Privacy Policy

Effective date: 11 October 2026. Last updated: 11 October 2026. Version: 2026-10-11.

The short version

• We keep only what we need to send your videos to your own TikTok inbox and to bill Pro plans.
• We cannot see your TikTok videos, followers, messages, comments or analytics.
• Your videos are deleted from our server right after TikTok confirms it received them. Videos you never send are deleted after 7 days.
• We do not sell or share your personal data, and we use no analytics, advertising or tracking cookies.
• "Delete my data" on the Account page deletes your account, TikTok access, videos and history right away.

1. Who is responsible for your data

Delvir Limited Liability Co. is responsible for your information in Promoflow and decides how and why it is used. Our details are at the top of this page. For any privacy question or request, email team@delvir.co.

This policy covers Promoflow only. TikTok and Stripe handle data under their own privacy policies when you use their services.

2. What we collect

From TikTok when you sign in

We ask TikTok for two permissions: user.info.basic and video.upload. From these we receive:

• Your TikTok account id (called an open_id), display name and a link to your avatar.
• Access and refresh tokens that let us send videos to your own TikTok inbox as drafts.

When you use Promoflow

• Video files you upload, or that we place in your library for you.
• Send history: file name, file size, date, status and TikTok's delivery reference for each send.
• Consent record: the Terms version you accepted at sign-up (for example "2026-10-11") and when you accepted, plus the time you gave consent for each send.

When you buy Pro

• Your Stripe customer id, subscription id, plan, status, renewal date, and the email address used for the purchase.

Stripe collects your card details directly. They never touch our servers.

Server logs

• Error and send events, recorded with an internal account number. Logs never contain your TikTok tokens or video content.

3. What we do not collect

• Your videos, followers, messages, comments or analytics on TikTok. Our permissions do not allow it.
• Your email address or phone number from TikTok.
• Your card number. Stripe handles it.
• Data from analytics, advertising or tracking tools. We do not use any, and the site loads no third-party scripts or fonts.

4. How we use your data

• To sign you in and show which TikTok account is connected.
• To preview your videos and send them to your own TikTok inbox when you ask.
• To count your sends against your plan's monthly limit.
• To take payments, send receipts, and send renewal reminders before each yearly renewal.
• To keep records of your consent, fix errors, and keep the Service secure.
• To keep billing records the law requires.

We do not use your data for advertising, and we never post, publish, schedule or change anything on your TikTok account.

5. Who receives your data

We use these processors. They act on our instructions and only for the purposes below.

• Hosting (United States): our own server, where your account, videos and history are stored.
• Payments (Stripe, United States): processes Pro payments, refunds and the billing portal.
• Email delivery (United States): sends receipts and renewal reminders to the email used for your purchase.

Their names are available on request (other than Stripe, named above) at team@delvir.co.

TikTok is the platform you connect. When you press "Send to my TikTok", we send that video to TikTok so it can appear in your inbox. TikTok's own terms and privacy policy govern your TikTok account and what TikTok does with your videos. Promoflow is not affiliated with or endorsed by TikTok.

We may also disclose data when the law requires it (see section 12), or as part of a business transfer (see section 14).

6. We do not sell or share your personal data

We do not sell or share your personal information. We do not sell your personal data, and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). We have not done so in the past 12 months.

7. Cookies

We use only two cookies, both strictly necessary:

• Sign-in cookie: keeps you signed in. Lasts 30 days.
• Checkout-link cookie: links a Pro purchase made before you sign in to your account. Lasts 24 hours.

We use no analytics of any kind (cookie-based or cookieless), no advertising or tracking cookies, and no third-party scripts or fonts. Because these cookies are strictly necessary, we do not show a cookie banner. Blocking them will stop sign-in or purchase linking from working.

8. Logs and hosting

Promoflow runs on our own server, hosted in the United States. Like any website, our server sees your IP address while it handles each request. The web server does not keep access logs of visitors' IP addresses.

Our server records errors and send events with an internal account number, never tokens or video content. These logs are kept for up to 30 days.

When you visit TikTok or Stripe pages (for example, to sign in or pay), those services may log your visit under their own policies.

9. How long we keep your data

How long we keep it, for each kind of data:

• TikTok account id, display name and avatar link: until your account is deleted.
• TikTok access and refresh tokens: until you press Disconnect (we also ask TikTok to revoke them) or delete your data.
• Video files: deleted right after TikTok confirms it received the video. Videos you never send are deleted automatically after 7 days. You can delete any video at any time.
• Send history: until you delete it or delete your data.
• Consent record: kept with your account and deleted with it.
• Billing records (Stripe customer id, subscription id, plan, status, renewal date, purchase email): while your account exists, and for up to 7 years after where tax and accounting law requires.
• Server logs: up to 30 days.
• Cookies: 30 days (sign-in) and 24 hours (checkout link).

10. Disconnecting and deleting

Disconnect on the Account page deletes your TikTok tokens and asks TikTok to revoke them. You can also remove Promoflow's access in your TikTok app settings.

Delete my data on the Account page deletes your account, tokens, videos and send history right away. If you have an active Pro plan, its renewal is cancelled first. Billing records we must keep for tax and accounting are kept as described in section 9.

11. Security

• TikTok access and refresh tokens are encrypted at rest with AES-256-GCM.
• The site is served only over encrypted connections (HTTPS).
• Card details go straight to Stripe and never reach our servers.
• Logs never contain tokens or video content.
• Videos are kept only as long as needed to preview and send them.

No system is perfectly secure. We cannot guarantee that data will never be accessed without permission.

12. Data breaches

If a breach affects your personal data, we will tell you without undue delay, and notify the relevant authorities, as the law requires. We will tell you what happened, what data was involved, and what we are doing about it. We notify by email where we hold one for you, and on the site.

13. Legal requests

We disclose personal data to authorities only when we are legally required to, such as under a valid court order or subpoena, or when it is needed to protect someone's safety.

Before we disclose your data, we tell you first where the law allows, so you can object.

We can only produce what we hold. Because videos are deleted after delivery and the web server keeps no access logs of IP addresses, we usually hold very little.

14. Business transfer

If Delvir or this product is sold or merged, or reorganised, your data may pass to the successor. The successor must keep protecting it under this policy, and we will give notice by email or on the site before your data becomes subject to a different policy.

15. International transfers

We are based in the United States, and your data is stored and processed in the United States. If you are in the European Economic Area and United Kingdom (or Switzerland), your data is transferred to the United States. Where required, those transfers rely on the standard contractual clauses approved by the European Commission (and the UK addendum to them).

16. Your rights

Wherever you live, you can see, download, correct or delete your data. Most of this you can do yourself on the Account page. For anything else, email team@delvir.co. We may need to confirm the request comes from the account holder. We respond within the time the law requires.

EU, UK and Swiss residents (GDPR and UK GDPR)

We rely on these legal bases:

• Contract: to run the Service you signed up for, including sign-in, storing and sending videos, plan limits, payments, and the logs needed to fix errors.
• Consent: for each send to TikTok. You give it by ticking the consent box. You can withdraw consent before a send by not sending, or by deleting the video.
• Legal obligation: to keep billing records for tax and accounting.

You have the right to access, correct, delete, restrict or object to processing of your data, to receive it in a portable format, and to withdraw consent at any time (this does not affect sends made before you withdrew).

You also have the right to complain to your local data protection supervisory authority. In the EU, the European Data Protection Board lists each country's authority at edpb.europa.eu. In the UK, it is the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to help first at team@delvir.co.

California residents (CCPA/CPRA)

In the past 12 months we collected these categories of personal information: identifiers (TikTok account id, internal account number, purchase email), commercial information (plan and billing records), and user content (videos and send history). We collected them from you, from TikTok when you signed in, and from Stripe when you paid, for the purposes in section 4. We disclosed them to the processors in section 5 for business purposes only.

You have the right to know, access, correct and delete your personal information, and the right not to be treated differently for using these rights. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you. You may use an authorised agent; we may ask the agent for proof of your permission.

Other US states

If your state gives you similar privacy rights, email us and we will honour them as your state's law requires, including any right to appeal a decision.

17. Children

Promoflow is not for anyone under 18, and it is not directed to children under 13. We do not knowingly collect personal data from children. If you believe a child has used the Service, email team@delvir.co and we will delete the account and its data.

18. Changes to this policy

We may update this policy. For material changes, we give at least 30 days' notice by email or on the site before they take effect. Each version has a new date and version id at the top of this page.

19. Contact

Privacy questions and requests: team@delvir.co, or Delvir Limited Liability Co., 30 N Gould St, Ste R, Sheridan, WY 82801, USA.

See also our Terms of Service.