — is therefore stored in the EEA.
What leaves the EEA, and when
Storing data in the EEA is not the same as every action staying there, and this policy does not treat the hosting regions above as an answer on their own.
- Publishing to TikTok. When you approve a post, the video and its caption go to TikTok, which operates globally and processes them under its own privacy policy as an independent controller, not as a processor for CreatorFlow. This is the point of the Service; it cannot be avoided while still publishing. Connecting an account sends the same way the limited profile data in section 4.
- Using the AI assistant. The brief you type is sent to Anthropic. CreatorFlow uses that provider’s standard global endpoint and does not request a specific processing region, so an individual request may be processed on infrastructure outside the EEA, including in the United States. Which region handles a given request is decided by the provider and is not reported to CreatorFlow, so this policy does not claim that any particular request stayed in, or left, the EEA. Only the brief described in the table below is sent — never your videos, your access tokens or your TikTok account data. If that is not acceptable to you, do not use the Content Studio; the rest of CreatorFlow works without it.
- Provider support access. The hosting, database, queue and worker providers are companies established outside the EEA, even where the servers they run for CreatorFlow are inside it. Whether, and from where, their staff can access data held on those servers for support or maintenance has not been verified by the operator, so this policy does not claim that no such access occurs. It is listed in section 15.
There is no European Commission adequacy decision that these transfers rely on. Vercel and Supabase publish data processing agreements that incorporate the Commission’s standard contractual clauses (Vercel, Supabase). Whether those agreements are in force for this deployment has not been recorded, so this policy does not present them as a completed safeguard — see section 15. You can ask at the privacy address above for the current position before you rely on it.
| Processor | What it handles |
|---|---|
| Vercel | Runs the web application and its server code; request logs may briefly contain IP addresses. |
| Supabase | Database, authentication (including the password hash and the verification and password-reset emails), and private file storage for videos and thumbnails. |
| Managed Redis provider (Redis Cloud) | Background job queue, running in eu-central-1 (Frankfurt, Germany). It holds job references such as a post identifier — which are still personal data — and never your content or your credentials. |
| Background worker host (Railway) | Runs the publishing pipeline in europe-west4-drams3a (Amsterdam, Netherlands). It reads scheduled posts and the videos attached to them, and decrypts the stored TikTok access token in order to publish on your behalf. It is the same code as the web application, running continuously so that scheduled posts go out when they are due rather than only while someone has the site open. |
| AI model provider (anthropic) | Receives only the brief you type: the kind of draft requested, niche, topic, audience, tone, format, desired length, your instructions, and — when you ask it to revise something you already have — the working title and current hook of that draft. It does not receive your videos, your access tokens or your TikTok account data. Anthropic’s published commercial policy is that it deletes API inputs and outputs within 30 days of receipt or generation, with stated exceptions, for example where a request is flagged for a policy violation. CreatorFlow has not agreed any shorter retention with it. May process this outside the EEA, as this section explains. |
| TikTok | The integration described in sections 4 and 5. TikTok processes that data under its own privacy policy, as an independent controller. |
No analytics service, advertising network, tag manager or third-party tracking script is used anywhere in CreatorFlow — there is none in the application’s code. Web fonts are served from CreatorFlow’s own domain, so visiting a page makes no request to a font provider.
8. How long data is kept
| Data | Retention |
|---|---|
| Your account and profile | Until you delete your account, which you can do yourself at any time (section 10). |
| TikTok access and refresh tokens | Until you disconnect the account, TikTok reports authorisation was removed, the account record is deleted, or the workspace is deleted — whichever happens first. The database row is deleted at that moment. |
| Authorisation request state | Stored hashed, usable once, and expires after 10 minutes. |
| Uploaded videos and thumbnails | Until you delete the video or the workspace. |
| Account, onboarding, timer, content, publishing, AI-generation and metric records | For the life of the workspace, so your history and audit trail stay intact. |
| Audit log | Append-only for the life of the workspace. Individual entries cannot be edited or deleted; they are removed only when the workspace is deleted. |
| Rate-limit counters | Deleted automatically once their window is more than two days old. They contain a keyed hash and a count, never an address. |
| Operational logs, and the hosting provider’s request logs | Kept for the period the hosting provider applies to its own logs, which the operator does not control and has not fixed by contract. CreatorFlow does not query or retain them itself. |
| Support email | Kept in the operator’s mailbox for as long as needed to deal with the matter and any follow-up. |
| Provider backups | The hosting and database providers keep their own backups on their own schedules. Deleted data can persist in those backups until they expire, and that is outside the operator’s direct control. |
9. Revoking TikTok access
There are two routes, with the same effect on CreatorFlow’s side:
- In CreatorFlow: open the account and choose Disconnect. CreatorFlow calls TikTok’s revoke endpoint, deletes the stored tokens, marks the account disconnected and pauses its scheduled posts. If the call to TikTok fails, the local tokens are still deleted, so CreatorFlow can no longer use them — but you should also remove the app in your TikTok settings to be certain the authorisation is gone at TikTok’s end.
- In TikTok: remove CreatorFlow in your TikTok account settings. TikTok notifies CreatorFlow, which deletes the stored tokens, marks the account revoked and pauses its scheduled posts. The same happens automatically if TikTok rejects a token.
Revoking stops all future access. Records of what was already published, and the audit trail, remain until you delete them.
10. Deleting and exporting your data
- One TikTok account record: open it, choose Delete and type the nickname to confirm. Any authorisation is revoked and that account’s onboarding history, posts and reviews are removed.
- A video: delete it in the Media Library and the stored file is removed. Videos attached to published posts are kept as part of the publishing history.
- A whole workspace: a workspace owner can delete it in Settings → Data and privacy, typing the workspace name to confirm. Database records are removed in a single transaction; the stored files are then deleted one by one.
- Your account: in Settings → Account, choose Delete my account, type
DELETEand re-enter your password. This deletes your sign-in identity, your profile, your setup answers, your notifications, and every workspace where you are the only member, together with its content and media. Your membership of workspaces other people also use is removed, and TikTok account records you owned there are left without an owner rather than deleted out from under your colleagues. - Export: Settings → Data and privacy exports a machine-readable copy of the workspace, or of your own personal data. Neither export includes access tokens.
- By request: write to aidenazraya@gmail.com.
Known limitations, stated rather than glossed over. Deleting your account is refused while you are the only owner of a workspace other people still use; transfer ownership or remove the other members first. Deleting a workspace removes its database rows in one transaction and then deletes its stored files one by one — if deleting an individual file fails, that deletion is not retried automatically, so write to aidenazraya@gmail.com and it will be completed by hand. Deletion does not reach the providers’ own backups, which expire on their schedules. Deleting your CreatorFlow account does not delete anything already published on TikTok, and does not delete your TikTok account.
11. Your rights
Under the GDPR you have the right to:
- ask for a copy of your personal data, and for information about how it is processed;
- have inaccurate data corrected, and incomplete data completed;
- have your data erased;
- have processing restricted while a dispute about it is resolved;
- receive the data you provided in a structured, machine-readable format, and have it transmitted to another controller where that is technically feasible;
- object to processing based on legitimate interests (section 6);
- withdraw consent at any time where processing rests on it, without affecting what was done lawfully beforehand.
The export and deletion features in section 10 let you exercise access, portability and erasure yourself, immediately. For anything else, write to aidenazraya@gmail.com. Requests are handled by one person reading email, not by an automated system; the operator will reply without undue delay and within one month, and will tell you if more time is genuinely needed. There is no charge, and the operator may ask you to confirm you control the account before acting on a request.
You may also complain to a supervisory authority. In Sweden, where the operator is established, that is Integritetsskyddsmyndigheten (IMY), imy.se. You can also complain to the authority in the EU or EEA country where you live or work.
12. Security
- TikTok access and refresh tokens are encrypted with AES-256-GCM before storage, using a key held outside the database.
- Every database query made for a signed-in user runs under database-enforced row-level security, so one workspace cannot read another’s data even if application code is wrong.
- The table holding credentials is not readable by the application’s database role at all, and it is excluded from every export.
- Uploaded videos are stored in a private bucket with no direct client access, and are reachable only through short-lived signed links.
- Passwords are hashed by the authentication provider; CreatorFlow neither stores nor logs them.
- Registration, sign-in, password reset, uploads and AI requests are rate-limited, and the counters hold only keyed hashes.
- The TikTok authorisation flow is bound to your browser session and to a single-use server-side record, so an authorisation link cannot be replayed or used by someone else.
- Webhook deliveries are verified by signature and timestamp before being accepted.
- Secrets are stripped from application logs and from the audit trail.
No system is perfectly secure, and this one is maintained by one person. It is designed so that the failure of a single layer does not expose data, but no guarantee of absolute security is given, and nothing here is a certification or a claim of compliance with any security standard. If you find a security problem, write to aidenazraya@gmail.com.
13. Cookies and browser storage
CreatorFlow sets only cookies that are strictly necessary to provide the Service. There are no advertising, profiling or third-party analytics cookies, and none of these is used to track you across other sites.
| Cookie | Purpose |
|---|---|
sb-* | Keeps you signed in, set by the authentication provider. |
cf_session | Keeps you signed in when the local demo sign-in is used instead. |
cf_ws | Remembers which workspace you are viewing. |
cf_oauth_state | Short-lived; protects the TikTok authorisation flow against cross-site request forgery. |
cf_recovery | Short-lived; proves you arrived from a valid password-reset link, so only you can set the new password. |
The registration pages also keep the email address you just typed in your browser’s session storage, so the “check your email” page can show it. It never leaves your browser and is discarded when you close the tab.
Because every cookie above is strictly necessary to deliver a service you requested, no consent is required under the Swedish Electronic Communications Act (lagen om elektronisk kommunikation 2022:482), and no consent banner is shown — adding one for cookies that need no consent would be misleading rather than careful. If anything non-essential is ever added, consent will be collected first and this section will change.
14. Age
CreatorFlow is not directed at children and is not for anyone under 18. No age verification is performed beyond the requirement in the Terms of Service and the statement you accept at registration. If the operator learns that data about someone below that age is held, it will be deleted.
15. What this policy cannot state yet
These are disclosures that are not settled. They are listed because an honest gap is more useful than a confident sentence that has not been checked, and each one names what has to happen before it can be answered.
- Processor contracts. Whether a data processing agreement under Article 28 GDPR is in force with each provider named above has not been recorded. The agreements the providers publish are linked, but this policy does not claim them as a completed safeguard.
- Postal address. A postal address for the operator has not been published yet. Swedish law requires one for a service offered online, and it will be added here before registration opens.
- Email delivery. Verification and password-reset emails are sent through the authentication provider. Which mail provider actually delivers them in production has not been confirmed, so this policy names none.
- Provider support access. Whether the hosting, database, queue or worker providers’ staff can reach data on the servers they run for CreatorFlow from outside the EEA, and under what controls, has not been verified. Section 7 therefore makes no claim either way.
- Legitimate-interests assessment. The balancing assessment that Article 6(1)(f) expects has not been written down for the security and audit processing in section 6. The processing itself is described accurately above.
16. Changes to this policy
If this policy changes, the effective date at the top of the page changes with it, and material changes will be notified in the application, and by email where reasonably possible, before they take effect.
17. Contact
Privacy questions and requests: aidenazraya@gmail.com. This policy takes effect on 2026-10-29 and is published at https://creatorflow.lol/privacy.