Privacy Policy
Last updated: July 30, 2026 · Operated by MatrixFlow
MatrixFlow ("we", "us", or "our") provides a SaaS analytics platform that helps cross-border e-commerce sellers monitor and optimize their TikTok creator account performance. This Privacy Policy explains what data we collect, how we use it, and the rights you have regarding your personal information.
By using our service, you agree to the practices described in this policy.
1. Information We Collect
1.1 Data from TikTok (with your authorization)
When you connect your TikTok account to MatrixFlow, we retrieve the following data through TikTok's official API, only after you have explicitly granted permission via OAuth:
- Basic profile information: Username, display name, avatar, and bio (scope:
user.info.basic)
- Video performance metrics: View counts, likes, comments, and shares on videos you have published (scope:
video.list)
- Account statistics: Follower count, following count, and aggregate engagement metrics
We do not access or store:
- Your TikTok password (we never see it — OAuth gives us only a token, never credentials)
- Direct messages or private communications
- Data from TikTok accounts other than your own
- Personal data of your followers (we see only aggregate follower counts)
- Your TikTok Shop data, ad account data, or payment information
1.2 Information You Provide Directly
- Email address (for account registration and communication)
- Display name and company name (optional)
1.3 Automatically Collected Information
- Usage logs: pages visited, features used, time spent in the platform
- Technical data: browser type, device information, IP address
2. How We Use Your Information
We use the collected data strictly to provide and improve our analytics service:
- To display analytics dashboards showing your TikTok video performance over time
- To generate insights and content strategy recommendations based on your historical performance
- To send service notifications, security alerts, and important account updates
- To improve our features, user experience, and platform reliability
- To detect, prevent, and address technical issues, fraud, or abuse of the Service
We do not:
- Sell, rent, or trade your personal data to any third party
- Use your TikTok video content to train AI models without explicit consent
- Use your data for cross-context behavioral advertising
- Share your data with advertising networks or data brokers
3. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, our legal bases for processing your personal data are:
- Consent (Art. 6(1)(a) GDPR): You authorized MatrixFlow to access your TikTok account data via OAuth
- Contractual necessity (Art. 6(1)(b) GDPR): Processing required to deliver the analytics service you registered for
- Legitimate interests (Art. 6(1)(f) GDPR): To secure, maintain, and improve our service
4. Data Storage and Security
- Hosting location: Data is stored on secure cloud servers located in Hong Kong
- Encryption in transit: All data transmission uses HTTPS / TLS 1.2 or higher
- Encryption at rest: TikTok access tokens are encrypted with AES-256
- Access control: Role-based access control (RBAC); employees access only the minimum data necessary to perform their job functions
- Monitoring: Access logs are retained for 90 days for security auditing
- Incident response: Documented incident response plan; affected users notified within 72 hours of a confirmed data breach
5. Third-Party Services
We integrate with the following third-party services. Each processes data according to its own privacy policy:
- TikTok for Developers (developers.tiktok.com): Source of your authorized TikTok account data
- Cloud infrastructure provider: Server hosting and database storage (Hong Kong region)
- Transactional email service: For sending service-related emails (password resets, alerts)
We do not share your personal data with advertising networks, data brokers, or third-party analytics providers that profile users across sites.
6. Your Rights
Depending on your jurisdiction (GDPR, CCPA, and similar laws), you may have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you
- Rectification: Request correction of inaccurate or incomplete data
- Erasure: Request deletion of your personal data ("right to be forgotten")
- Data portability: Receive your data in a structured, machine-readable format
- Restriction: Request that we limit processing of your data
- Objection: Object to processing based on legitimate interests
- Withdraw TikTok authorization: Disconnect your TikTok account at any time — we immediately revoke the access token and stop retrieving new data
To exercise any of these rights, email us at chenhaodong@easyislandsoftware.com. We respond within 30 days.
7. Data Retention
- Active accounts: Data is retained while your MatrixFlow account is active
- Closed accounts: All personal data is deleted within 30 days of account closure
- TikTok tokens: Immediately revoked and deleted when you disconnect TikTok
- Aggregated / anonymized data: May be retained indefinitely for product analytics (no longer linked to your identity)
- Legal hold: Data may be retained longer if required by law, regulation, or legal proceedings
8. Cookies and Similar Technologies
We use only essential cookies required for:
- User authentication and session management
- Security and fraud prevention (e.g., CSRF tokens)
- Remembering user preferences (e.g., language, theme)
We do not use:
- Advertising or marketing cookies
- Third-party tracking pixels (Google Analytics, Facebook Pixel, etc.)
- Cross-site tracking technologies
9. International Data Transfers
Our service is intended for users located outside mainland China. If you access our service from a different region, your data will be processed and stored in Hong Kong. By using MatrixFlow, you consent to this cross-border transfer and processing.
10. Children's Privacy
Our service is not directed to individuals under 18 years of age. TikTok account holders must be at least 13 (or the minimum age required in their country). We do not knowingly collect personal information from minors. If you believe we have collected data from a person under 18, please contact us immediately for deletion.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will:
- Notify you of material changes via email or in-app notification at least 30 days before they take effect
- Update the "Last updated" date at the top of this page
- Maintain previous versions of this policy available upon request
12. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact: