Legal

Privacy Policy

Effective date: 13 May 2026 · Last updated: 13 May 2026

This Privacy Policy explains how OpsCraftCo Studio ("we", "us", "our") handles personal data in connection with the OpsCraftCo Studio Content Engine application (the "App") and the website at studio.cadencestandard.co.uk (the "Website").

OpsCraftCo Studio is a UK sole trader trading under the Cadence Standard brand umbrella, based in the United Kingdom. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller for any personal data processed by the App or the Website is OpsCraftCo Studio. You can contact us at cadencestandard.co@gmail.com.

1. What the App is

The App is an internal first-party publishing tool used by OpsCraftCo Studio to upload our own video content to our own social media accounts — in particular the @opscraftco TikTok account that we own and operate. The App is not offered to the public, has no end users other than the studio owner, and does not provide any service to any third party.

2. Personal data we collect

From third parties (the public)

• None. The App does not collect personal data from any TikTok user other than the studio owner's own account, and does not collect personal data from visitors to the Website beyond what is described under "Server logs" below.

From the studio owner (the App operator)

• An OAuth access token and refresh token issued by TikTok, used to authenticate the owner's own account and upload videos to it.
• The TikTok username, display name, account ID and avatar of the owner's own account, returned by the user.info.basic scope.
• Metadata about each video the owner publishes through the App — file name, caption text, hashtags, privacy setting, and the upload/publish timestamp.

Server logs (Website)

• The Website is a static site hosted on Cloudflare Pages. Cloudflare may process limited technical request data (IP address, request time, user-agent string) for security, abuse prevention and aggregated traffic statistics. See Cloudflare's privacy notice for details.
• The Website does not set first-party cookies, does not run analytics scripts, and does not embed third-party trackers.

3. How we use personal data

• To authenticate to TikTok on behalf of the studio owner and upload videos to the owner's own account.
• To keep an internal record of which videos have been published, so the same video is not published twice.
• To diagnose errors when an upload fails (for example, by retaining the response payload from the TikTok API for a short period).

We do not sell or share personal data with third-party marketers or data brokers, and we do not use it to build profiles of TikTok users.

4. Legal basis (UK GDPR)

• Consent — the studio owner explicitly grants the App access to their own TikTok account via TikTok's OAuth consent screen.
• Legitimate interests — operating, securing and improving our own first-party publishing pipeline, where this does not override the rights of any data subject.

5. Data retention

• OAuth tokens are stored only for as long as needed to operate the App, and are deleted on revocation or when the owner disconnects the App in TikTok's settings.
• Upload metadata (video file name, caption, publish timestamp) is retained for up to 24 months as an internal publishing log, then deleted.
• Cloudflare server logs are subject to Cloudflare's own retention policy and we do not retain copies separately.

6. TikTok platform data

The App accesses TikTok APIs under the scopes user.info.basic, video.upload and video.publish, against the studio owner's own account only. We do not request, receive or store data about any other TikTok user through the App. Our use of TikTok platform data is subject to TikTok's Developer Terms of Service and TikTok's Privacy Policy.

7. International transfers

Personal data is processed in the United Kingdom and the European Economic Area, and may transit via TikTok's and Cloudflare's global infrastructure. Where data is transferred outside the UK or EEA, we rely on the safeguards offered by those providers (such as the UK International Data Transfer Addendum and Standard Contractual Clauses).

8. Your rights

Under UK GDPR you have the right to: request access to personal data we hold about you; request rectification or erasure; restrict or object to processing; data portability; and to withdraw consent where processing is based on consent. To exercise any of these rights, email cadencestandard.co@gmail.com.

You can also lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. Security

OAuth tokens are stored encrypted at rest. Access to the App's runtime environment is limited to the studio owner. We do not knowingly share credentials with third parties.

10. Children

The App is not directed at children and we do not knowingly collect personal data from anyone under 13.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be summarised at the top of this page for at least 30 days.

12. Contact

OpsCraftCo Studio · United Kingdom · cadencestandard.co@gmail.com