Privacy Policy

• Account data — your email address and display name, managed through our authentication provider, Supabase.
• Billing data — your plan and subscription status. Payments are processed by Stripe; we do not store your full card details.
• Content data — the prompts, ideas, images, and posts you create or upload in the Service.
• TikTok account data — if you connect TikTok, we receive your TikTok open_id, username, and avatar, plus access and refresh tokens. Tokens are stored encrypted and used only to upload or publish content to your own TikTok account on your behalf.
• Third-party API keys — if you provide your own keys (e.g. Google Gemini and HeyGen), they are stored encrypted and used only to run the features you request.
• Usage data — basic logs and metrics (such as generation counts) needed to operate the Service and enforce plan limits.

• To provide the Service and your account (performance of a contract).
• To process subscriptions and payments (performance of a contract).
• To connect to TikTok and upload or publish content you request (your consent, which you can withdraw at any time by disconnecting TikTok).
• To send service emails such as welcome and usage notices (legitimate interest and contract).
• To secure, maintain, and improve the Service and prevent abuse (legitimate interest).

When you connect your TikTok account, Slidehook uses TikTok’s Login Kit and Content Posting API solely to (a) confirm which TikTok account is connected and (b) upload or publish content you generate to that same account. We do not access your private messages and we never post to any account other than your own. Our use of information received from TikTok complies with the TikTok Developer Terms and the TikTok Community Guidelines.

You can revoke Slidehook’s access at any time from your TikTok account settings, or by disconnecting TikTok in Slidehook Settings — doing so deletes the access and refresh tokens we store.

We do not sell personal data. We share data only with service providers who process it on our behalf:

• Supabase — authentication and database hosting
• Stripe — payment processing
• Google — Gemini AI generation
• Resend — transactional email
• TikTok — content publishing, only when you connect it
• Optional, only if you enable it: HeyGen

Some providers may process data outside the EU. Where they do, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses.

We keep personal data for as long as your account is active and as needed to provide the Service. When you delete your account or disconnect an integration, we delete or anonymize the associated data, except where we must retain it to comply with legal obligations (for example, accounting records).

We use industry-standard measures, including encryption of sensitive credentials (TikTok tokens and third-party API keys) at rest, encrypted transport (HTTPS), and access controls. No method of transmission or storage is completely secure, but we work to protect your data.

Under the GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. You may also lodge a complaint with the French data protection authority (CNIL). To exercise your rights, email contact@slidehook.app.

We use strictly necessary cookies to keep you signed in and to operate the Service (for example, authentication and short-lived OAuth state cookies). We do not use advertising cookies.

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

We may update this Policy from time to time. We will post the new version here and update the “Last updated” date. Material changes will be communicated where appropriate.

Foxtaming — contact@slidehook.app