Privacy Policy (Datenschutzerklärung)

Last updated: 21 March 2026

1. Data Controller (Verantwortlicher)

If you have any questions about this Privacy Policy or wish to exercise your rights under data protection law, please contact us at the above address.

2. Overview of Data Processing

VidPipe is a video scheduling service that allows you to schedule video uploads to TikTok. We process personal data only to the extent necessary to provide, maintain, and improve this service. We do not use your data for advertising, profiling, automated decision-making, or any purpose unrelated to operating VidPipe.

3. Legal Bases for Processing (Art. 6 GDPR)

We process your personal data on the following legal bases:

• Art. 6(1)(b) GDPR – Performance of a contract: Processing your TikTok account data, video files, and scheduling information is necessary to provide the VidPipe service you have requested.
• Art. 6(1)(b) GDPR – Performance of a contract: Processing payment data through Stripe is necessary to fulfil your Pro subscription.
• Art. 6(1)(f) GDPR – Legitimate interest: Maintaining server logs and session data for security purposes and the reliable operation of the service. Our legitimate interest is the secure, stable operation of VidPipe.

4. Personal Data We Collect

4.1 TikTok Account Data

When you log in via TikTok OAuth, we receive and store:

• Your TikTok Open ID (a unique, anonymised identifier)
• Your TikTok display name
• Your TikTok avatar URL
• OAuth access token and refresh token (encrypted at rest – see Section 7)

4.2 Video Files and Scheduling Data

• Video files you upload for scheduling
• Video captions you provide
• Scheduled publication date and time
• Upload status (pending, uploading, completed, failed)

4.3 Payment Data (Pro Subscribers)

If you subscribe to VidPipe Pro, payment processing is handled entirely by Stripe, Inc. We do not receive or store your credit card number, bank account details, or other payment instruments. We store only:

• Your Stripe Customer ID (a reference identifier)
• Your subscription tier (free or pro)

4.4 API Keys (Pro Subscribers)

If you generate an API key for programmatic access, the key is stored in our database and associated with your account.

4.5 Technical Data

When you access VidPipe, your browser automatically transmits technical data such as your IP address, browser type, and operating system. Server logs containing this data are retained for a maximum of 30 days for security and debugging purposes.

5. Cookies

VidPipe uses a single, strictly necessary cookie. No consent banner is required as this cookie is exempt under Art. 5(3) of Directive 2002/58/EC (ePrivacy Directive) – it is essential for the service to function.

Name	Purpose	Duration	Type
connect.sid	Session cookie – keeps you authenticated after login. Contains a cryptographically signed session ID. No personal data is stored in the cookie itself; the session data is stored server-side.	30 days	Strictly necessary

This cookie is set with the following security flags: Secure (transmitted only over HTTPS), HttpOnly (inaccessible to JavaScript), and SameSite=Lax (protection against cross-site request forgery).

VidPipe does not use any tracking, analytics, advertising, or third-party cookies.

6. Third-Party Processors (Auftragsverarbeiter)

We use the following third-party services to operate VidPipe. Data is shared with them only to the extent necessary for their respective function.

6.1 TikTok (ByteDance Ltd.)

Purpose: Authentication and video publishing via the TikTok API.
Data shared: OAuth tokens, video files, captions.
Privacy Policy: tiktok.com/legal/privacy-policy

6.2 Stripe, Inc.

Purpose: Payment processing for Pro subscriptions.
Data shared: Email address (if provided), Stripe Customer ID. All payment details are processed directly by Stripe and never touch our servers.
Stripe is certified under the EU-U.S. Data Privacy Framework.
Privacy Policy: stripe.com/privacy

6.3 Render Services, Inc.

Purpose: Cloud hosting infrastructure.
Data shared: All data processed by VidPipe is stored on Render’s infrastructure in the EU (Frankfurt region).
Privacy Policy: render.com/privacy

7. Data Security (Art. 32 GDPR)

We implement the following technical and organisational measures to protect your data:

• All TikTok tokens are encrypted at rest using AES-256-GCM with a server-side encryption key
• All data transmission is encrypted via HTTPS/TLS
• Session cookies are cryptographically signed and protected with Secure, HttpOnly, and SameSite flags
• Video files are stored on an encrypted persistent disk
• Database access is restricted to the application process
• Sensitive data (tokens, payment details) is never written to application logs

8. Data Retention

Data Category	Retention Period
Video files	Deleted immediately after successful upload to TikTok, or upon manual deletion by you
Scheduling metadata	Retained while your account exists; deletable via the dashboard
TikTok OAuth tokens	Refreshed on each use; deleted upon account deletion
Account data	Retained while your account is active; deleted upon request
Stripe Customer ID	Retained while your subscription is active; deleted upon account deletion
Server logs	Maximum 30 days
Session data	Maximum 30 days; deleted on logout

9. International Data Transfers (Art. 44–49 GDPR)

Your data is primarily processed within the European Union. Where data is transferred to third countries (e.g., to TikTok or Stripe servers in the United States), such transfers are safeguarded by:

• The EU-U.S. Data Privacy Framework (where applicable), or
• EU Standard Contractual Clauses (Art. 46(2)(c) GDPR)

10. Your Rights (Art. 15–21 GDPR)

You have the following rights regarding your personal data:

• Right of access (Art. 15): Obtain confirmation of whether we process your data and request a copy
• Right to rectification (Art. 16): Request correction of inaccurate data
• Right to erasure (Art. 17): Request deletion of your data (“right to be forgotten”)
• Right to restriction (Art. 18): Request restriction of processing under certain conditions
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interest at any time

To exercise any of these rights, contact us at info@pride.direct. We will respond within 30 days.

You can delete your scheduled videos at any time through the dashboard. To request full account deletion, email us at the address above.

11. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for our registered office is:

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the VidPipe dashboard. The “Last updated” date at the top of this page indicates the most recent revision.

---

Pride.Direct GmbH · Doormannsweg 19 · 20259 Hamburg · info@pride.direct