ShopReel Privacy Policy.

1. Introduction and Data Controller

ShopReel is a webshop widget that lets store owners display their own public TikTok videos on their storefront. ShopReel is operated by Plugly.io ApS as part of the Plugly product family (plugly.io).

This Privacy Policy describes how ShopReel processes personal data about you when you use the ShopReel service, including data retrieved from TikTok when you connect your TikTok account to ShopReel.

The data controller is:

Plugly.io ApS (Danish CVR no.: 38171658)
P. Nørkjærs Plads 4, 9800 Hjørring, Denmark
Email: info@plugly.io
Web: https://plugly.io/en/shopreel/

This policy applies to ShopReel users (typically webshop owners who connect a TikTok account), administrators using the ShopReel section of the Plugly administration tool at app.plugly.io, and end users who view ShopReel widgets embedded on our customers' websites.

2. Definitions

ShopReel

The TikTok feed widget product described in this policy, operated by Plugly.io ApS under the Plugly platform.

User

A person who has a ShopReel/Plugly account (typically a webshop owner or marketing manager) and connects a TikTok account to ShopReel.

End User

A visitor to a website where a ShopReel widget is embedded.

TikTok Account

The User's own TikTok account, connected to ShopReel via TikTok's official OAuth flow.

Widget

The embeddable element that displays content from the User's connected TikTok account on the User's website.

Personal Data

Any information that can identify a natural person, either directly or indirectly.

3. Data ShopReel Collects

3.1 Data You Provide to ShopReel

• Name, email address and password (when creating a ShopReel/Plugly account)
• Company information (company name, CVR number, billing address)
• Payment information (handled by our payment processor - ShopReel does not store card numbers)
• Information you enter yourself, e.g. widget configuration, support requests

3.2 Data ShopReel Collects Automatically

• Technical information: IP address, browser type, operating system, timestamp
• Usage data: which pages you visit in the administration tool, which ShopReel features you use
• Aggregated widget statistics (impressions, clicks) - anonymised, with no identification of individual end users

3.3 Data ShopReel Retrieves from TikTok

When you, as a User, connect a TikTok account to ShopReel, ShopReel retrieves data from TikTok on your behalf. This is described in detail in section 4.

4. Data Retrieved from TikTok

When you connect your TikTok account to ShopReel, ShopReel acts as a data processor for the content retrieved from your TikTok account. ShopReel only retrieves data from TikTok accounts that you have explicitly connected and consented to via TikTok's official OAuth flow (TikTok Login Kit).

4.1 TikTok API Endpoints Used by ShopReel

ShopReel uses the TikTok Login Kit for authentication and the TikTok Display API for retrieving public profile information and the User's own public videos. When you connect your TikTok account, ShopReel retrieves and displays the following data:

• Basic profile information (scope user.info.basic): open_id (used to link the TikTok account to your ShopReel account), display_name and avatar_url (displayed in the widget header).
• Extended profile information (scope user.info.profile): username (displayed as the @-handle in the widget) and profile_deep_link (used as the destination of the "Follow on TikTok" button).
• Profile statistics (scope user.info.stats): follower_count (displayed as "X followers") and is_verified (used to render the verified badge).
• Video metadata (scope video.list): id, cover_image_url, share_url, embed_link, view/like/comment/share counts, caption, duration, width/height, create_time.
• OAuth tokens: access_token (valid for 24 hours) and refresh_token (valid for 1 year) - stored encrypted server-side and used solely to retrieve data from your connected TikTok account.

ShopReel does not retrieve, download, store, re-host or proxy the actual video files. Videos are always played via TikTok's official embed player (https://www.tiktok.com/player/v1/{id}). Only cover thumbnails are cached on our CDN for performance reasons. Videos that are removed or set to private on TikTok disappear from ShopReel widgets within 24 hours via the next sync.

The use of TikTok data through ShopReel is governed by TikTok's Terms of Service and the TikTok Developer Terms of Service.

4.2 What ShopReel Does Not Collect

• ShopReel does not retrieve private messages (DMs) from TikTok
• ShopReel does not retrieve TikTok comments or other users' content
• ShopReel does not retrieve any data from TikTok accounts that have not been explicitly connected by the User
• ShopReel does not track individual end users on the pages where the widget is displayed (no tracking cookies are set by the widget)
• ShopReel does not sell, share or transfer TikTok data to third parties for advertising, profiling, retargeting, or machine learning training

5. Purposes and Legal Basis

ShopReel processes personal data for the following purposes:

• Provision of the ShopReel service (Article 6(1)(b) GDPR - performance of contract): account creation, operation of the widget, storage of configuration
• Invoicing and bookkeeping (Article 6(1)(c) GDPR - legal obligation): the Danish Bookkeeping Act requires retention for 5 years
• Retrieval and display of content from TikTok (consent and contract): only after the User's explicit authorisation via TikTok's OAuth flow
• Operation, security and troubleshooting (Article 6(1)(f) GDPR - legitimate interest): logs and technical data
• Improvement of the ShopReel service (Article 6(1)(f) GDPR - legitimate interest): aggregated, anonymised analytics
• Marketing and communication (consent): only if you have signed up for newsletters or similar

6. Sharing of Data and Data Processors

ShopReel does not disclose your personal data or TikTok data to others, except for the following data processors that help operate the service:

• Cloudflare, Inc. - CDN, DDoS protection and storage (Cloudflare R2) for cached TikTok thumbnails
• Hetzner Online GmbH - hosting of ShopReel backend and databases
• Stripe, Inc. - handling of card payments
• Postmark (ActiveCampaign LLC) - sending transactional and service emails
• Plausible Analytics - anonymised, cookie-free product analytics

Plugly.io ApS has entered into Data Processing Agreements with all relevant data processors in accordance with the GDPR.

ShopReel may also disclose data to authorities if legally required to do so.

ShopReel does not share TikTok data with any third party for advertising, profiling, retargeting or machine learning training.

7. Transfers Outside the EU/EEA

Some of ShopReel's data processors (e.g. Cloudflare, Stripe) may process data in the United States. Such transfers take place on the basis of the European Commission's Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework, and ShopReel ensures that recipients comply with the GDPR's requirements for data protection.

8. Retention Periods

ShopReel retains data for as long as necessary for the purposes for which it was collected, and as required by law:

• Account data: as long as your ShopReel account is active. Deleted within 30 days after you request deletion.
• Invoicing data: 5 years, pursuant to the Danish Bookkeeping Act.
• OAuth tokens from TikTok: as long as you have an active connection. Deleted within 24 hours after you disconnect the TikTok account.
• Cached TikTok thumbnails and video metadata: updated continuously via the ShopReel sync. Cached content is deleted within 24 hours after you disconnect the TikTok account, delete a widget, or when a video is removed or made private on TikTok.
• Logs: max 90 days.
• Aggregated analytics: may be retained indefinitely in anonymised form.

9. Your Rights

Under the GDPR, you have the following rights regarding data processed by ShopReel:

• Access: you can find out what information ShopReel processes about you
• Rectification: you can have inaccurate information corrected
• Erasure ("right to be forgotten"): you can have your information deleted, unless ShopReel is legally required to retain it
• Restriction: you can ask ShopReel to restrict the processing
• Data portability: you can have your data delivered in a structured, commonly used and machine-readable format
• Objection: you can object to processing based on legitimate interest
• Withdrawal of consent: you can withdraw consent at any time
• Complaint: you can lodge a complaint with the Danish Data Protection Agency (see section 15)

To exercise your rights, contact ShopReel at info@plugly.io. ShopReel responds to requests within 30 days.

10. Withdraw Consent and Delete Data from TikTok

You may at any time withdraw your consent for ShopReel to retrieve data from your connected TikTok account, and you may have all related data deleted.

10.1 Disconnect within ShopReel

1. Log in at app.plugly.io
2. Open the ShopReel widget
3. Click "Disconnect TikTok account" or "Delete widget"
4. Within 24 hours ShopReel will delete: your OAuth tokens, all cached TikTok thumbnails and metadata, and any widget configurations tied to that account

10.2 Revoke Access Directly with TikTok

You may also remove ShopReel from your authorised apps directly within TikTok:

1. Open the TikTok app or go to tiktok.com
2. Settings → Security and permissions → Manage app permissions
3. Find ShopReel and tap "Remove access"

When access is revoked on the TikTok side, ShopReel detects the revocation on the next sync and deletes all associated TikTok data within 24 hours.

10.3 Request Full Deletion of Data

To have all data - including account data, invoicing data (to the extent permitted by law) and all TikTok-derived data - deleted, send a request to:

Email: info@plugly.io
Subject: "ShopReel data deletion request"
Content: Your email address, ShopReel account name, and if possible the TikTok username that was connected

ShopReel will confirm receipt within 3 business days and complete the deletion within 30 days.

10.4 TikTok Data Deletion Callback

ShopReel exposes a Data Deletion Callback endpoint that handles automatic deletion requests originating from TikTok: https://api.plugly.io/tiktok/data-deletion. When a deletion request is received via this endpoint, ShopReel deletes all data associated with the relevant TikTok account within 24 hours and confirms completion to TikTok.

11. Cookies and Tracking

On plugly.io and app.plugly.io (where you administer ShopReel) the following cookies are used:

• Strictly necessary cookies for login session and CSRF protection - set without consent as they are strictly necessary
• Statistics cookies for anonymised product analytics - set only after consent

In ShopReel widgets embedded on customers' websites no tracking cookies are set. ShopReel only uses technically strictly necessary cookies/storage to remember display state (e.g. whether the user has opened a modal). Aggregated counters of widget impressions and clicks are anonymous and cannot be used to identify individual end users.

12. Data Security

ShopReel takes data protection seriously and has implemented appropriate technical and organisational security measures, including:

• Encryption in transit (TLS 1.2+) for all connections
• Encryption of sensitive data at rest (AES-256), including all OAuth tokens from TikTok
• Access control and logging of administrator access
• Regular backups and recovery testing
• Vulnerability monitoring and dependency updates
• Restricted employee access on a need-to-know basis

In the event of a data breach involving high risk to data subjects, ShopReel will notify the Danish Data Protection Agency within 72 hours and the affected users without undue delay.

13. Children

ShopReel is a service for commercial entities and is not directed at children under the age of 18. ShopReel does not knowingly collect personal data about children. If you become aware that ShopReel has nonetheless done so, please contact us and we will delete it.

14. Changes to this Policy

ShopReel may update this policy from time to time. The version in force at any given time is available at plugly.io/en/shopreel/privacy/. In the event of material changes, ShopReel will notify Users via email or in the administration tool before the change takes effect.

The date of the most recent update is shown in the schema block at the top and at the bottom of the page.

15. Contact and Complaints

If you have questions about this ShopReel Privacy Policy or ShopReel's processing of your data, contact:

Plugly.io ApS (operator of ShopReel)
Email: info@plugly.io

You have the right at any time to lodge a complaint with the Danish Data Protection Agency about ShopReel's processing of your personal data:

Datatilsynet (Danish Data Protection Agency)
Carl Jacobsens Vej 35
2500 Valby, Denmark
Email: dt@datatilsynet.dk
Web: www.datatilsynet.dk

Last updated: 21 May 2026