Privacy policy

1. Controller

PROCESS — Amine Ennasri — Entrepreneur individuel, 9 Square Constant Margueritte, 35000 Rennes, France. aminennasri@outlook.com.

2. Data and purposes

We process names, emails, password hashes, sessions, email confirmations, settings, business profiles, saved public research, media, carousel recipes and schedules to perform the requested service. Payment references, entitlements and consent evidence support billing and legal obligations. Quota counters, technical errors and operational logs support security and reliability based on our legitimate interests.

3. TikTok, Google et MCP

TikTok connects only through OAuth authorization. Approved scopes may provide identifiers, profile data, metrics, posts and server-side access/refresh tokens. We do not collect TikTok passwords. Reads and publications execute your requests, including scheduled posts. Google may provide identity and verified email. MCP keys grant workspace access: assistant-requested data is sent to your chosen AI client under its own privacy policy.

4. Providers

Vercel hosts the service and private media; PostgreSQL/Neon hosts data when configured. Stripe processes payments, Resend transactional emails, Brave discovery queries and a technical provider public TikTok metadata. ScrollShow does not store full card numbers or sell your data. Providers may process data outside the EEA; PROCESS must maintain appropriate contractual safeguards and transfer mechanisms.

5. Retention and deletion

Active data is retained to provide the account. Account deletion removes user references after resolving in-flight publications, billing and service disconnections. Unreferenced media is queued for deletion after 48 hours; media still referenced by a post is retained. Signed media links expire within 24 hours. Encrypted store backups are retained for 30 days under the operational policy; legally required accounting records remain for the applicable statutory period. Deletion failures are tracked and may require support intervention.

6. Your rights

You may request access, correction, erasure, restriction, objection and portability under GDPR conditions. Settings provide an export. Contact PROCESS; proportionate identity verification may be required. You may lodge a complaint with the CNIL. Without information necessary for the contract, corresponding features cannot be provided. CNIL.

7. Cookies and security

The HTTP-only session cookie and preference storage support login and the interface. Non-essential analytics or advertising must not be enabled without required consent. No GPS tracking is performed. Keep API keys private and revoke compromised keys through settings.

8. Revenue and content measurement

When you connect Stripe, RevenueCat or Shopify to a project, ScrollShow processes technical account, customer, order and transaction identifiers, dates, amounts, currencies, statuses and refunds to provide the requested reports and associate them with tracked content. The Shopify connector does not request customer names, addresses, emails or phone numbers. It reads orders and does not change products, orders or refunds. Access and refresh credentials remain encrypted on the server.

Tracked links use a random click reference. The redirect service does not retain the visitor's IP address. The tracking script sets no cookie and uses no local storage by default. The business website can enable seven-day local click retention after obtaining appropriate visitor consent. The business chooses which events its server sends, informs visitors and applies their choices. Sales without an observed source remain unattributed.

Data remains limited to the authorized project. Sales and refund ledgers can be exported from Results. Disconnecting a source removes its local credentials and retains previously collected history; account deletion removes its business data. Shopify data access and erasure requests are handled within the relevant shop's scope. Encrypted backups follow the 30-day retention described above. For rights concerning data processed for a shop, contact that shop first or our privacy contact.

9. ScrollShow Chrome extension

The extension is optional. It only acts when you start a search from ScrollShow: it opens the TikTok search in your own browser, reads the public results TikTok displays to you (carousels, captions, counters, the author’s public handle) and sends them to your ScrollShow account, where they join your search history.

It does not read your messages, credentials, TikTok cookies or browsing history, and is not active on any other page. No data is sold or shared with third parties. TikTok login or verification prompts are never bypassed. Uninstalling the extension ends all processing; results already saved can be deleted from ScrollShow.