Your data, in plain language.
How this website handles personal data, how to contact us, and the planned data processing for the Stillkind service.
1. Who is responsible.
Stillkind Studio is operated by Theodor Borth, a sole proprietor in Vienna, Austria. Our business address and contact email are available in the company information and contact pages linked below.
For website operations, account administration and support, the operator acts as controller. For comment moderation carried out on a creator’s instructions, the allocation of controller and processor responsibilities must be reflected in a data processing agreement before live service begins. TikTok and the creator also have their own responsibilities for data collected on TikTok.
2. Information we process.
You can read the public company and product information without registering or connecting a TikTok account.
If you create a Stillkind account, the application processes your email address, hashed password, account identifier and login sessions. In a live authorized integration, it also processes the following data:
- TikTok account identifiers, username, encrypted authorization tokens and token expiry information.
- Video identifiers, captions, thumbnail URLs, publication times and comment counts returned by TikTok.
- Comment and reply identifiers, text, usernames, timestamps and visibility information.
- AI classification categories, confidence scores, moderation actions, processing timestamps and scan status.
- Technical request information such as IP addresses, timestamps and errors for operation and abuse prevention; and any information you choose to include in a support message.
3. Purposes and legal bases.
We use account and contact information to operate the requested service and respond to enquiries. Where applicable, this relies on performing a contract or taking steps at your request before entering one (Article 6(1)(b) GDPR).
Security and abuse prevention may rely on legitimate interests (Article 6(1)(f)). Records that must be kept under applicable law rely on legal obligations (Article 6(1)(c)). Optional processing that requires consent will only begin after obtaining it.
For commenter data processed on a creator’s instructions, the creator is responsible for identifying an appropriate legal basis and providing required notices. OAuth authorization grants technical account access; it is not blanket GDPR consent from everyone who comments.
We do not sell personal data, build advertising audiences from comments, or use TikTok data for influencer discovery and rankings.
4. Service providers and AI processing.
This public website is hosted on Vercel. Enquiries sent to our domain email are forwarded by Namecheap to the operator’s Gmail inbox, where Google processes the correspondence. The planned application uses Railway for the custom backend and PostgreSQL database, OpenAI’s API for comment classification, and TikTok for authorized account data and moderation requests. Live TikTok processing has not started.
The classifier receives comment text, usernames, identifiers and video captions. It does not receive your Stillkind password or TikTok access tokens. We do not use customer content to train our own models. OpenAI states that API data is not used to train its models by default.
We request that classification responses are not stored as API application state. This does not remove all provider retention: OpenAI may retain abuse-monitoring logs for up to 30 days by default, with exceptions described in its current policies. We do not claim Zero Data Retention.
The final contracting entities, hosting regions, processor agreements and international-transfer safeguards remain to be confirmed before production. Processing may take place outside the EEA; do not assume EU-only data residency.
5. Retention and deletion.
The current application retains account, comment and moderation records until they are deleted by the operator. Disconnecting TikTok does not automatically delete those records. Automated retention limits and production backup expiry have not yet been configured; they must be finalized and this notice updated before live customer data is collected.
Application sessions are valid for up to 30 days unless ended earlier. Ending a session invalidates access; token expiry is not the same as deletion of database records.
You may request deletion at any time. Data needed for a legal obligation or a specific dispute may need to be retained for the applicable period, restricted to that purpose. Provider logs and backups follow the applicable provider arrangements.
7. Your rights and choices.
Depending on the law that applies, you may have rights to access, correct, erase, restrict or receive a portable copy of your personal data, object to processing based on legitimate interests, and withdraw consent where consent is the legal basis. You can complain to the competent data protection authority.
Contact the operator with enough information to locate your records. We may need proportionate verification before releasing or deleting data. GDPR requests are generally answered within one month; where the law allows an extension, the reason and revised timing must be communicated.
If you are a commenter on a connected creator’s video, identify the creator, video and comment concerned. Where the creator is controller, we will route the request appropriately. Never send your TikTok password.
8. Automated moderation, children and changes.
AI-assisted decisions can hide comments from a creator’s comment section. Classification can be wrong; the creator can review decisions and request restoration. The product is not intended to make decisions about access to credit, employment or other similarly significant matters.
Stillkind accounts are intended for adults acting in a professional capacity. We do not intentionally offer accounts to children. Public comments may nevertheless contain data about minors; only provide information necessary for moderation.
This notice will be updated when the live deployment, providers or processing purposes change. Material changes will be communicated through the website and, where appropriate, to registered users.