Privacy Policy

ReplayTok helps TikTok creators automatically capture their live streams and battles. To provide that service, we need to process some information about you, your account, and how the service is used.

In short, we aim to collect only what we need to run your account, sign you in, deliver recordings to the cloud storage you choose, manage billing, improve reliability, and keep the service safe. We do not sell your personal data, we do not use it for cross-context behavioural advertising, and you can request access, export, correction, or deletion of your data.

ReplayTok ("ReplayTok", "we", "us") is responsible for the personal data described in this Policy. In GDPR terms, we act as the data controller for our website at replaytok.com, the dashboard, and the ReplayTok companion software.

For privacy questions, contact our privacy team at privacy@replaytok.com. EU and UK residents may also contact our representative at eu-rep@replaytok.com (EU) or uk-rep@replaytok.com (UK).

We try to collect only what we need. Personal data we process falls into a few categories:

• Account data — name, email address, role (creator / editor / admin), authentication identifiers from our identity provider, and password-style credentials managed by that provider on our behalf.
• Profile and preferences — display name, theme, language, notification preferences, and records of your privacy choices, such as which optional cookies you accepted and when.
• Subscription and billing data — plan tier, renewal status, invoice history, and partial payment-instrument data (last four digits, brand, country). Full card numbers are handled by our payment processor and never reach our servers.
• Recording metadata — for each clip we capture on your behalf: timestamp, duration, file size, capture quality, and the destination in your linked cloud storage. We do not transcribe, watch, or scan the video contents.
• Usage and security logs — IP address, browser or device information, pages or API endpoints requested, response codes, and timestamps. We use these to keep ReplayTok reliable, detect abuse, investigate errors, and maintain security records. We keep them for a limited time.
• Support correspondence — anything you send us by email or contact form.

For users in the EU, UK, and other GDPR-aligned regions, every processing activity rests on one of the lawful bases in Article 6 GDPR:

• Performance of a contract — running your account, delivering recordings to your linked cloud storage, authenticating you, and providing the features you signed up for.
• Legitimate interests — keeping the service secure, preventing fraud and abuse, fixing bugs, understanding reliability, and improving product quality. We use this basis only where we believe our interests do not override your rights and freedoms.
• Legal obligation — meeting tax, accounting, and consumer-protection requirements, and responding to valid legal process.
• Consent — for non-essential cookies, optional analytics, marketing emails, and anything else where we ask you first. You may withdraw consent at any time without affecting past processing.

We use the data above to:

• create and authenticate your account;
• connect your ReplayTok device, capture matches, and route the output to the cloud storage you have linked;
• process subscription payments, send invoices, and apply trials, promotions, or refunds;
• send transactional emails (sign-in confirmations, billing receipts, security alerts) — these are not marketing and you cannot unsubscribe from them while you have an account;
• send product updates and tips only if you have opted in;
• detect and prevent abuse (credential stuffing, scraping, chargeback fraud, AUP violations);
• comply with legal obligations and respond to lawful requests;
• measure aggregate usage and reliability — these metrics are keyed to anonymous ids where possible.

We do not sell or rent personal data. We share it only when needed to run ReplayTok, comply with the law, or protect the service. Our service providers act under written contracts that require confidentiality, security, and GDPR processor terms where they apply. The categories of recipients are:

• Identity and authentication providers — to sign you in and keep your session safe.
• Payment and billing processors — to handle subscriptions, invoices, and fraud prevention.
• Cloud infrastructure providers — for hosting, databases, storage, and backups.
• Email delivery providers — for transactional messages (sign-in, billing, security).
• Reliability and error-monitoring providers — so we can spot and fix problems quickly.
• Privacy-preserving analytics providers — configured to avoid cross-site tracking.

If you want to know which specific providers we currently use, write to us at privacy@replaytok.com.

We may also disclose information to comply with a valid subpoena, court order, or other lawful request, or where we reasonably believe disclosure is required to protect our rights, property, or safety, or the rights, property, or safety of our users or the public. Where legally permitted, we will notify you first.

If ReplayTok is involved in a merger, acquisition, financing, or asset sale, your data may be transferred as part of that transaction. We will give you notice and choices before any new owner uses your data in a materially different way.

ReplayTok is designed so that the videos themselves never live on our servers. Recordings are delivered straight to the cloud-storage destination you have linked. We store metadata about each clip (duration, timestamp, destination URL, capture settings) so the dashboard can show you a list, but we do not download, copy, watch, or scan the underlying footage.

You can revoke our access to your linked storage at any time from your dashboard or directly with the storage provider. Doing so prevents future uploads but does not delete clips already delivered.

Some of our processors are located outside your country, including in the United States. When we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (or the UK International Data Transfer Addendum, as applicable), and we apply additional technical and organisational measures (encryption in transit and at rest, access controls, audit logging).

You can request a copy of the safeguards in place by emailing privacy@replaytok.com.

We keep personal data only as long as we reasonably need it for the purposes described in this Policy, unless a longer period is required by law. After that, we delete it or anonymise it.

• Active accounts — for the lifetime of the account.
• After account deletion — most personal data is removed within 30 days. Limited records (billing history, audit-log entries, fraud markers) are retained up to 7 years to meet tax, accounting, and legal-defence obligations, then purged.
• Security and audit logs — typically 90 days, with longer retention for entries flagged as part of an incident investigation.
• Backups — encrypted backups are kept for a limited rolling window; deletion in production propagates through backup cycles.
• Support tickets — up to 24 months after the ticket is closed.

Subject to your local law, you have the rights described below. You can exercise most of them directly from Settings → Privacy in your dashboard, or by emailing privacy@replaytok.com. We respond within 30 days (extendable by an additional 60 days for complex requests, as GDPR allows).

• Access — request a copy of the personal data we hold about you, including a downloadable export.
• Rectification — correct inaccurate or incomplete data.
• Erasure — delete your account and personal data, subject to retention obligations described above.
• Restriction — pause processing while we investigate a dispute.
• Portability — receive your data in a structured, commonly-used, machine-readable format.
• Object — object to processing based on legitimate interests, including for direct marketing.
• Withdraw consent — for any processing based on consent, at any time, without affecting past processing.
• Lodge a complaint — with your local supervisory authority. We would prefer a chance to address the issue first but you do not have to come to us before going to a regulator.

We do not subject you to decisions based solely on automated processing that have legal or similarly significant effects.

If you live in California, the California Consumer Privacy Act, as amended by the CPRA, gives you specific privacy rights. Other US states, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana, provide similar rights under their own laws.

Categories of personal information collected in the last 12 months: identifiers (name, email, account id), customer records (billing details), commercial information (subscription history), internet/network activity (logs), geolocation (coarse, inferred from IP), and inferences drawn from the above.

Sale or sharing. ReplayTok does not sell personal information for money and does not "share" it for cross-context behavioural advertising as those terms are defined in the CCPA. We have not done so in the last 12 months.

Sensitive personal information. We process authentication credentials and account log-ins, which are considered sensitive PI. We use them only for the purposes permitted by §7027(m) of the CCPA regulations (providing the service, security, and fraud prevention) and you do not need a separate opt-out.

How to exercise your rights. US-state residents can submit access, deletion, correction, and opt-out-of-sale / sharing requests by emailing privacy@replaytok.com or using the dashboard tools described under Your Rights above. We may designate an authorised agent to act on your behalf; we will verify the agency relationship before acting on the request.

Right to non-discrimination. We will not deny you the Service, charge a different price, give you a different quality of service, or threaten any of those, because you exercised any right granted by the CCPA or other US-state privacy law. Financial incentives, if any, will be opt-in and disclosed before enrolment.

Many browsers include settings that send a "Do Not Track" (DNT) header or a Global Privacy Control (GPC) signal on your behalf. The two say similar things to a website: stop tracking me.

ReplayTok treats a GPC signal as a valid opt-out of non-essential analytics and any "sale" or "sharing" of personal information as defined by the CCPA, on the device and browser that sent it. We treat a DNT header the same way for the duration of the visit, even though the standard was never finalised. Strictly necessary cookies, such as sign-in, security, payment, and consent-choice cookies, continue to function regardless of either signal.

If you also have a ReplayTok account, exercising rights tied to the account (export, deletion, restriction) still goes through the dashboard or privacy@replaytok.com — the browser signal alone cannot identify your account.

ReplayTok is not directed to children under 13, and not directed to anyone under 16 in the European Economic Area, the United Kingdom, or another region that sets a higher digital age of consent. We do not knowingly collect personal data from anyone below those thresholds.

If we learn that we have collected personal data from a child without verifiable parental consent (as required by COPPA in the United States) or appropriate parental authorisation under GDPR Article 8, we will delete the data and the account promptly, refund any purchases made on that account, and notify the registered parent or guardian where we can.

If you are a parent or guardian and believe a child has given us their data, contact us at privacy@replaytok.com. The product is designed in line with the UK Age-Appropriate Design Code (the "Children's Code") for the features that apply to it.

We apply industry-standard safeguards for data in transit and at rest, hashed credentials, role-based access controls with least-privilege defaults, audit logging on sensitive actions, and rate-limiting and anomaly detection on authentication endpoints.

No system is completely impervious to attack. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the appropriate supervisory authority within 72 hours and notify affected users without undue delay where required by law.

We use cookies and similar technologies to keep you signed in, remember your preferences, understand basic usage, and improve the service. See our Cookie Policy for a plain-language explanation of the categories we use and how to manage your choices.

We may update this Policy from time to time. When we make material changes, we will notify you by email or in the dashboard and post a notice on the site before the change takes effect where required. Less significant changes are reflected by updating the "last updated" date at the top of this page.

For privacy questions or to exercise your rights:

• Email: privacy@replaytok.com
• EU representative: eu-rep@replaytok.com
• UK representative: uk-rep@replaytok.com
• Security disclosures: security@replaytok.com