Privacy Policy

1. Introduction and Scope

tiktok.ecomm.lk (“TikTokers”), operated by Ecomm Software Solutions, provides an automated content scheduling and publishing platform designed for content creators, influencers, and online businesses in Sri Lanka. This document outlines the technical mechanisms we use to collect, handle, store, and protect your personal information and media files.

By signing up for an account, accessing our workspace, or uploading media to our servers, you acknowledge the data handling practices described here.

2. Data We Collect and How We Obtain It

We collect only the minimum data required to authenticate your identity, execute your scheduled video posts, and confirm your subscription payments:

• Mobile Phone Number: Collected during registration. Your Sri Lankan mobile number serves as your primary account identifier and is used to dispatch one-time verification codes (OTP) via SMS.
• Login Credentials: Passwords are never stored in plaintext. All passwords undergo cryptographic salting and hashing using the bcrypt algorithm before being committed to our database.
• Video Files and Metadata: Vertical video files (MP4, MOV), captions, hashtags, and scheduled publish times submitted to your workspace.
• Payment Slip Receipts: Screenshots or image files of bank deposit slips or mobile payment receipts uploaded for manual administrative verification.
• Platform Authorization Tokens: OAuth tokens received when you connect your TikTok account to our workspace. We store only the access and refresh tokens required to transmit videos via the official Content Posting API. We do not have access to your personal TikTok account passwords.

3. Technical Architecture and Data Storage

We structure our backend systems to separate operational metadata from large media files:

• Object Storage: Video files and payment slip images are uploaded directly from your browser to private, non-public cloud buckets (Cloudflare R2) using short-lived presigned upload URLs. These buckets cannot be browsed publicly.
• Database Security: Account state, subscription records, and post queues are managed within an encrypted PostgreSQL database. Access is restricted to internal backend services operating over private network connections.
• Automated Scheduling Engine: Our scheduling worker process evaluates the database queue every 30 seconds. It checks for posts scheduled for publication based on Sri Lanka Standard Time (Asia/Colombo UTC+05:30). Once a scheduled time is reached, the worker streams the file directly to TikTok servers on your behalf.

4. SMS Notifications and Transactional Messages

We use direct SMS gateway routes to send critical transactional updates. These include:

• One-time registration and password reset verification codes.
• Payment slip approval and subscription renewal confirmations.
• Immediate notifications when a scheduled video has been published or if a post fails due to an expired platform token.

We do not send unsolicited promotional SMS messages or share your mobile number with external telemarketing lists.

5. Third-Party Data Sharing Policy

We have a strict operational policy: we do not sell, rent, monetize, or trade your personal information, videos, or contact details to third parties, data aggregators, or marketing firms.

Data is communicated exclusively with infrastructure vendors necessary to operate our service:

• Cloud computing and object storage providers for hosting the application and video files.
• Telecommunication SMS providers for delivering transactional verification codes to Sri Lankan numbers.
• The official TikTok Content Posting API for publishing scheduled videos to your authorized account.

6. Data Retention and Account Deletion

You maintain full ownership of your content. Video files are retained in storage while scheduled in queue. Following successful publication, video files are routinely cleaned from temporary working storage to conserve system resources.

Payment slip images are archived solely for accounting reconciliation and tax record-keeping as required by standard business financial practices.

If you wish to terminate your account and remove all personal records, phone numbers, and stored media, you may submit an account deletion request through our WhatsApp support or contact form. Your profile and connected authorization tokens will be revoked and deleted permanently within 7 business days.

7. Contact for Privacy Inquiries

If you have questions regarding this Privacy Policy or wish to request data verification, please reach out to our team directly: