Privacy Policy

This Privacy Policy explains how Oriono Digital Limited, trading as KyloAI Studio (“KyloAI”, “we”, “us”), handles personal data when creators and authorised operators use KyloAI Studio.

1. What KyloAI Studio does

KyloAI Studio is a managed creator-operations service. It prepares and validates photo carousels, lets participating creators personally authorise their TikTok accounts, and transfers a creator-confirmed carousel to that creator's TikTok inbox. Nothing is automatically published by KyloAI Studio.

2. Data we handle

Creator TikTok connection data

• TikTok open ID, display name and profile image;
• permissions granted to KyloAI Studio;
• encrypted access and refresh tokens and their expiry times;
• connection, refresh, disconnection and revocation times.

Carousel and delivery data

• carousel identifiers, assigned creator and version;
• title, description and ordered public media URLs;
• validation results and creator-confirmation state;
• TikTok publish IDs, delivery states and error information.

Operator and technical data

• authorised operator email address and authentication state;
• limited security and operational logs, such as timestamps, request outcomes and redacted error details;
• information supplied in support, access or deletion requests.

We do not ask for or receive a creator's TikTok password. We do not request TikTok profile statistics, video history or unrelated account information.

3. Why we use this data

We use the data described above to:

• identify the TikTok account a creator has connected;
• provide and secure the carousel hand-off service;
• show the creator the exact carousel before transfer;
• refresh or revoke authorised TikTok access;
• report whether TikTok received the inbox hand-off;
• prevent duplicates, misuse and unauthorised access;
• respond to support, privacy and deletion requests.

Depending on the circumstances, our lawful bases are performance of our service agreement, our legitimate interests in securely operating and improving the service, compliance with legal obligations, and consent where required.

4. TikTok authorisation and control

TikTok authorisation occurs on TikTok's own service. Creators choose whether to grant the displayed permissions. A creator may disconnect through TikTok's app-permissions controls or ask us to disconnect their account. When KyloAI processes a disconnection, it revokes the TikTok token and removes or deactivates the local connection credentials.

5. Service providers and transfers

We use service providers only as needed to operate KyloAI Studio:

• Vercel for application hosting and delivery;
• Supabase for authentication and database services;
• Google Cloud Storage for carousel media;
• TikTok for account authorisation and content hand-off.

These providers may process data in countries outside the United Kingdom. Where required, we rely on appropriate contractual and legal safeguards. We do not sell personal data.

6. Security

TikTok client credentials and user tokens are kept server-side. TikTok access and refresh tokens are encrypted at rest using a key stored separately from the database. Operator routes require authentication, confirmation links are random and expiring, and sensitive values are excluded from application logs.

7. Retention

We keep personal data only for as long as needed for the service and the purposes described above:

• TikTok connection data is retained until disconnection, revocation or a valid deletion request;
• delivery metadata is ordinarily retained for up to 90 days;
• unused connection and confirmation links expire within 24 hours;
• carousel media is retained in the managed Content Engine storage until it is removed under the applicable creator workflow.

Limited information may be retained longer where reasonably required for security, legal obligations or dispute resolution.

8. Your rights

Depending on applicable law, you may have rights to access, correct, erase, restrict or object to processing of your personal data, and to receive a portable copy. You may also withdraw consent where processing relies on consent and complain to the UK Information Commissioner's Office.

To make a request, email kyloconsulting@gmail.com. We may need to verify your identity before completing a request.

9. Cookies

KyloAI Studio uses strictly necessary authentication and security cookies to keep authorised operators signed in and protect requests. We do not use advertising cookies in the initial service.

10. Changes and contact

We may update this policy when the service or legal requirements change. The current version and date will remain available on this page. Questions can be sent to kyloconsulting@gmail.com.