Privacy Policy
This policy covers two separate things: this public website, which only provides information, and the Studio Publisher HF tool, which only authorised members of our team use. Visiting this website does not give you access to the tool, and the tool is not reachable from this website.
1. Who is responsible
- Controller
- Hanifera GmbH, Wuhlestraße 7a, 12683 Berlin, Germany
- Privacy contact
- music@hanifera.de
2. This website
Hosting and delivery
The website consists of static pages served by a web server we run ourselves, in a container on our own server. Public access goes through Tailscale Funnel, a relay service of Tailscale Inc.: your browser's encrypted connection is passed through Tailscale's relay servers to our server, and only our server decrypts it. To relay the connection, Tailscale processes connection data such as your IP address, the time of the connection and the requested host name. Tailscale's servers may be located outside the EU/EEA. Details are in Tailscale's privacy policy.
Logs
Our web server does not keep an access log, so we do not record which pages you request. The containers that run the website write technical operating logs (for example start-up messages, errors and the connection status of our server). These logs are rotated by size and the oldest entries are overwritten automatically.
No cookies, tracking or external content
This website sets no cookies and uses no analytics, advertising or tracking tools. It does not load fonts, scripts or other content from third parties. The only external link above leads to Tailscale's own website.
Legal basis
We process the connection data needed to deliver this website on the basis of our legitimate interest in providing a working and secure website (Art. 6(1)(f) GDPR).
3. The Studio Publisher HF tool
Who is affected
The tool processes data about our own connected social media account and about the team members who use it. It does not process data about visitors of this website, and it is not used to post on behalf of anyone outside our team.
What we process
- The account connection. When a team member connects our TikTok account through TikTok's login, TikTok returns an access token, a refresh token, their expiry times, the permissions granted (uploading and posting videos) and an identifier for the account (the open_id TikTok issues for our app). We also hold our app's client key and client secret issued by TikTok.
- Account settings at posting time. Before a direct post, the tool asks TikTok which visibility options the connected account currently allows, to check that the post is permitted. This answer is used for the check and is not stored.
- Videos and their details. The video file, its technical properties (file size, duration, resolution and a checksum), the caption, the visibility setting and the AI-generated content label.
- Publishing records. For each transfer the tool keeps a record containing TikTok's publish ID, the account identifier, the file checksum and size, the technical video properties, the chosen mode and post settings, timestamps and the status reported by TikTok. It does not record upload addresses or tokens in these records.
Where it is stored
This data is stored locally on the computer of the authorised team member who runs the tool, in a private folder that only their user account can read. The folder is protected by file permissions; it is not encrypted. The tool has no central database and does not store data in a cloud service of ours. Tokens and secrets are never placed on this website or in our code repository.
Transfer to TikTok
Only after a team member explicitly confirms the transfer of a specific video does the tool send that video and its post settings to TikTok. TikTok processes the content under its own terms and privacy policy and is responsible for that processing.
How long we keep it
- Tokens are kept until the connection is removed or they expire. TikTok determines how long they remain valid.
- Publishing records document what was published. They are kept until a team member deletes them; the tool does not delete them automatically.
- Videos are not copied by the tool. The source files remain in our own project storage.
Disconnecting an account
The connection can be removed at any time in the TikTok settings for apps connected to the account; this withdraws the tool's access. We then also delete the locally stored tokens. Deleting the stored tokens alone also stops the tool from acting for the account.
Legal basis
We process this data on the basis of our legitimate interest in publishing our own content on our own accounts in a controlled way (Art. 6(1)(f) GDPR).
4. Your rights
Under the GDPR you have the right to access your personal data (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). You can also lodge a complaint with a data protection supervisory authority (Art. 77). To exercise these rights, contact us using the details in section 1.
5. Changes
We update this policy when the website or the tool changes. The date at the top shows the current version.