1. Who is responsible?
DigiCyfr Studio is operated by CYFR SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, trading as DigiCyfr, ul. Admiralska 10, lok. 1, 00-910 Warszawa, Poland, KRS 0001266161, NIP 9522289731. Contact info@digicyfr.com or +48 695 021 633.
CYFR is the controller for its staff access, business contacts, support correspondence and service security. When CYFR handles client content and account data solely under a client’s documented instructions, responsibilities and any processor terms must be agreed for that engagement. A client may remain the controller for the personal data in its content and audience interactions.
This notice covers Studio and its dedicated information site. It does not replace the privacy policies of TikTok, Meta or other independent social platforms.
2. Information Studio handles
- Business and staff information: names, business email addresses, roles, workspace membership and support correspondence.
- Connected account information: platform account identifiers, display names, handles where available, avatars, granted permissions, account status and token expiry information.
- Authorisation credentials: access and refresh tokens returned by a platform. These allow the operations authorised for that account; they are not the account’s human password.
- Content and operational records: captions, media, drafts, selected accounts, review decisions, publishing settings, scheduling instructions and publication results.
- Platform data where enabled and authorised: post identifiers, public video/post information, available performance metrics and supported comments or messages. Data differs by platform and permission.
- Technical information: IP addresses, browser information, request timing, security and error records, and essential authenticated-session information.
3. Why information is used
We use information to provide the agreed content-management service, authorise the correct accounts, prepare and review content, perform instructed platform operations, handle support, protect access and meet applicable obligations.
Depending on the relationship and purpose, the legal basis may be performing or preparing a contract, legitimate interests in business administration and service security, a legal obligation, or consent where applicable. Client-controlled data is processed under the relevant documented instructions.
OAuth permission authorises access at the platform; it does not replace any separate legal basis needed to process personal data or any client approval required to publish content.
4. TikTok-specific use
The current TikTok integration is a sandbox pilot. It requests profile information (user.info.basic), public video information (video.list), direct posting (video.publish) and upload-to-TikTok capability (video.upload). Requesting a permission does not mean production use is approved or that every capability is exposed by the current interface.
Profile information identifies the authorised account. Video information supports available content metrics. Posting credentials are used only for instructed content operations permitted by the platform. No public TikTok posting is currently enabled through this deployment.
We do not use TikTok data for sale, advertising audiences, unrelated surveillance or training an AI model. An additional use would require a valid basis, platform permission and appropriate notice.
5. Recipients and service providers
Access is limited to authorised CYFR personnel, the client’s authorised representatives where relevant, and service providers needed for the agreed operation. Platform APIs receive the account instructions and content sent to them. Authorities and professional advisers may receive information when justified or required.
| Service | Purpose and information |
|---|---|
| CYFR-managed Studio application | Workspace, account authorisation, draft/media and operational storage. Application credentials are kept outside the source repository. |
| TikTok, Meta and other enabled social platforms | Account authorisation, instructed publishing and permitted platform data. Each platform also processes data under its own policies. |
| Zoho Mail | Business support and privacy-request correspondence sent to the published contact address. |
| OpenAI Sites and its hosting infrastructure | This separate information website and technical delivery data. No client workspace, media library or social authorisation credentials are connected to it. |
Any additional processing provider needed for a client engagement must be assessed and recorded before use. More about service boundaries.
6. International processing
We do not promise that every provider processes data only within Poland or the EEA. Social platforms and website infrastructure may process data internationally under their own arrangements.
Where CYFR arranges a restricted international transfer, an applicable transfer mechanism and any necessary safeguards must be identified. Clients may request information about the processing arrangements relevant to their engagement.
7. Retention and deletion
Workspace information is retained for the active service and the purposes agreed with the client. Support, billing and legal records may have a different retention period. No universal fixed deletion deadline is promised for all record types.
Disconnecting an account removes its Studio connection and associated account records; posts targeting only that account can also be removed from Studio. Media or multi-platform drafts may need a separate deletion instruction. Disconnecting does not delete posts already published on a social platform.
The application currently keeps three successful local backup snapshots. Deleted data can remain in restricted recovery copies until those copies rotate out; this is not a guaranteed three-day period. Data subject to a justified legal hold is restricted for that purpose. How to request deletion.
8. Security and website storage
Studio uses application-level encryption for stored OAuth credentials, protected server credential files, authenticated workspace access and HTTPS for the configured application connection. Media and all database fields are not described as universally encrypted at rest. No system can guarantee absolute security.
This information site adds no advertising pixels, optional analytics or enquiry form. Hosting infrastructure may process technical request data. The authenticated Studio application uses essential session and security cookies; these are separate from this informational website.
9. Your choices and rights
Where applicable, you may request access, correction, deletion, restriction or portability of your personal data, object to relevant processing, or withdraw consent for future consent-based processing. Some requests are subject to legal conditions and exceptions. You may complain to a competent supervisory authority, including Poland’s President of the Personal Data Protection Office (UODO).
Send a request to info@digicyfr.com. Tell us which business, account or workspace is concerned. Do not send passwords, access tokens or identity documents unless a secure and proportionate verification process has been agreed.
If a request concerns client-controlled information, we may need to refer it to the client or act under the client’s instructions. We respond within the period applicable to the request.
10. Automated decisions and updates
Studio is not used to make decisions with legal or similarly significant effects solely by automated processing of personal data. Operational publishing automation follows configured instructions and platform checks.
We update this notice when the service or processing changes. The date above identifies this version. Material changes are communicated through the relevant service relationship.