Privacy policy
Last updated: 26 July 2026
1. Who processes the data
The data controller is MPMEDIA, 96 Rue Paradis, 13006 Marseille, FR, SIRET . For any question or request about your data: anlisoilihi08@gmail.com.
Given the size of the business and the nature of the processing, appointing a data protection officer is not mandatory. None has been appointed.
2. What is recorded, and why
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| User accounts | name, email, hashed password, role, last sign-in date | opening and securing access to the tool | legitimate interest (art. 6(1)(f)) |
| Creators and editors | handle, profile link, platform, PayPal identifier, usual rate, notes | organising placements and paying for services | performance of a contract or pre-contractual steps (art. 6(1)(b)) |
| Clients | company name, contact name, email, postal address, company number, VAT number | issuing invoices and tracking payment | performance of a contract (art. 6(1)(b)) and legal obligation (art. 6(1)(c)) |
| Self-billing agreements | name or company name, address, country, email, tax and VAT numbers, place and date of signature, drawn signature, IP address and browser at signing | issuing invoices on behalf of service providers, and proving they authorized it | performance of a contract (art. 6(1)(b)) and legal obligation (art. 6(1)(c)) |
| Campaigns and invoicing | titles, artists, links to published content, amounts, deadlines, payment status | tracking campaigns and keeping the accounts | legal obligation (art. 6(1)(c)) |
| Audience of tracked posts | public post link, public handle, caption, public counters (views, likes, comments, shares, saves) | measuring what a campaign achieved, and reporting it to the client | legitimate interest (art. 6(1)(f)) |
| Audit log | account identifier, nature of the action, timestamp | tracing changes, finding an error, detecting abuse | legitimate interest (art. 6(1)(f)) |
No special category data within the meaning of Article 9 of the GDPR is collected. Information comes either from the people themselves or from public profiles on the platforms concerned.
3. How long it is kept
| Invoices and accounting records | 10 years from the end of the financial year (art. L123-22 of the French Commercial Code) |
| Daily readings of tracked posts | duration of the campaign, then 3 years |
| Signed self-billing agreements | as long as the invoices issued under them are kept (10 years) |
| Client and creator records | duration of the business relationship, then 3 years |
| User accounts | until access ends, then erased within 3 months |
| Audit log | 12 months |
| Session cookie | 7 days |
4. Who has access
Only people holding an account on the tool, within the limits of their role. Nothing is sold, rented out or passed on for advertising purposes.
The only technical third parties are those required to run the service : Hetzner Online GmbH, host, acting as a processor within the meaning of Article 28 of the GDPR.
Where the audience of a promoted post is tracked, the tool asks TikAPI for the counters TikTok already shows publicly under that post. It sends the identifier of the post to be read, and nothing else — no account, no client, no internal user data is passed on.
5. Cookies
A single cookie is set, named session. Its only purpose is to recognise you from one page to the next once signed in. It is httpOnly, cryptographically signed, and expires after 7 days.
No trackers, no analytics, no advertising. A cookie strictly necessary for the service requested is exempt from consent, so there is no banner.
6. Security
- Passwords are hashed with bcrypt and never stored in clear text.
- Access relies on a signed session, checked server-side on every request.
- Permissions are enforced on the server, never in the browser.
- A disabled account loses access immediately, without waiting for the cookie to expire.
- The service is served over HTTPS as soon as it goes online.
7. Your rights
Under Articles 15 to 22 of the GDPR, you have the right of access, rectification, erasure, restriction, objection and portability, as well as the right to give directions about what happens to your data after your death.
To exercise them, write to anlisoilihi08@gmail.com. A response is provided within one month. Proof of identity may be requested in case of reasonable doubt.
If an answer does not satisfy you, you may lodge a complaint with the French supervisory authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or cnil.fr.
8. Transfers outside the European Union
Data is hosted within the European Union.
One request does leave it: the call to TikAPI that reads the public counters of a tracked post. It carries the identifier of that post, and brings back figures already visible to anyone on TikTok.
9. Automated decision-making
The tool makes no automated decisions and performs no profiling. Every figure it displays — budgets, totals, deadlines — is a plain sum of what has been entered.
10. Changes
This policy may change along with the service. The last-updated date at the top of the page is authoritative.