1. Information We Collect

We collect several types of information to provide and improve the Service:

Account Information

When you register for an account, we collect information you provide directly to us, including your email address, name, company or organization name, phone number, and a password you create. You may also provide optional information such as your company logo, address, and billing details.

Business Data

You or your users may enter or upload various types of business data into the Service, including sales transactions, inventory records, customer information, supplier data, accounting records, and other business-related content. This data is stored within the multi-tenant database schema and is logically isolated per Tenant.

Usage Information

We automatically collect information about your interaction with the Service, including your IP address, browser type and version, operating system, the pages you visit, the time and date of your visit, the referring URL, and other diagnostic data. We may also collect aggregate usage metrics such as feature adoption and session duration.

TikTok Integration Data

When you choose to connect your TikTok account to OmniStore using TikTok's OAuth-based Login Kit, we receive the following from TikTok:

• Your TikTok user ID (open_id) for identification purposes only;
• Your TikTok display name;
• Your TikTok profile avatar URL;
• A list of your recent TikTok videos, including video titles, descriptions, durations, cover image URLs, and TikTok-provided embed links (embed_link).

We request only the scopes user.info.basic and video.list. TikTok access tokens and refresh tokens are stored encrypted in your Tenant's data store and are never shared with other Tenants or third parties.

2. How We Use Information

We use the information we collect for the following purposes:

• To provide and operate the Service, including processing transactions, managing accounts, and delivering core ERP modules (sales, purchasing, inventory, accounting, customers, suppliers);
• To display TikTok reels on your platform storefront when you have connected a TikTok account. The reels are cached for up to 12 hours and displayed using TikTok's official embed player within an iframe. Reels are de-duplicated by TikTok video ID;
• To communicate with you, including sending technical notices, security alerts, and support responses;
• To improve and personalize the Service, including analyzing usage patterns and feature engagement;
• To protect the security and integrity of the Service and detect fraud or abuse;
• To comply with legal obligations and respond to lawful requests from authorities.

3. Data Storage and Processing

The Service operates as a multi-tenant application. Each Tenant's data is stored in logically isolated database schemas and file storage buckets. Your business data, including TikTok reels cache data, is stored in the region where the Service is deployed and is accessible only to users authorized within your Tenant.

Data at rest and in transit is protected using industry-standard encryption where applicable. TikTok OAuth tokens are stored encrypted using the platform's secret management system.

We act as a data processor on behalf of Tenants for any personal data contained within business records. Tenants act as data controllers for their own business and customer data.

4. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to:

• Maintain your authenticated session while you use the Service;
• Remember your language and display preferences (e.g., LTR/RTL);
• Enable core functionality of the web application.

We do not use cookies for cross-site behavioral advertising. You can control cookies through your browser settings, though disabling them may affect your ability to use certain features of the Service.

The Service includes a Progressive Web App (PWA) service worker (sw.js) that caches static assets and HTML pages for offline access. This cache is local to your browser and does not transmit data to third parties.

5. Third-Party Services and Links

The Service may contain links to or integrations with third-party websites, services, and applications ("Third-Party Services"). This includes integrations such as TikTok Login Kit and Display API, payment processors, and cloud service providers.

We do not control and assume no responsibility for the content, privacy policies, or practices of any Third-Party Services. You acknowledge and agree that we are not liable for any damage or loss caused by your interaction with these services. We encourage you to read the privacy policy of every Third-Party Service you engage with.

6. Data Retention

We retain information for as long as necessary to provide the Service and fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law.

• Account data is retained for as long as your account is active or as needed to provide the Service. You may request account deletion at any time;
• Business data is retained according to your Tenant's data retention settings and applicable legal requirements;
• TikTok reels cache data is automatically refreshed every 12 hours and is cleared if you disconnect your TikTok account;
• Usage logs containing IP addresses and access timestamps are retained for 90 days for security and debugging purposes, then deleted or anonymized.

7. Your Rights and Choices

You have the right to:

• Access and update your account information by logging into your account settings;
• Request deletion of your account data by contacting support;
• Disconnect your TikTok account at any time using the disconnection feature in the platform. Upon disconnection, your TikTok access tokens are permanently revoked and deleted, and cached reels are cleared;
• Export your business data using the platform's export tools;
• Opt out of promotional communications by following the unsubscribe instructions included in each email;
• Request data portability for data you have submitted through the Service.

To exercise these rights, please contact us using the information in Section 12 below. We may need to verify your identity before fulfilling your request.

8. Security Measures

We implement reasonable and appropriate technical and organizational measures to protect your information from unauthorized access, alteration, disclosure, or destruction. These measures include:

• Transport Layer Security (TLS) for all data in transit;
• Encryption of sensitive credentials at rest;
• Role-based access controls (RBAC) scoped per Tenant;
• Regular security audits and penetration testing;
• Rate limiting and abuse detection on public endpoints.

While we strive to protect your information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security and encourage you to use the Service only if you accept these security limitations.

9. International Data Transfers

Your information may be transferred to and processed in countries where we or our service providers operate, which may have data protection laws that differ from your jurisdiction. When we transfer your data across borders, we implement appropriate safeguards such as standard contractual clauses approved by applicable data protection authorities.

10. Information About Children

The Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected information from a child under 13 without parental consent, we will take steps to delete such information. If you believe we have collected information from a child under 13, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. We may also provide notice through the Service or via email where reasonably possible. Your continued use of the Service after any changes constitutes your acceptance of the updated Policy.

12. Contact Us

If you have any questions about this Privacy Policy, your personal data, or your rights, please contact us through the support channels provided within the Service, or write to the contact information available at https://omnistoreerp.com.