Privacy Policy

Last updated: 14 March 2026

1. Who we are

PM3K is a small independent service that lets you upload and schedule content for TikTok either directly from the PM3K dashboard or from low-code tools (Make, n8n, Zapier, custom scripts, etc.). This Privacy Policy explains what data we collect, how we use it and what choices you have.

PM3K is operated by Dmitrii Suchilin, VAT/NIF ESY8442376X, Calle de la Luna 1, 2B, Algorfa, Spain. For service, billing, or legal privacy questions, contact [email protected].

We are not affiliated with TikTok or ByteDance. We simply use the official TikTok APIs on your behalf, using your own TikTok account and permissions.

2. What this policy covers

This policy applies to:

• the pm3k.org website and dashboard,
• the PM3K REST API used from your low-code flows,
• temporary PM3K storage used for media uploads.

3. Data we collect

3.1. TikTok account data

When you connect TikTok, we receive data from TikTok via their official OAuth flow, for example:

• your TikTok open_id and basic profile info (username, avatar),
• access tokens and refresh tokens that allow us to upload and publish posts on your behalf.

We never receive your TikTok password. TikTok access and refresh tokens are stored only on our backend in encrypted storage/KV and are used solely to perform actions you or your automations request (uploading media, publishing posts, checking status, running scheduled jobs). We do not send these TikTok tokens to n8n, Make, Zapier or other external services: your flows talk to PM3K using PM3K API keys, webhooks or similar credentials, not TikTok tokens. When you use PM3K from a low-code tool (Make, n8n, Zapier, etc.), those tools communicate only with PM3K using your PM3K API key. Your TikTok tokens are never shared with them. We do not log TikTok access or refresh tokens in plaintext in our application logs and take reasonable steps to avoid tokens appearing in error traces.

3.2. Content you upload

When you upload media to PM3K storage or pass media URLs to our API, we process:

• the media file itself (for PM3K storage uploads),
• metadata such as file name, size, content type,
• your caption/title and posting options (privacy, comments, duets, stitches, ad flag, brand name).

PM3K does not analyze or view the contents of your media beyond what is required to prepare and send it to TikTok (such as format, size or duration checks).

PM3K may automatically check media metadata, captions, and posting patterns to prevent abuse and spam and protect the service. These checks are not used for profiling or advertising.

Media uploaded to PM3K storage is kept only for a limited time and then automatically deleted. Depending on plan and workflow, this is generally up to 3 days on the Free trial and up to 30 days on paid plans. Some flows keep media only for a shorter temporary window. See the “Data retention” section and the Data Deletion page for more details.

3.3. Usage and technical data

When you use PM3K, our servers and infrastructure providers automatically collect basic technical data, such as:

• IP address, browser type, device information,
• timestamps of logins, API calls, uploads and errors,
• limited request metadata (e.g. which endpoint was called, status codes, error messages).

We use this data to run the service, debug issues, fight abuse and respect TikTok’s limits and policies.

3.4. Cookies and local storage

We use a few simple cookies and browser storage items to make PM3K work, for example:

• session cookies to keep you signed in,
• plan and UI preferences (for example, selected plan or theme). These are cached locally in cookies or sessionStorage/localStorage only to make the interface faster; your actual subscription and plan window are stored on our backend and cannot be changed just by editing browser storage.
• security cookies set by our hosting provider (Cloudflare) to protect the site from abuse.

We do not use third-party advertising cookies and do not run cross-site tracking. Any analytics we use are basic and privacy-friendly (aggregated usage statistics, not marketing profiles).

3.5. Creator information (creator_info)

When you connect your TikTok account and use the dashboard, PM3K may call TikTok’s creator_info endpoint for your account.

This response can include your TikTok username, display name, avatar URL, privacy options, maximum video duration, and flags indicating whether comments, Duet or Stitch are disabled for your account.

We use this data to:

• show your TikTok profile in the dashboard,
• check if your account is allowed to post,
• automatically adjust available options (for example, disable Duet/Stitch switches if they are disabled on TikTok),
• validate your video duration before sending it to TikTok.

PM3K does not use your creator_info data for advertising or profiling. It is only used to configure your posting experience and enforce TikTok’s own limits.

We do not sell this information and do not share it with third parties, except TikTok as required to perform posting on your behalf.

3.6. Billing and subscription data

For paid subscriptions, payments are processed by PayPal. PM3K does not store full bank card numbers, full cardholder data, or full card verification details.

To operate paid access and subscription lifecycle events, PM3K may store limited billing and subscription metadata, such as:

• subscription status and cancellation state,
• subscription identifier,
• current billing period end, grace-period end, and access cutoff timestamps,
• payment-related event metadata needed for audit, security, and support.

This metadata is used only to provide, secure, and support subscription access, including enforcing paid-period and grace-period access windows.

Future charge cancellation and subscription management are handled through PayPal.

4. How we use your data

We use the data described above to:

• provide the core service (uploads, scheduling, posting to TikTok);
• enforce anti-spam checks and basic safety checks on captions;
• secure the service and prevent abuse and fraud;
• communicate with you about the service via in-app messages and, if you contact us by email or another channel, use that contact information only to reply and send important information about your account (no marketing);
• comply with our legal obligations and TikTok’s developer policies.

We may scan your captions for prohibited patterns (for example, external links or unsafe content) to comply with TikTok policies. This analysis is automatic and not used for marketing or profiling.

We do not sell your personal data and we do not use your media or captions to train public AI models.

5. Legal bases (for EEA/UK users)

If you are in the European Economic Area or the UK, we process your personal data mainly on these legal bases:

• Contract — to provide the PM3K service you sign up for,
• Legitimate interests — to secure our systems, prevent abuse and improve reliability,
• Legal obligation — where we must keep certain records or respond to lawful requests.

6. Data retention

• Media in PM3K storage. On the Free plan, PM3K-hosted media is generally kept for up to 3 days. On paid plans, PM3K-hosted media is generally kept for up to 30 days, but never beyond the end of your current billing period. Some flows keep media only for a shorter temporary window. Longer-term storage and longer posting schedules are only possible when you use your own media domain or storage that you connect and verify inside PM3K, and then use URLs from that domain in your flows or API calls. In that case the original files stay in your own infrastructure, and you control how long they are stored — PM3K may still fetch or temporarily buffer media needed to complete posting.
• Scheduling and job records. Kept long enough for you to see job history in the dashboard and for us to debug issues, then removed or anonymised.
• TikTok tokens and API keys. TikTok tokens and PM3K API keys are stored only while your PM3K account or plan is active. When you revoke access, perform a Disconnect & revoke., or when your plan expires, we delete or invalidate these tokens and keys immediately. We retain only your PM3K profile record (plan tier, expiration window and non-sensitive profile fields). All access tokens and API keys are deleted immediately when you sign out fully.
• Logs. Server logs and security logs may be kept for a longer period (for example up to 12–18 months) for security and abuse-prevention purposes.

You can also request deletion of your account and related personal data at any time. See the separate Data Deletion page for practical details.

7. Sharing your data

We share your data only with:

• Service providers that help us run PM3K (for example, hosting and storage providers such as Cloudflare/R2, error-tracking and logging tools, and PayPal for paid subscription payments).
• TikTok, when we call the TikTok APIs on your behalf to upload and publish posts or check status.
• Authorities only when we are legally required to do so.

These providers are allowed to process your data only to provide their services to us and must protect it appropriately.

8. International transfers

Our infrastructure providers may operate servers in different countries. This means your data may be processed outside your home country, including outside the EEA/UK. Where applicable, we rely on appropriate safeguards (for example, standard contractual clauses and data-processing agreements with our providers).

9. Your rights

Depending on your location, you may have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of your data, or restriction of its processing;
• object to certain types of processing;
• request a copy of your personal data that we store (for example, basic account profile, plan information and high-level usage records) in a portable format, where technically feasible. This does not include security credentials such as TikTok API keys, access tokens or refresh tokens.

To exercise these rights, contact us using the email address on the Contact page or the instructions on the Data Deletion page. We may need to verify your identity before acting on your request.

If you are in the EEA or UK and are not satisfied with our response, you can also complain to your local data protection authority.

10. Children

PM3K is a tool for adult creators and low-code developers. It is not intended for use by anyone under the minimum age required to use TikTok in their country. We rely on TikTok to enforce its own age limits. If we ever learn that someone below that age is using PM3K, we will remove their access and delete related data.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the dashboard or other in-service messages.

12. Contact

If you have questions about this Privacy Policy or how we handle your data, please contact us using the email address provided on the Contact page.