Privacy Policy

Last updated: 15.11.2026. This is an English translation of our Datenschutzerklärung. If the two versions differ, the German version prevails.

1. Controller

seobuddha GmbH, Bahnhofstraße 112, 25451 Quickborn, Germany
Email: info@seobuddha.de

2. Overview

ChatScout helps creators search the chat of their own TikTok LIVE streams and provides rankings about LIVE streams. Three groups of people are affected:

We do not use any advertising, analytics or tracking tools and we do not sell data.

3. Hosting and server logs

The application is operated by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, the database by Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992 in the region London (eu-west-2), United Kingdom. We have data processing agreements with both providers (Art. 28 GDPR). For the United Kingdom, an adequacy decision of the European Commission applies (Art. 45 GDPR). Where data is transferred to the USA or other third countries, we rely on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses (Art. 45, 46 GDPR).

When you visit the website, the host processes technically necessary data (IP address, time, requested address, browser identifier) in server logs to provide the service securely and analyze errors. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). Logs are kept only for a short time.

4. Login with TikTok

Sign-in works exclusively via "Login with TikTok" (TikTok Login Kit). After you consent, TikTok redirects you back to us and transmits: your TikTok account ID (open_id), your username, your display name and your profile picture. We use this to make sure you only see data from your own streams.

We revoke the access token issued by TikTok immediately after reading this information. We do not store it and do not access your TikTok account any further. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). TikTok's own privacy policy applies to the processing at TikTok.

5. Customer account and API keys

For your account we store the information from section 4, the time of verification, your API keys (only as a cryptographic hash), package and term, and the number of API requests per day (for quotas). The legal basis is Art. 6(1)(b) GDPR. We keep this data for as long as your account exists and then delete it, unless statutory retention obligations apply (e.g. up to 10 years for invoices under German commercial and tax law).

6. Cookies

We only use technically necessary cookies (§ 25(2) no. 2 TDDDG). No consent is required for them:

7. Payments

We currently only offer a free trial and do not process any payment data. Once we introduce paid packages, we will add the payment provider and the data processed here.

8. Chat messages in the streams of signed-in creators

Which data: username and display name of the person writing, message text, time and the related stream. The data comes from the public LIVE chat (Art. 14 GDPR).

Only for signed-in creators: chat messages are only stored from streams of creators who have verified their TikTok account with us and have active access. Only that creator can search them. We do not store chats from other streams. There is no search for people across streams.

Purpose and role: the search serves the creator's moderation and community management, for example to find giveaway entries, spam or insults. We process the data on behalf of the creator (Art. 28 GDPR). The creator is the controller and relies on their legitimate interest in moderating their stream (Art. 6(1)(f) GDPR).

Retention: chat messages are deleted automatically after 30 days. When the creator's access ends, no new messages are stored.

Your rights as a viewer: you can object to the processing and request deletion of your messages, either with the creator directly or with us at info@seobuddha.de (please state your TikTok username and the stream). We forward requests to the creator or delete the messages on their behalf.

9. Public LIVE rankings

For rankings we process publicly visible information about LIVE streams: username, display name, country and category of creators, times and viewer numbers of streams, and the totals of virtual gifts, including the username and display name of the people sending gifts. The legal basis is our legitimate interest in providing statistics about public LIVE activity (Art. 6(1)(f) GDPR). You can object at any time (section 11), and we will then remove your data from the rankings. Individual gift events, including the names of the people sending gifts, are deleted automatically after 90 days.

9a. Stream analytics (polls and content tracking)

From public LIVE streams we evaluate how many votes each poll option received, how many chat messages were written per minute, the mood in the chat, and how often other creators were named via @-mention or in the stream title. Messages and votes are evaluated automatically as they arrive. Only counts without viewers' names are stored; the message text is discarded. The legal basis is our legitimate interest in statistics about public LIVE activity (Art. 6(1)(f) GDPR).

Named poll votes are only stored for streams of signed-in creators with active access, on behalf of that creator (Art. 28 GDPR, see section 8). Only that creator can see them. We do not share them with third parties and do not offer any cross-stream analysis of individual people. Like chat messages, they are deleted after 30 days.

10. Recipients

Recipients are our hosting providers (section 3) and, for chat data, only the respective creator. Data is only passed on to third parties if we are legally obliged to do so.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). To exercise them, contact info@seobuddha.de.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us: Independent Centre for Privacy Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

12. Automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.