ZELVAYA COMMERCE OS
Privacy Policy
This page is public and does not expose merchant or advertising account data.
1. Who we are and how to contact us
ZELVAYA Commerce OS is operated by the legal entity 广州特帆贸易有限公司, with primary operations in China. The registered legal name is shown in Chinese to avoid an unverified translation. Privacy, account-disconnection and data-rights requests may be sent to support@tfine.shop. Legal registration details can be supplied to TikTok through its protected review channel.
2. Scope and data controller
This policy covers ZELVAYA's private operator console and public integration gateway. For the TikTok Ads integration, 广州特帆贸易有限公司 determines how data is used inside ZELVAYA for its own advertising operations and company-owned advertiser accounts. TikTok separately controls data processed on the TikTok platform under its own terms and policies.
3. Data we process
For an explicitly authorised TikTok connection, we may process advertiser and first-party TikTok Shop identifiers, granted scopes, store and product metadata, rule-based audience metadata, campaign and advertising structure, creative metadata, performance metrics, operational records, OAuth tokens, webhook events, provider request IDs and audit logs. Public review pages do not query or display account data. Customer-file audience upload is not part of the current integration scope.
4. Purpose and basis
We process authorised data to provide account management, campaign operations, first-party store and product selection, rule-based audience management, reporting, anomaly detection, operational recommendations, approval control, execution readback, security and troubleshooting. Processing is limited to the account holder's OAuth authorisation, the authorised business relationship, legitimate security and operational needs, and applicable legal obligations.
5. Authorisation and human control
TikTok account access begins with OAuth and the account holder's consent. External advertising writes require an authorised operator decision in ZELVAYA. Users may revoke access through TikTok or request disconnection from ZELVAYA. AI recommendations do not execute by themselves.
6. Storage and security
Application secrets remain in managed server-side secret storage. OAuth tokens are encrypted at rest and separated by connection and advertiser account. ZELVAYA uses role-based access, approval records, audit logs, limited public routes and data minimisation. Public pages do not expose tokens, secrets, advertiser data or customer data.
7. Service providers and disclosure
We do not sell TikTok account data or personal information. Managed hosting, database, security and logging providers may process limited data only to operate and protect the service. Data may also be disclosed when required by law or necessary to investigate security abuse, subject to appropriate controls.
8. International processing
The company operates in China and may support authorised advertising operations in the United Kingdom and other approved markets. Data may therefore be processed in China and in infrastructure regions used by managed service providers. We limit access, minimise exported fields and use contractual, organisational and technical safeguards appropriate to the data and service.
9. Retention and deletion
OAuth credentials are retained only while needed for an active authorised connection and are invalidated or deleted after revocation, expiry or a verified disconnection request. Operational and audit records are retained only while needed for service delivery, security, accounting or legal obligations, then deleted or anonymised. We acknowledge verified deletion requests promptly and target completion within 30 days unless law or an active security investigation requires limited retention.
10. Data rights and complaints
An authorised account holder may request access, correction, disconnection, deletion or restriction by emailing support@tfine.shop. We verify the requester's authority before changing an advertiser connection. If a request concerns data controlled by TikTok, we will direct the requester to the relevant TikTok channel.
11. Children
ZELVAYA is a business operations service for authorised adult operators. It is not directed to children and does not intentionally collect children's data through the public review pages.
12. Updates
We may update this policy when the product, legal requirements or platform integrations change. The current version is published on this page. Last updated: 24 August 2026.