EmpAi Social Automation

Privacy Policy

Effective date: November 4, 2026

This Privacy Policy explains how Janyx LLC ("we", "us") collects, uses, shares and protects personal data when you use EmpAi Social Automation (the "Service") at https://social.empai.ai, including data we receive from TikTok when you connect a TikTok account.

In short: we only access a TikTok account after its owner authorizes us through TikTok, we only use TikTok data to show which account is connected and to publish the content you approve, we encrypt access tokens, we keep each business's data separate, we do not sell your data or use it for advertising, and you can disconnect and request deletion at any time.

1. Who is responsible

Janyx LLC, Janyx LLC, email armin@empai.ai.

For data about the people who sign in to the Service (account data), we act as controller. For content and data that a business customer ("Tenant") manages in the Service, including the TikTok accounts it connects, we process data on the Tenant's behalf and according to its instructions (as processor or service provider), while also acting as controller for security, fraud prevention and legal compliance.

2. Data we collect

2.1 Account and workspace data

  • Name, email address, sign-in credentials (passwords are stored only as salted hashes), role and the Tenant you belong to.
  • Workspace settings, brand information, and audit records of actions such as approvals and publish confirmations.

2.2 Content you provide or generate

  • Product images, videos, prompts, captions, descriptions, hashtags and scheduling information.
  • AI-generated drafts created from those inputs.

2.3 Technical data

  • IP address, browser type, timestamps and server logs needed to operate and secure the Service.
  • We use only cookies that are strictly necessary to keep you signed in and protect against cross-site request forgery. We do not use advertising or cross-site tracking cookies.

3. TikTok data

When you connect a TikTok account through TikTok Login Kit, TikTok shows you an authorization screen listing the permissions ("scopes") we request. We only receive data for the scopes you approve, and we use it only for the purposes below.

ScopeTikTok data we accessWhy we use it
user.info.basic Your TikTok account's open ID (a TikTok identifier specific to our app), union ID, display name and avatar image URL. To identify the connected account, link it to your Tenant, and show you which account (name and avatar) content will be posted to.
video.upload We do not read content from your account with this scope. We send video files you approve to your TikTok inbox as drafts and receive a publish ID and processing status from TikTok. To let you finish and post a video yourself in the TikTok app.
video.publish Creator information TikTok provides before posting: nickname, username, avatar, the privacy levels available to the account, whether comments/duets/stitches are disabled for the account, and the maximum allowed video length. After posting: a publish ID, publishing status, any error reason, and the ID of the published post when TikTok returns it. To show the posting screen required by TikTok (correct account, allowed privacy options and interaction settings), to publish videos and photo posts you explicitly confirm, and to show you whether publishing succeeded.
OAuth tokens (all scopes) Access token, refresh token, their expiry times and the list of scopes you granted. To call TikTok's API on your behalf for the actions above. Tokens are encrypted at rest.
video.list / user.info.stats (only if requested and granted) For video.list: your public videos' IDs, titles/descriptions, cover image, link and engagement counts. For user.info.stats: follower, following, like and video counts. To show basic performance analytics for posts in your workspace. We only request these scopes if analytics are enabled, and only use the data where you have granted it.

We do not access your TikTok password, direct messages, comments, followers' identities, or any content beyond what is described above. We do not use TikTok data to build advertising profiles, sell it, or share it with data brokers. When we publish content that was generated with AI, we mark it as AI-generated using TikTok's labeling feature.

While our TikTok integration has not completed TikTok's audit, TikTok may limit posts published through it to private ("only me") visibility.

4. How we use data

  • To provide the Service: authentication, workspaces, AI drafting, approvals, scheduling, publishing and status tracking.
  • To keep the Service secure, prevent abuse, and debug problems.
  • To communicate with you about your account and the Service.
  • To comply with legal obligations and TikTok's platform requirements.

We do not use your content or TikTok data to train AI models, and we do not use automated decision-making that produces legal or similarly significant effects on you.

5. Legal bases (EEA/UK)

  • Contract (Art. 6(1)(b) GDPR): providing the Service you or your organization signed up for, including connecting TikTok and publishing at your instruction.
  • Consent (Art. 6(1)(a)): connecting a TikTok account and granting scopes; you can withdraw consent at any time by disconnecting.
  • Legitimate interests (Art. 6(1)(f)): security, fraud prevention and service improvement.
  • Legal obligation (Art. 6(1)(c)): where we must retain or disclose data by law.

6. Who we share data with

  • TikTok: content, captions and posting settings you confirm are sent to TikTok to publish or upload as a draft. TikTok's handling of that data is governed by TikTok's own privacy policy.
  • AI providers: text such as prompts, product descriptions and brand guidelines is sent to Anthropic (Claude) to generate captions, descriptions and hashtags. Where you use AI video generation, the images and prompts you select are processed by the AI provider used for that feature. We do not send your TikTok tokens to AI providers.
  • Infrastructure providers (hosting, storage, email) that process data on our behalf under contract.
  • Authorities or others where required by law, or to protect rights and safety.
  • A successor in a merger or acquisition, subject to this Policy.

We do not sell personal data and do not "share" it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA).

7. Tenant isolation and security

Each Tenant's data, including connected TikTok accounts and tokens, is logically separated and only accessible to that Tenant's authorized users. TikTok access and refresh tokens are encrypted at rest using AES-based authenticated encryption (Fernet). Data is transmitted over HTTPS. Access by our staff is limited to what is needed to operate and support the Service. No method of storage or transmission is completely secure, but we work to protect your data and will notify you and authorities of a personal data breach where required by law.

8. Retention

  • TikTok tokens and profile data: kept while the TikTok account is connected. When you disconnect, we revoke the token with TikTok and delete the stored tokens and TikTok profile data.
  • Media files: stored only to create and publish your posts. Media is deleted when you delete it, when it is no longer needed to fulfil a scheduled or pending post, or when your account is deleted.
  • Publishing records (post status, publish IDs, errors): kept while your workspace exists so you can see your posting history.
  • Account data: kept while your account is active and deleted after you request deletion, except where we must keep limited records by law.
  • Logs and backups: kept for a limited period for security and recovery, then deleted or overwritten on a rolling basis.

9. Disconnecting TikTok and deleting your data

  • Disconnect in the Service: go to the TikTok accounts page in your workspace and choose "Disconnect". We revoke our access via TikTok's token revocation endpoint and delete the stored tokens and TikTok profile data.
  • Revoke in TikTok: you can also remove EmpAi Social Automation's access from the security / authorized apps settings in the TikTok app. Our access then stops working, and we delete stored tokens once we detect the revocation.
  • Delete your data: follow the steps on our Data deletion page or email armin@empai.ai. We complete deletion requests within 30 days and confirm by email.

Deleting data in EmpAi Social Automation does not delete posts already published on TikTok. You can delete those in the TikTok app.

10. Your rights

EEA, UK and Switzerland: you have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time without affecting prior processing. You may lodge a complaint with your local data protection authority.

California: you have the right to know what personal information we collect, use and disclose; to request deletion; to correct inaccurate information; to opt out of sale or sharing (we do neither); to limit use of sensitive personal information (we do not use it for purposes requiring this); and not to be discriminated against for exercising these rights. You may use an authorized agent. In the past 12 months we collected the categories described in Section 2 (identifiers, account information, internet/network activity, and content you provide) for the business purposes described in Section 4, and disclosed them only to the service providers and parties in Section 6.

To exercise any right, email armin@empai.ai. We will verify your request and respond within the period required by law. If your data is managed by a business customer of ours, we may forward your request to that business.

11. International transfers

We and our providers may process data in countries other than yours, including the United States. Where required, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.

12. Children

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from anyone under 16 (or the minimum age required where you live).

13. Changes

We may update this Policy. We will post the new version here with a new effective date and, for material changes, notify you in the Service or by email.

14. Contact

Janyx LLC
Janyx LLC
Email: armin@empai.ai