Today You Can Do Anything · TikTok reporting dashboard

Privacy Policy

Last updated: 1 November 2026

This Privacy Policy explains how Today You Can Do Anything SRL processes personal data when you use the Today You Can Do Anything social media reporting dashboard and its TikTok connection features (the “Service”). It applies to the Service, not to TikTok or other third-party websites, which have their own privacy notices.

1. Data controller

Today You Can Do Anything SRL acts as the data controller for personal data processed to provide and secure the Service, unless a separate written agreement says otherwise.

2. Personal data we process

• Contact and account data: name, business name, email address, account settings, and support correspondence that you provide.
• TikTok connection data: TikTok account identifiers, display name, profile information, and the authorization status needed to connect an account.
• Profile and video reporting data: permitted profile statistics and public video details and metrics, such as follower or video counts and video views, likes, comments, and shares, depending on the permissions granted and TikTok API availability.
• Authorization data: OAuth access and refresh tokens or equivalent credentials required to maintain an authorized connection. These must be stored and handled securely by the Service.
• Technical and security data: service logs and diagnostic information needed to maintain security and troubleshoot failures. These include IP address, date and time of requests, browser or device type, pages or API endpoints requested, and error details.
• Billing data: transaction and invoice details if you purchase a paid plan. We invoice business customers directly. If you pay through a Revolut payment link, Revolut processes the payment and we receive the transaction confirmation; we do not receive or store your full card details.

We do not request TikTok messages or publish content to TikTok through the current read-only reporting integration.

3. Why we use data and legal bases

• To create and administer your Service account, connect the TikTok account you select, and provide the requested dashboard features: performance of a contract or steps you request before entering a contract (GDPR Article 6(1)(b)).
• To protect the Service, prevent misuse, and investigate technical or security incidents: our legitimate interests in operating a secure service (GDPR Article 6(1)(f)), balanced against your rights and expectations.
• To issue invoices and meet accounting or other legal obligations, if applicable: compliance with a legal obligation (GDPR Article 6(1)(c)).
• For any optional processing that requires consent, we will request consent separately and explain how to withdraw it.

4. TikTok authorization and account data

You choose which TikTok account to connect and approve the requested permissions through TikTok. We use the resulting authorization only to request the data needed to provide the reporting features you use. You can revoke the application’s permissions in TikTok’s settings. After revocation, we stop making API requests for that connection. We delete the stored access and refresh tokens and the cached profile and video data for that connection within 30 days of disconnection or revocation.

TikTok processes data under its own terms and privacy policy. We do not control TikTok’s independent processing.

5. Recipients and service providers

We may disclose personal data to TikTok to complete authorization and API requests, and to service providers that support hosting, storage, security, customer support, and payment processing where applicable. Such providers may process data only for the services they provide to us and under appropriate contractual protections.

The service providers we currently use are: TikTok (account authorization and the TikTok API); Cloudflare, Inc. (hosting, data storage, content delivery and security); Revolut (payment links, where you choose to pay that way); and our email provider for support correspondence. We do not sell personal data and do not share it for advertising.

6. International transfers

TikTok or a service provider may process data outside the European Economic Area. Where personal data is transferred outside the EEA, we will use a transfer mechanism required by GDPR, such as an adequacy decision or appropriate safeguards, where applicable.

Cloudflare, Inc. is based in the United States and participates in the EU-U.S. Data Privacy Framework; it also offers Standard Contractual Clauses approved by the European Commission. TikTok processes data under its own privacy policy, which describes its international transfers.

7. How long we keep data

We keep account and connected TikTok data for as long as needed to provide the Service and while the connection remains active. When you disconnect an account or close your Service account, we stop using its authorization credentials and delete or anonymize associated data within 30 days, except where retention is required by law or needed to establish, exercise, or defend legal claims. Technical logs are retained for up to 90 days. Invoices and accounting records are retained for the period required by applicable law.

8. Your rights

Subject to applicable law, you may request access to, correction or deletion of your personal data, restriction of processing, data portability, or object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting processing carried out before withdrawal. To exercise your rights, email contact@todayyoucandoanything.ro.

You may also lodge a complaint with the Romanian data protection authority, ANSPDCP, or with the supervisory authority where you live or work.

9. Security

We use appropriate technical and organizational measures to protect personal data. No online service can guarantee absolute security. Access to the Service requires login and is limited to authorized users. TikTok access and refresh tokens are stored only on the server side, encrypted, and are never exposed in browser code. We have a process for investigating and responding to security incidents, including notifying affected users and the supervisory authority where the law requires it.

10. Children and automated decisions

The Service is intended for businesses and people authorized to manage business social media accounts. It is not designed for children. We do not use the Service data to make decisions about you solely by automated means that produce legal or similarly significant effects.

11. Changes and contact

We may update this Policy when our data practices or legal requirements change. The current version and its update date will appear on this page. For privacy questions or requests, contact contact@todayyoucandoanything.ro.