Legal
Privacy notice
Who is responsible
The controller of personal data described in this notice is Hieorkkey LLC, 45 High Street, Manchester, M4 1HQ, United Kingdom (“we”, “us”). You can reach us at support@hieorkney.xyz, support2@hieorkney.xyz or support3@hieorkney.xyz.
This notice covers the Hieorkney website at hieorkney.xyz and the Hieorkney service that connects to the TikTok Business API on your behalf.
What we collect
- Account and contact data: your name and work email, and the messages you send us.
- Authorisation data: access and refresh tokens issued by TikTok when you approve the connection, and the identifiers of the advertiser accounts you selected.
- Advertising data from TikTok: advertiser name, currency and time zone; campaign, ad group and ad settings (names, budgets, schedules, status); creative details (file names, formats, sizes, review status); pixel and event-source status; the names and identifiers of your registered apps; product catalog and feed diagnostics; and aggregated reporting figures such as spend, impressions, clicks and conversions.
- Technical data: IP address, request time and user agent in server logs, used for security and abuse prevention.
We do not collect the content of direct messages, follower lists, comments or the personal data of people who saw or clicked your ads.
How we use it and our legal basis
- To provide the checks and reports you asked for — performance of a contract.
- To keep the service secure and prevent abuse — legitimate interests.
- To answer your messages and requests — legitimate interests and legal obligation.
We do not sell personal data, do not share it for cross-context behavioural advertising, do not use TikTok data to train machine-learning models, and do not make decisions about you by automated means that have legal or similarly significant effects.
International transfers
Some providers process data outside the United Kingdom. Where they do, we rely on the UK International Data Transfer Agreement or Addendum, or on an adequacy regulation.
How long we keep it
- Authorisation tokens: until you disconnect, or 30 days after the last use, whichever is earlier.
- Advertising and reporting data: 24 months, then deleted.
- Server logs: 45 days.
- Backups: overwritten within 28 days.
- Correspondence: 24 months after the last message.
Your rights
Under UK GDPR you may ask us to give you a copy of your data, correct it, erase it, restrict or object to its use, or move it to another service. To use any of these rights write to support@hieorkney.xyz, support2@hieorkney.xyz or support3@hieorkney.xyz. We acknowledge requests within 4 working days and answer within one month. You can also request erasure directly.
You may revoke Hieorkney’s access at any time in your TikTok for Business account settings; we then stop all requests to TikTok for that account.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to resolve it first.
Security
Traffic is encrypted with TLS. Tokens are encrypted at rest and visible only to the service process. Access to production systems is limited to named staff and protected by multi-factor authentication. If a breach puts your rights at risk we will tell you and the ICO as the law requires.
Children
Hieorkney is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.
Changes
If we change this notice in a way that matters, we update the date above and, for connected users, tell them by email.