Privacy Policy
Last updated: September 23, 2026
This Privacy Policy describes how Runcai ("we", "us", "our") collects, uses, stores, and shares information when employees of Runcai use our internal Runcai Ad Dashboard (the "Service") to view TikTok advertising performance metrics through the TikTok API for Business platform.
1. Information We Collect
- TikTok advertising account information: account ID, account name, business center ID, advertiser role, and permissions granted to the Service.
- TikTok advertising performance data: campaign, ad group, and ad metrics including impressions, clicks, conversions, spend, CTR, CVR, CPC, CPM, ROAS, and audience demographics retrieved via the TikTok Reporting API.
- TikTok creative metadata: ad creative IDs, names, statuses, and preview URLs retrieved via the Creative Management API.
- Employee identity: your Runcai corporate email and employee ID, used solely to verify that you are an authorized Runcai staff member.
- Usage logs: server access logs (IP address, user agent, request URL, timestamp) used for security monitoring and debugging.
2. How We Use Information
We use the information solely for the following purposes:
- Authenticating authorized Runcai employees to the internal ad dashboard.
- Displaying TikTok advertising performance metrics from authorized ad accounts.
- Generating aggregated internal reports for Runcai's marketing and operations teams.
- Detecting and responding to abuse, security incidents, and operational errors.
We do not sell, rent, or commercially share any TikTok advertising data. We do not use TikTok advertising data for advertising retargeting, profiling unrelated to internal operations, or training of machine learning models.
3. Data Storage and Retention
- All TikTok data is stored on Runcai-internal servers located in a controlled corporate environment.
- Access tokens and refresh tokens are encrypted at rest and never logged in plaintext.
- Token retention: Access tokens are stored for as long as the connection is active; revoked or expired tokens are purged within 30 days.
- Metrics retention: Cached TikTok advertising metrics are retained for up to 12 months for internal reporting, after which they are deleted.
- Log retention: Server access logs are retained for 90 days for security purposes, unless required to be retained longer for incident investigation.
4. Data Sharing
We do not share TikTok advertising data with any third party except:
- With TikTok (Pte. Ltd. and its affiliates) as required for the operation of the APIs.
- With hosting and infrastructure providers under strict data-processing agreements.
- When required by law, regulation, or valid legal process.
5. Employee Rights and Data Deletion
Employees can at any time:
- Revoke access: Disconnect their TikTok advertising accounts from the Service through TikTok's "Manage app permissions" settings or by contacting our team.
- Request deletion: Email privacy@runcai.example.com to request deletion of all data associated with their TikTok account. Deletion is completed within 30 days of verification.
- Request access: Request a copy of all data we hold associated with their TikTok advertising account.
6. Security
We protect TikTok advertising data with industry-standard measures, including TLS encryption in transit, AES-256 encryption at rest for tokens, role-based access control limited to authorized Runcai marketing and operations staff, and regular security reviews.
7. Children's Privacy
The Service is intended for Runcai employees and is not directed at children under 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect data from children.
8. International Transfers
If you are located outside the country where our servers operate, you acknowledge that your information may be transferred to, stored, and processed in that country. We take appropriate safeguards for such transfers.
9. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest revision. Material changes will be notified to authorized users before they take effect.
10. Contact
If you have questions about this Privacy Policy or our data practices, please contact: