Privacy & Security
Effective: Oct 16, 2026 · Last updated: Oct 17, 2026 · Our security policies and privacy notice, in one place.
These policies set operating requirements for TopTiks personnel, contractors, business devices, and systems that handle company or customer information. The business owner maintains the program and approves documented, time-limited exceptions with compensating controls. Publication is not an independent audit or certification of implementation.
1. Information security policy
Protect the confidentiality, integrity, and availability of company and customer information.
- The business owner is accountable for the security program, risk decisions, incident coordination, and approval of access and service providers. Employees and contractors must follow these policies and report suspected issues promptly.
- Maintain an inventory of business devices, software, cloud services, sensitive data, and accountable owners. Review risks at least quarterly and before material changes; record the risk, treatment, responsible person, and target date.
- Apply least privilege, secure configurations, encryption, malware protection, vulnerability management, and incident response appropriate to the risk. Assess providers handling confidential information before use and annually thereafter.
- Provide security and privacy instruction at onboarding and annually. Maintain protected backups for critical server data and test restoration at least quarterly. Browser-only work requires user exports and is not covered by server backups.
- Review the program and these policies annually and after a significant incident or service change. Record approvals, exceptions, training, risk decisions, and corrective actions as evidence of operation.
2. Network segregation and threat protection
Separate trust boundaries and limit the paths through which systems and data can be reached.
- Logically separate production, development, and testing through distinct environments, credentials, permissions, and data stores or equivalent isolation. Do not use unmasked customer data in development or testing.
- Keep databases and administrative services authenticated and restricted to authorized workloads and personnel. Use private connectivity, allowlists, or equivalent provider-supported controls where available; document any necessary public endpoints and their protections.
- Permit only required services and connections. Use managed firewall and DDoS protections, secure administrative channels, and application rate limits appropriate to the service. Keep network and cloud configurations supported and current.
- Enable relevant authentication, application-error, access, and provider security alerts. Review alerts daily and security logs at least weekly; investigate unusual activity and escalate suspected compromise through the incident procedure.
- Review network exposure and environment boundaries quarterly and after material changes. Protect logs from unauthorized access or alteration; retain necessary security records for at least 90 days, unless a stricter legal or contractual rule applies, without recording secrets or unnecessary personal data.
3. Antivirus and endpoint protection
Require active malware defenses on every device used to access company or customer systems.
- Before access is granted, company-owned and personally owned work devices must run a supported operating system with approved antivirus or platform-native anti-malware protection installed, enabled, and kept current.
- Enable real-time protection and automatic security-engine and signature updates. Configure scheduled scans where supported and check protection health at least monthly; investigate failures and alerts promptly.
- Users must not disable protection, install unapproved software, or use rooted, jailbroken, or unsupported devices for business access. Use standard-user privileges for routine work and administrative privileges only when needed.
- Immediately report suspected malware to the security contact, isolate the device from company systems, and preserve relevant evidence. Restore access only after the owner or designated technical responder verifies remediation and rotates any exposed credentials.
- Record approved devices, protection status, update checks, and incidents. Remove access from devices that do not meet this policy until they are remediated.
4. Daily operational security baseline
Set minimum controls for the people, devices, and accounts used to operate TopTiks.
- Require unique workforce accounts, a password manager, and unique passwords or passphrases of at least 14 characters where passwords are used. Require MFA for workforce email, cloud, source-control, database administration, and privileged access wherever supported; document compensating controls for exceptions.
- Enable device encryption, automatic screen locking within five minutes, and a password or biometric unlock. Lock screens when unattended and protect devices against loss, theft, and unauthorized use.
- Enable automatic security updates where practical. Remove unnecessary software, extensions, accounts, and services; use supported browsers and operating systems. Follow the vulnerability policy for updates requiring manual handling.
- Keep desks and screens clear of sensitive material when unattended. Secure paper records and removable media, use approved encrypted transfer methods, and securely destroy or erase records and devices before disposal or reassignment.
- Verify unexpected requests for credentials, payments, or access through a trusted channel. Do not put secrets or confidential customer data into personal email, public repositories, unapproved AI tools, or other unapproved services. Report loss, phishing, and suspected disclosure immediately.
5. Access control and least privilege
Grant the minimum access necessary for an approved business purpose and remove it when no longer needed.
- Deny access by default. The business owner or delegated data owner must approve access based on role, task, data sensitivity, and duration. Use named accounts and scoped service identities; do not share workforce passwords.
- Separate administrative access from routine work. Limit production and personal-data access to authorized personnel, use read-only permissions where sufficient, and require MFA for privileged access wherever supported.
- Keep a register of users, service accounts, permissions, owners, and approvals. Review access at least quarterly and on role changes; remove dormant accounts and unnecessary permissions.
- Revoke access immediately when employment, a contract, or the relevant business need ends. Disable sessions, remove keys and device access, and rotate shared or potentially exposed credentials. Time-limit temporary and emergency access and review its use afterward.
- Store credentials and tokens in approved secret storage, restrict access to them, and log material administrative changes without logging secret values. Request only the third-party API scopes required for the approved feature and honor authorization revocation.
6. Data classification and encryption
Classify data before collection and apply handling, encryption, retention, and disposal rules to its sensitivity.
- Classify information as Public (approved for publication), Internal (routine business information), Confidential (personal data, private notes, contracts, or non-public analytics), or Restricted (passwords, API secrets, authorization tokens, or highly sensitive records). Apply the highest relevant classification when data is combined.
- Collect only data necessary for a documented purpose. Record its owner, permitted uses, storage locations, authorized recipients, retention period, and deletion requirements. Public availability does not remove privacy rights or provider restrictions.
- Protect Confidential and Restricted data in transit with TLS 1.2 or later, or an equivalent secure protocol, and at rest with AES-256 or equivalent provider-managed encryption. Require encryption on work devices and backups containing such data; verify provider controls and configuration.
- Use salted, one-way password hashing. Keep encryption keys, API secrets, and tokens in approved restricted storage, separate from source code and public assets. Limit and review access, rotate on suspected exposure, and never include secrets in logs or support material.
- Share sensitive data only through approved encrypted channels. Delete or anonymize it when its purpose or retention period ends, authorization is withdrawn where applicable, or a valid deletion obligation applies; document justified legal holds and account for backups and provider copies.
7. Incident response and communications
Detect, contain, investigate, recover from, and communicate security incidents promptly.
- Report suspected compromise, malware, lost devices, or data exposure immediately to stephen@tothestars.marketing. The business owner acts as incident lead and communications owner, appoints technical assistance as needed, and coordinates with hosting, database, payment, and API providers.
- Triage promptly: assess affected systems, data, customers, ongoing exposure, and business impact. Prioritize active compromise and personal-data exposure as critical. Maintain a restricted incident record with timestamps, decisions, evidence, responsible persons, and actions.
- Contain the incident by isolating affected devices or services, revoking sessions and exposed tokens, and limiting access. Preserve relevant logs and evidence before destructive changes when feasible; do not publish sensitive incident details or erase evidence casually.
- Investigate the cause, remove malicious access, patch the weakness, rotate affected credentials, and restore from verified clean backups where necessary. Validate system integrity and monitor for recurrence before normal operation resumes.
- Notify affected sellers, TikTok Shop, customers, and authorities as required by applicable law and contracts, without undue delay and within their deadlines. Do not wait for a completed investigation if an initial notice is required; provide verified facts and updates without speculation.
- Conduct a documented lessons-learned review after significant incidents, assign corrective actions, and update controls. Exercise the response process at least annually and after major changes. Preserve incident records under documented retention and legal-hold rules.
8. Vulnerability and threat management
Find, prioritize, fix, and verify security weaknesses throughout the service lifecycle.
- Monitor vendor advisories and relevant threat information. Check dependencies, source code, secrets, and exposed configurations before production releases and at least weekly using suitable automated checks and manual review; assess third-party service risks as part of provider management.
- Track findings with severity, affected assets, exploitability, data impact, owner, and remediation deadline. Treat active exploitation, exposed credentials, and externally exploitable critical issues as urgent; isolate or mitigate immediately.
- Use internal remediation targets of 24 hours for critical or actively exploited issues, 7 days for high, 30 days for medium, and 90 days for low severity. These are operational targets, not a warranty; if a fix is unavailable, apply compensating controls and record an owner-approved, time-limited exception.
- Test fixes appropriately, deploy through controlled changes, and recheck the affected system before closing a finding. Rotate exposed secrets even after removing them from code or logs. Reassess overdue issues and exceptions at least monthly.
- Review the external attack surface and cloud configuration quarterly and after significant changes. Arrange risk-based independent testing when warranted, track corrective actions, and accept responsible vulnerability reports at stephen@tothestars.marketing without requiring disclosure of customer data or secrets.
9. End-of-contract data deletion
Delete customer data when the contractual relationship ends, authorization is revoked, or a valid deletion request applies.
- The business owner coordinates offboarding and deletion. On termination or authorization revocation, stop collecting and using the affected customer’s data, disable the connection and scheduled jobs, and revoke or remove associated access tokens and credentials promptly.
- Identify all collected customer data and copies under our control, including personal data, authorized seller data, derived records, raw API responses, archives, exports, caches, local SQLite snapshots, and copies held by processors. Historical research or archive status does not exempt customer data from deletion.
- Delete affected data from active systems within 30 days of termination or a verified request, or sooner when required by law, TikTok Shop requirements, or contract. Use secure deletion appropriate to the storage system; deleting a visible account or database reference alone is insufficient if accessible copies remain. Coordinate any authorized export before deletion without extending a required deadline.
- Instruct relevant processors to delete their copies and obtain confirmation where available. Restrict residual backup copies from ordinary use and expire them within 90 days, or sooner if required. Select and configure backup services to meet that limit; if restoring a backup, reapply recorded deletions before returning restored data to normal use.
- Retain only specific records legally required to be kept, documenting the legal basis, minimum data, restricted access, and expiry date. Do not retain customer data merely for convenience, analytics, or future marketing. Delete legally retained records when the obligation ends, and explain any permitted exception to the requester unless disclosure is prohibited.
- Verify completion across the data inventory and record the request or termination date, systems checked, processor confirmations, backup expiry, exceptions, and responsible person without preserving the deleted content. Confirm completion to the customer or TikTok Shop when required. Send deletion requests to stephen@tothestars.marketing; verify the requester’s authority before acting.
Reference frameworks: NIST Cybersecurity Framework, CIS Controls, and NIST incident response guidance. These references do not imply certification or third-party endorsement.
Privacy notice
This policy explains how TopTiks ("we," "us," and "our") handles information when you visit our website, create an account, subscribe, save inspiration, or contact us. It applies to TopTiks at tiktok.tothestars.marketing and toptikscom.vercel.app.
Information we collect
- Account information. When you register, we collect your name, email address, and password. Passwords are stored as hashes rather than readable passwords. We also store account identifiers, session records, and registration or sign-in timestamps.
- Subscription information. Stripe processes payments. We store Stripe customer and subscription identifiers, membership status, and billing-event records needed to manage your access. Card details entered in Stripe Checkout are processed by Stripe; TopTiks does not store your full payment-card number or security code.
- Saved workspace. Bookmarks, boards, notes, and briefs currently live in your browser’s local storage. They are not automatically synchronized to your TopTiks account or across devices.
- Catalog information. We collect and archive public video and creator information through data providers, currently EnsembleData and FastMoss. This can include usernames, video identifiers, links, captions, thumbnails, publication dates, engagement statistics, product links, and provider-reported commerce metrics. Historical snapshots help us compare observations over time.
- Technical and support information. Hosting and authentication services may process IP addresses, browser and device information, requested URLs, errors, and security logs. We also receive information you include when you contact us. Catalog searches and requests may be recorded to operate the archive and manage data limits.
How we use information
We use information to provide the catalog and research features, authenticate accounts, manage subscriptions, respond to support and privacy requests, diagnose problems, prevent abuse, and maintain the service. Saved workspace content supports the features you use in your browser. AI analysis of private notes and briefs is not currently enabled.
TikTok Shop connections
Our official TikTok Shop connection is currently in development; seller authorization and official Shop API ingestion are not active. If you authorize a connection after it becomes available, the authorization screen will identify the permissions requested. Connection information may include authorization tokens, shop or account identifiers, market, granted permissions, and the data returned under those permissions.
Authorized TikTok Shop data will be used for the approved TopTiks functionality, subject to the permissions granted and TikTok’s applicable requirements. Authorizing one shop does not give TopTiks unrestricted access to other shops’ private orders or customer information. You can revoke a connection through TikTok’s authorization controls and contact us about data associated with it.
Service providers and sharing
We use Vercel for application hosting, Neon PostgreSQL for server-stored account, billing, and catalog records, Stripe for payment processing, and Resend for account recovery email, with EnsembleData and FastMoss for public catalog and commerce data collection. These providers process information needed to deliver their services. Opening a video, loading a hover preview, or following a TikTok link sends a request to TikTok, which may receive technical information and use its own cookies.
Public catalog information is displayed as part of the research service. We do not currently sell account details or private workspace content, share them for targeted advertising, or run third-party advertising pixels on TopTiks. We may disclose information when legally required, to address fraud or security incidents, or in connection with a business transfer, subject to applicable obligations.
Providers and linked services have their own privacy practices. See the Stripe Privacy Policy and the TikTok Privacy Policy.
Cookies and browser storage
Separate sound-preference cookies remember whether homepage previews and opened videos are muted. These preferences stay in your browser for up to one year and can be changed with the sound controls or removed through your browser’s cookie settings.
Authentication cookies keep you signed in, and local storage holds your saved workspace. You can manage cookies and clear site storage through your browser. Clearing local storage removes locally saved boards, notes, and briefs from that browser; it does not cancel a subscription or delete server-stored account records. Embedded TikTok content and Stripe’s pages may use their own storage and cookies.
Retention and deletion
Our end-of-contract data deletion policy covers customer data in active systems, archives, local snapshots, processor copies, and backups when a relationship ends. It sets deletion requirements of 30 days for active systems and 90 days for residual backups, subject to earlier applicable deadlines and narrowly documented legal retention obligations.
We retain account and subscription records while needed to provide the service, manage billing, resolve disputes, prevent fraud, or meet legal obligations. Catalog observations and provider responses are archived for historical research, subject to applicable provider restrictions and removal requirements. Browser-saved workspace content remains until you remove it or clear that browser’s site storage.
You can request access, correction, a copy, or deletion of information associated with you by contacting us below. Requests are handled by the operator; we may need to verify your identity. Some records may need to be retained for legal, billing, or security reasons, and copies in provider backups may remain until the relevant backup cycle expires. An account-deletion request does not automatically cancel Stripe billing; manage your subscription in your account or ask us for help.
Security and international processing
TopTiks uses HTTPS, account authentication, and server-side handling of service credentials. No service can guarantee absolute security. Our hosting, database, payment, and content providers may process information in countries other than where you live. This policy does not claim that TopTiks holds an independent security certification.
Children
TopTiks is intended for adult business users and is not directed to children under 13. If you believe a child has provided personal information to us, contact us so we can investigate and address it.
Changes to this policy
We will post updates on this page and change the date above. Where applicable law requires additional notice or consent, we will provide it before making the relevant change in how information is used.
Contact and privacy requests
For privacy questions, account-data requests, or concerns about public creator information in the catalog, email stephen@tothestars.marketing with “TopTiks privacy request” in the subject. Please do not include passwords, API secrets, or full payment-card details.