Privacy Policy

Last updated: 23 October 2026

1. Who is responsible for your data

The data controller is SND Team SRL, Romania. For anything related to your data, write to contact@olo.ro.

This policy covers the website olo.ro and the OLO web application.

2. What data we process and why

2.1 Your OLO account

Name (or company name), email address, password (stored only as a scrypt hash, we never see it), language, time zone, the date you signed up and last logged in, and whether you confirmed your email. We use them to create and run your account and to send you service emails (email confirmation, password reset). Legal basis: the contract with you (Art. 6(1)(b) GDPR).

2.2 Data we receive from TikTok

When you connect a TikTok account and tap Authorize on TikTok’s page, you allow OLO the permissions user.info.basic, video.publish and video.upload. We then receive and store:

• the account identifier TikTok issues for OLO (open_id), the display name, the username and the profile photo address;
• an access token and a refresh token, which let OLO post on your behalf (stored encrypted);
• the permissions you granted;
• before each post, what the account currently allows (who can view videos, whether comments, Duet and Stitch are allowed, maximum video length), which we show you in the posting form;
• after each post, its status at TikTok (processing, posted, sent to drafts, failed and the reason) and, for public videos, the video ID, so we can link to it.

We do not receive your TikTok password, your messages, your followers or any data about people who watch your videos.

We use TikTok data only to provide the features you use in OLO: to show which account a video goes to, to publish videos when and how you instruct, and to show you the result. We do not use it for advertising, we do not sell or share it with data brokers, and we do not use it to train artificial intelligence models. Legal basis: the contract with you (Art. 6(1)(b) GDPR) and the authorization you give on TikTok’s page.

2.3 Your videos and posts

The videos you upload, their captions and the settings you choose for each post (account, visibility, comments, Duet, Stitch, commercial content disclosure, AI label, cover, time). We need them to send the video to TikTok. Legal basis: the contract with you.

• Video files are deleted from our server 7 days after the post is published or sent as a draft. A video uploaded but never posted is deleted 7 days after upload.
• The post history (caption, settings, time, status, link) stays in your account until you delete the post or the account.

2.4 API keys

If you create an API key, we keep its name, the first characters and a hash of the key (not the key itself), plus when it was last used.

2.5 Security and technical data

The IP address and browser type of each login session, and an event log (sign-ups, logins, failed logins, connected accounts, posts). We use them to keep accounts safe and prevent abuse. Legal basis: our legitimate interest in securing the service (Art. 6(1)(f) GDPR). Sessions expire after 30 days; the event log is deleted after 180 days. Our hosting provider also keeps standard server logs for a short time.

2.6 Messages you send us

If you email us, we use your message and address to answer you and keep the conversation as long as needed to solve your request.

3. Cookies

OLO uses only cookies that are strictly necessary for the site to work, so we do not ask for consent:

• olo_s: keeps you logged in (30 days);
• olo_csrf: protects forms against forged requests (1 day);
• olo_lang: remembers the language you chose (1 year);
• olo_flash: shows a one-time confirmation message (1 minute).

We use no analytics or advertising cookies and no third-party trackers. Fonts are served from our own server.

4. Who we share data with

• TikTok. When you post, schedule or send a draft, OLO sends the video, caption and chosen settings to TikTok through the official API. From then on TikTok processes them under its own privacy policy.
• Hosting provider. OLO runs on servers of Scaleway SAS, located in the European Union, which processes data only on our behalf.
• Email provider. Service emails (confirmation, password reset) go out through our email server.
• Authorities, only when the law requires it.

We do not sell, rent or give away your data, including data received from TikTok.

5. Where the data is stored

OLO stores data on servers in the European Union. When you choose to post to TikTok, TikTok may process the content outside the EU, as described in its own policy.

6. How long we keep data

• Account data: until you delete the account.
• TikTok tokens and profile data: until you disconnect the account or delete your OLO account. The access token is valid for 24 hours and is renewed automatically; the refresh token is valid for one year, after which you need to connect the account again.
• Video files: 7 days after posting (or after upload, if unused).
• Post history: until you delete the post or the account.
• Event log: 180 days. Database backups, where they exist, are overwritten within 30 days.

7. How we protect data

• The connection to OLO is encrypted (HTTPS).
• Passwords are stored as scrypt hashes; TikTok tokens are encrypted with AES-256-GCM before being saved and are never shown or written to logs.
• Only the people who run OLO can access the servers, and only when needed.
• OLO talks to TikTok only through the official API and never uses browser automation.

8. How to disconnect TikTok

• In OLO: TikTok accounts → Disconnect. OLO deletes the tokens and profile data and asks TikTok to revoke its access.
• In the TikTok app: Profile → menu ☰ → Settings and privacy → Security and permissions → Apps and services permissions → OLO → Remove access. (Labels may differ slightly between app versions.)

From that moment OLO can no longer post to the account or read anything from it.

9. Your rights

Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. In OLO you can download your data (Settings → Download my data) and delete your account (Settings → Delete account) yourself. For anything else, write to contact@olo.ro; we answer within one month.

You can also complain to the Romanian data protection authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, www.dataprotection.ro.

10. Children

OLO is meant for people over 18 and for businesses. We do not knowingly collect data from children.

11. Changes

If we change this policy in a way that matters, we will tell you by email or in OLO before the change applies. The date at the top shows the latest version.