Privacy Policy

1. Who is responsible

The organization responsible for personal information collected through the Service is:

TikTok2Go
Edmonton, Alberta, Canada
Privacy: privacy@tiktok2go.com
Legal: legal@tiktok2go.com

TikTok2Go is not TikTok. We are an independent Alberta-based product. When you connect a TikTok account, TikTok is a separate organization with its own privacy policy. We only receive the TikTok data you authorize through official TikTok APIs.

2. Scope

This Policy applies to:

• the website and apps at tiktok2go.com and subdomains;
• short links in the form tiktok2go.com/r/[slug] and related click events;
• creator uploads, generated captions, and listing pages;
• orders we hand off to Community Cart or another partner;
• information we receive from official TikTok APIs (Login Kit, video display, content posting / share) after you grant permission.

It does not apply to restaurants’ own sites, Community Cart’s platform, or TikTok’s platform, each of which has its own policy.

3. Information we collect

3.1 You provide

• Account data: display name, handle, email, password or magic-link token, role (consumer, creator, admin), city, avatar, bio.
• Creator listings: restaurant name, dish or meal title, description, line items (name, quantity, notes, price), tags, special instructions, optional photos, vertical video files.
• Generated and edited captions and hashtags.
• Order data: selected items, dropoff address, delivery notes, and any contact details needed to complete delivery.
• Communications you send to support or legal inboxes.
• Moderation decisions if you are an admin.

3.2 Collected automatically

• Device and log data: IP address, user agent, browser, approximate location derived from IP, pages viewed, timestamps, referring URL.
• Short-link analytics: slug clicked, time, referrer, city we infer, user agent, and later events (page view, order started, order completed). We use this to attribute a creator and understand which posts convert.
• Cookies or similar storage for session, preferences, and fraud prevention. See Section 8.

3.3 From partners

• Community Cart or another courier/merchant partner may send order-status updates (confirmed, preparing, on the way, delivered).
• Hosting, storage, video, and analytics providers process data on our instructions (see Section 7).
• TikTok, when you connect or authorize an integration (Section 4).

4. Information from official TikTok APIs (important)

If you choose to connect TikTok, we use only official TikTok developer products and only the scopes you approve on TikTok’s authorization screen. We do not scrape TikTok and we do not collect your TikTok password.

4.1 Categories we may receive

• Identity / Login Kit: TikTok open_id and/or union_id, display name, username / handle, avatar URL, and the fact that you authorized our app.
• Video display: identifiers, cover images, captions, duration, embed or playback URLs, and public engagement counts for videos you allow us to list or preview on TikTok2Go.
• Content posting / share: tokens that let us submit a draft or post that you initiated, typically containing your TikTok2Go caption, hashtags, and short link. We do not post to your TikTok account without that explicit action.
• Token metadata: access and refresh tokens, expiry, and granted scopes, stored securely so the integration keeps working until you revoke it.

4.2 Why we use TikTok data

• Let you sign in without a separate password if you choose Login Kit.
• Match your TikTok identity to your TikTok2Go creator profile so attribution on short links is accurate.
• Help you publish or copy the exact-order link onto a TikTok post you control.
• Show you (and, where you permit, visitors) the video associated with a listing.
• Debug, secure, and measure those integrations.

4.3 What we do not do with TikTok data

• We do not sell TikTok user data.
• We do not use TikTok data to train general-purpose public AI models.
• We do not use TikTok data for unrelated third-party advertising.
• We do not share TikTok data with restaurants or Community Cart except the creator handle / attribution already visible on a listing (for example “created by @handle”) and what is needed to complete an order you placed.
• We do not request scopes we do not need, and we do not retain TikTok tokens after you disconnect plus a short security buffer.

4.4 Your TikTok controls

You can revoke TikTok2Go’s access in your TikTok app or at TikTok’s connected-apps settings, and you can email privacy@tiktok2go.com to ask us to delete tokens and TikTok-sourced profile fields from our systems. TikTok also processes data under TikTok’s Privacy Policy.

5. How we use information

We use personal information to:

• create and secure accounts, sessions, and admin roles;
• host videos, generate captions/hashtags, mint short links, and publish listings after moderation;
• show location-aware feeds (starting with Edmonton / Alberta);
• accept exact orders and transmit tickets to restaurants and Community Cart;
• attribute clicks and orders to a creator and a short link;
• moderate unsafe, infringing, or misleading content;
• prevent fraud, abuse, and spam;
• provide support and send service messages;
• improve the product (aggregated or de-identified metrics where practical);
• comply with law and enforce our Terms of Service;
• operate official TikTok integrations you enable (Section 4).

Caption generation may be sent to an AI provider (currently SpaceXAI / xAI) containing the listing text you entered — restaurant, dish, items, and tags — not your payment card and not TikTok access tokens.

6. Legal basis (Canada and elsewhere)

We are based in Canada. We rely on:

• Consent — account creation, optional TikTok connect, marketing emails (CASL), optional cookies beyond essentials.
• Performance of a contract — delivering the Service you requested (listings, short links, orders).
• Legitimate interests that do not override your rights — security, moderation, attribution analytics, product improvement.
• Legal obligation — tax, accounting, lawful requests.

Alberta’s Personal Information Protection Act (PIPA) and federal PIPEDA may apply depending on our structure and the activity. You may withdraw consent where processing is consent-based, without affecting processing we must keep for a contract or the law.

7. How we share information

We share personal information only as follows:

• Restaurants named on a listing, so they can cook the exact ticket.
• Community Cart (and successor fulfilment partners), so they can pick up and deliver. Their handling of the order is also governed by their privacy terms.
• Service providers who host the site, store files, transcode or stream vertical video (for example Cloudflare Stream, Mux, or equivalent), send email, or run analytics — under contracts that limit use to our instructions.
• AI caption provider — listing text only, to generate caption and hashtags.
• TikTok — only the content and tokens involved when you use an official integration (for example submitting a post you started).
• Public display — approved listings, creator handles, videos, and prices are public by design. Do not put secrets in a listing.
• Legal and safety — if required by law, to protect rights, or in a merger / asset sale with notice where required.

We do not sell personal information as that term is commonly understood under Canadian law or the CCPA/CPRA, and we do not share TikTok-sourced personal information for cross-context behavioural advertising.

8. Cookies and similar technologies

We use:

• Essential cookies or local storage for login session (for example a session identifier) and security.
• Preference storage for city or UI settings.
• Analytics that may set first-party cookies to understand feature use. We will request consent where required before non-essential cookies.

You can block cookies in your browser. The Service may not stay signed in if you block essential cookies.

9. Retention

• Account and profile data: for the life of the account, then deleted or de-identified within 90 days after a verified deletion request, except records we must keep.
• Listings, videos, and short-link stats: while the listing is live, then up to 24 months for attribution disputes and analytics unless you request earlier deletion and no legal hold applies.
• Orders and fulfilment payloads: at least as long as tax, accounting, and consumer-dispute rules require in Alberta (typically 6–7 years for transactional records).
• Server logs: typically 90 days, longer if needed for security investigations.
• TikTok tokens: until you disconnect, plus a short expiry/rotation window.

10. Security

We use reasonable administrative, technical, and physical safeguards: HTTPS, access-controlled storage, least-privilege admin roles, and hashed or vaulted secrets for API keys. No method of transmission is 100% secure. Tell us immediately at privacy@tiktok2go.com if you believe your account was compromised.

11. Storage and international transfers

We aim to host primary application data in Canada or a region we disclose in-product. Some processors (video, AI, email, TikTok) may process data in the United States or other countries. Where we transfer personal information outside Canada, we use contractual and practical safeguards appropriate to the risk. TikTok’s own transfers are described in TikTok’s policy.

12. Your rights

Subject to legal exceptions, you may request to:

• access the personal information we hold about you;
• correct inaccurate information;
• delete your account and associated personal information;
• withdraw consent for optional processing (including TikTok connect);
• object to or restrict certain analytics;
• unsubscribe from marketing emails (service emails about an order you placed may still be sent);
• receive a portable copy of listing and order data you provided, where technically feasible.

Email privacy@tiktok2go.com from the address on your account. We may need to verify your identity. We will respond within the time PIPEDA / PIPA require (generally 30 days, extendable with notice).

If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta.

If you are in the EEA/UK, you may also have GDPR rights of access, erasure, restriction, portability, and complaint to a supervisory authority. If you are a California resident, you may have CCPA/CPRA rights to know, delete, and correct, and to opt out of “sale” or “sharing” — we do not sell or share personal information as those statutes define those terms.

13. Children

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have, contact privacy@tiktok2go.com and we will delete it. Users under 18 may not place paid orders.

14. Automated decisions and AI

Caption and hashtag generation is automated assistance. It does not by itself approve a listing or refuse an order. Human moderators may approve or reject listings. We do not make solely automated decisions that produce legal or similarly significant effects about you without human involvement.

15. Third-party links and embeds

The Service may link out to TikTok, Community Cart, restaurants, or maps. Those sites are not controlled by us. If we embed a TikTok player or official embed, TikTok may set cookies or collect data under its policy.

16. Changes to this Policy

We will post updates on this page and change the “Last updated” date. Material changes (including new TikTok scopes or new categories of sharing) will be called out in-product or by email where required. Continued use after the effective date means you acknowledge the updated Policy.

17. Contact

Privacy questions, access requests, deletion requests, and TikTok-data requests:

TikTok2Go
Edmonton, Alberta, Canada
privacy@tiktok2go.com
https://tiktok2go.com
Related: Terms of Service