1. Who we are
Project Lighthouse is a commerce operations platform provided by NAVIGATOR TIMES CULTURE MEDIA CO.,LTD. (“we”, “us”) to authorized business customers. Our business contact and privacy mailbox is hhj@hanghaijiafff.com. This notice covers the marketing-account connection described here; separate shop integrations may involve additional account and order information within the ERP. Customer businesses remain responsible for the shops and accounts they choose to connect.
2. What information we process
When an account owner authorizes TikTok Login Kit, we receive a TikTok account identifier, display name and avatar. With video.list, we query that account’s public video information, which may include video identifiers, titles or descriptions, hashtags, publication time, cover and share URLs, and available view, like, comment and share counts. TikTok also provides access and refresh tokens so the connection can continue without asking the owner to sign in for every query. We request video.upload so that, if approved and authorized, an authorized user can deliberately send a video the customer has rights to use to the selected account's TikTok inbox as a draft. The ERP records the selected destination and transfer status. We do not request private videos or Direct Post, and the ERP does not automatically publish content.
The ERP may link those public videos to separately authorized TikTok Shop analytics, such as product clicks, orders and GMV, only when the available identifiers and source data support the link. Customer access may also involve business identity, roles and operational audit information needed to run the workspace.
When email registration is enabled, a person may provide an email address, a chosen username, a display name, a password and optionally an avatar on the ERP registration page. We send a short-lived email verification code to check control of the address; the code is not retained as plaintext in the account file. Passwords are stored as salted hashes, not plaintext. We record account creation, recent login activity and whether the account has only demo access or has been admitted to a real business workspace. Demo access uses synthetic data and does not expose the shops of existing customers.
3. Why and how we use it
- Identify which consenting marketing account owns a public video and show a recognizable name and avatar to authorized users.
- Display video covers, descriptions, dates and available performance metrics to support content review and shop operations.
- Transfer a user-selected video that the customer is authorized to use to the selected account's TikTok inbox as a draft, only where the required access is available; publication remains the account holder's decision inside TikTok.
- Maintain secure account connections, prevent mistaken account attribution, investigate errors and protect the service.
- Respond to access, correction, disconnection and privacy requests.
Our business purpose is to provide and improve commerce and content workflows for authorized customers. The account owner’s TikTok authorization controls API access; it is not a claim that every data-processing activity relies on privacy-law consent. Where applicable, we rely on legitimate business interests, contractual necessity or another lawful basis appropriate to the activity, subject to the rights described below.
4. Storage, access and sharing
Account tokens, login records and matching records are stored in access-restricted files on our UK production server. Approved customer users and service personnel can view relevant information in the ERP according to their duties and permissions; tokens and password hashes are not displayed in the ERP. Zoho Mail, our existing email provider, processes registration addresses and verification messages when that login channel is enabled. Our infrastructure and service providers may process limited information to deliver hosting, security, identity and backup functions. The primary ERP runs in the UK and a separate Germany server is used for backup and recovery. Staff and service providers may access information across borders where needed for operations, subject to appropriate safeguards. We do not sell account data or give unrelated parties posting access.
Email demo account details and login records are retained while the account exists; a verified deletion request or discontinuation of the service triggers a review for deletion, subject to applicable operational, legal and backup requirements. Other records are retained according to their business purpose and applicable requirements. If an account is disconnected, we stop using its tokens and assess related records for deletion or retention where a legal obligation applies. Backup copies may take additional time to expire through the normal backup cycle.
5. Your choices and rights
Account owners can decline TikTok authorization. They can also revoke an app’s access from TikTok’s account settings, and may ask us to disconnect an account or review, correct or delete related personal information by emailing us. Revoking access at TikTok stops future API access but may not automatically remove records already held in our ERP; contact us if you want those reviewed. Depending on applicable law, you may also have rights to object, restrict processing, obtain a copy of your information or complain to a data-protection authority.
6. Contact and changes
Send privacy, email-account deletion and account-disconnection requests to hhj@hanghaijiafff.com. Please identify the relevant account without sending passwords or access tokens. We may update this notice as our integrations change; the effective date above will show the current version.