Privacy Policy

Our direct users are representatives of brands (our “Customers”) who sign in to manage affiliate creator programs. When a Customer connects their TikTok Shop account to Drover, we process data from TikTok’s APIs on that Customer’s behalf and at their direction. In that respect Drover acts as a service provider (processor) to the Customer for the TikTok-derived data, and as the controller for the account and usage data we collect directly from our users.

Account information. When you create an account or sign in, we collect your name, email address, and authentication credentials. Passwords are handled by our authentication provider and stored only in hashed form; we do not have access to your plaintext password.

Brand configuration data. Information you enter to configure your program, such as brand criteria, scoring preferences, approved product claims, and content-brief settings.

TikTok Shop integration data. When you authorize Drover to connect to your TikTok Shop account, we receive and store OAuth access and refresh tokens and basic shop identifiers needed to make authorized API calls on your behalf. Tokens are stored server-side and are used only to operate the Service for your account.

Creator and marketplace data. On your instruction, we retrieve data about affiliate creators from TikTok’s Creator Marketplace and affiliate APIs, such as public creator profile information and performance metrics. This data is processed to score creators, support your approval decisions, and operate outreach workflows.

Usage and audit data. We maintain an append-only audit trail of key actions taken in the Service, along with standard technical logs needed to operate, secure, and troubleshoot the Service.

We do not knowingly collect special categories of personal data, and we do not collect data from individuals under 18.

We use the information above to provide and operate the Service and your account; score and rank affiliate creators against your brand-specific criteria; generate compliance-conscious content briefs and run FTC/FDA-oriented compliance scans; manage creator approval workflows and outreach on your behalf; maintain an audit trail of decisions; secure the Service and prevent abuse; and communicate with you about your account and material changes.

We do not sell personal information, and we do not use creator or Customer data to train third-party models.

We share information only as needed to operate the Service. We rely on a small number of sub-processors, all of which process data in the United States: Vercel Inc. (application hosting), Supabase, Inc. (database, authentication, and storage), and Anthropic, PBC (AI content generation for briefs and compliance scanning). Each provider processes data on our behalf and is not authorized to use it for its own purposes.

To operate the integration, we exchange data with TikTok Shop’s APIs using the authorization you grant. Data obtained through TikTok’s APIs is used solely to provide the Service to the authorizing Customer and is handled in accordance with TikTok’s developer terms.

We may disclose information if required by law or to protect the rights, safety, or property of Drover, our users, or others. If Drover is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction.

We take a least-privilege approach to data access. Data is encrypted in transit (TLS) and at rest. Tenant data is isolated using row-level security so each account can access only its own data. Trusted server-side operations and user-facing requests use separate database credentials, and credentials and access tokens are stored server-side and are not exposed in logs or to client code. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We retain account, configuration, and audit data for as long as your account is active and as needed to provide the Service and support accountability for outreach decisions. When you close your account or request deletion, we delete or de-identify your data within a reasonable period, except where we are required to retain it to comply with legal obligations, resolve disputes, or enforce agreements.

You may request to access, correct, or delete the personal information we hold about you, and you may disconnect your TikTok Shop authorization at any time, which revokes our ongoing access to that data. Depending on your location, you may have additional rights under applicable law. To make a request, contact us using the details below.

Because Drover is a business product, requests from individuals whose data we process on behalf of a Customer (for example, affiliate creators) may be directed to the relevant Customer, and we will assist that Customer in responding.

The Service is intended for business users and is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

Drover is operated from the United States, and all processing occurs in the United States. If you access the Service from outside the United States, you understand that your information will be processed in the United States.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our handling of your data, contact Drover (Millad Afshar, sole proprietor) at milliafshar@gmail.com, 5017 Gresham Dr, El Dorado Hills, CA 95762, United States.