Privacy Policy

This Privacy Policy explains how TAB Publisher (the "Service"), available at https://post.tab-media.ro, collects, uses, stores and protects personal data. The Service lets you connect your TikTok accounts, upload videos, write captions, choose posting settings and publish those videos to TikTok, either directly or as drafts in your TikTok inbox, at a time you choose. We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable Romanian law.

1. Who is responsible for your data

The data controller for the Service is:

• TĂBĂCARU INVESTMENTS GROUP S.R.L., operating as TAB Media
• Registration / tax ID: CUI 50671185, Reg. Com. J2024029452004
• Address: Str. Tudor Vladimirescu, Moinești, jud. Bacău, România
• Email: denis@tabgroup.ro

You can contact us at the email address above about anything in this policy, including to exercise your rights.

2. What data we collect

We only collect the data needed to run the Service:

• Account data: the email address and login details you use to sign in to the Service.
• TikTok account data (received from TikTok when you connect an account): your TikTok open_id (a unique identifier TikTok assigns to you for our app), display name, username and avatar (profile picture) URL.
• TikTok authorization tokens: the OAuth access token and refresh token TikTok issues so the Service can post on your behalf. These are encrypted at rest using AES-GCM.
• Content you upload: the video files you choose to publish.
• Post settings: the captions, privacy level, interaction settings (comments, duet, stitch), commercial content disclosure choices and scheduled publishing time you set for each video.
• Publishing records: the status of each publish attempt (for example queued, processing, published or failed), error messages returned by TikTok, and the TikTok publish and post IDs.
• Technical data: basic server logs generated by our hosting provider (such as IP address, request time and browser type), used only for security and troubleshooting.

We do not collect your TikTok password. We do not read your TikTok messages, followers, likes or viewing history, and we do not use analytics or advertising trackers.

3. Why we use your data and our legal basis

• To provide the Service (sign-in, connecting TikTok accounts, uploading, scheduling and publishing your videos, showing you the publish status). Legal basis: performance of a contract with you (Art. 6(1)(b) GDPR).
• To keep the Service secure (preventing abuse, investigating errors, protecting tokens). Legal basis: our legitimate interest in operating a secure service (Art. 6(1)(f) GDPR).
• To comply with legal obligations (for example responding to lawful requests from authorities, keeping records required by law). Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• To connect your TikTok account and publish on your behalf.We only do this after you explicitly authorize the Service on TikTok's consent screen and, for each video, after you press the publish or schedule button. You can withdraw this authorization at any time (see section 5).

We do not sell your data, rent it, or use it for advertising or profiling.

4. TikTok data specifically

The Service uses TikTok Login Kit and the TikTok Content Posting API. When you connect a TikTok account, you are asked by TikTok to grant the following permissions (scopes):

• user.info.basic — to read your open_id, display name and avatar so we can show you which account you are posting to.
• video.upload — to send videos to your TikTok inbox as drafts, which you then finish and post in the TikTok app.
• video.publish — to publish videos directly to your TikTok profile with the settings you chose.

We use TikTok data only to provide the features you request. We do not add watermarks, logos or promotional content to your videos, and we do not modify your videos. We do not share TikTok data with third parties other than the processors listed in section 7. Your use of TikTok remains subject to TikTok's own terms and privacy policy.

5. Disconnecting TikTok and deleting your data

• Disconnect an account: you can disconnect a TikTok account from the Service at any time. When you do, we revoke the tokens with TikTok and delete them from our database.
• Revoke from TikTok:you can also remove the Service's access from the TikTok app settings (Settings and privacy > Security > Apps and services, or similar).
• Delete everything: email us at denis@tabgroup.ro from the address linked to your account and we will delete your account and all associated data within 30 days.

Deleting data from the Service does not delete videos already published on TikTok. You can delete those directly in the TikTok app.

6. How long we keep data

• Video files: stored only until TikTok has fetched them for publishing, then deleted. Files for posts that are cancelled or fail are deleted as well.
• TikTok tokens and profile data: kept while the TikTok account is connected; deleted immediately when you disconnect it or delete your account.
• Captions, settings, schedules and publishing records: kept while your account is active so you can see your posting history, and deleted when you delete your account.
• Server logs: kept for a short period by our hosting provider for security purposes, in line with its standard retention.

7. Who processes data for us

We use a small number of service providers:

• Cloudflare, Inc. — hosting (Cloudflare Workers), database (Cloudflare D1) and temporary file storage (Cloudflare R2). Cloudflare acts as our data processor under a data processing agreement.
• TikTok (TikTok Technology Limited / TikTok Pte. Ltd. and affiliates) — when you connect an account and publish, data is exchanged with TikTok as necessary to authorize you and post your content. TikTok processes that data under its own privacy policy.

We may also disclose data where required by law or to protect our rights, for example in response to a valid court order.

8. International transfers

Cloudflare operates a global network and TikTok operates outside the European Economic Area, so your data may be processed in countries outside the EEA, including the United States. Where this happens, transfers are protected by appropriate safeguards such as the EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw any consent or authorization you gave, at any time, without affecting past processing.

To exercise these rights, email denis@tabgroup.ro. We will reply within one month. You also have the right to lodge a complaint with the Romanian data protection authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, Romania, www.dataprotection.ro, or with the authority in your EU country of residence.

10. Cookies

We use only one strictly necessary cookie: a session cookie that keeps you signed in. It is required for the Service to work, so it does not need consent. We do not use analytics, advertising or tracking cookies.

11. Security

• All traffic is encrypted in transit with HTTPS.
• TikTok access and refresh tokens are encrypted at rest with AES-GCM.
• Uploaded videos are stored only temporarily and deleted after TikTok fetches them.
• Access to production systems is restricted to authorized personnel.

No system is completely secure, but we take reasonable technical and organisational measures to protect your data. If a breach affecting your data occurs, we will notify you and the authorities as required by law.

12. Children

The Service is not intended for anyone under 18. We do not knowingly collect data from minors. If you believe a minor has used the Service, contact us and we will delete the data.

13. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date above and, for significant changes, notify signed-in users in the Service or by email.

14. Contact

TĂBĂCARU INVESTMENTS GROUP S.R.L. (TAB Media), Str. Tudor Vladimirescu, Moinești, jud. Bacău, România. Email: denis@tabgroup.ro.