Privacy
Policy.

Who is responsible

Leon Stolz operates Kanaso Creator and is responsible for the processing described here. For privacy questions or requests, email privacy@kanaso-creator.xyz. This policy covers the Creator website, dashboard and related Creator Program operations, including the invitation-only TikTok API connection where used.

Kanaso Creator is Kanaso’s own paid promotional campaign for its Japanese-learning app. Participating creators make content under Kanaso’s briefs and submit their own TikTok posts for view tracking and payment review. It is not a marketplace connecting creators with other brands. The Japanese-learning app is a separate service; this policy concerns the Creator Program.

What we handle and why

• Discord sign-in: your Discord ID, username or display name, avatar reference, server roles, login challenge and session records. We use these to identify you, check access and protect the dashboard. The website requests Discord’s identify permission and sends a one-time code by Discord direct message.
• TikTok accounts and submissions: registered usernames and account status; submitted post URLs and IDs; content type and language; saved preview images; observed views and check times; review decisions and notes. We use these to verify account ownership, display posts, check eligibility and resolve disputes.
• Earnings and operations: calculated earnings, affiliate codes and referrals, approval and payout records, plus audit events for submissions, reviews and payment actions. We use these to administer the program, detect abuse and account for payments.
• Support and privacy requests: the contact details and information you choose to send us, together with the records needed to answer your request or verify account ownership.

Processing needed to provide the Creator Program and dashboard is based on performance of our agreement with you (GDPR Article 6(1)(b)). Security, fraud prevention, audit and dispute handling are based on our legitimate interests (Article 6(1)(f)); records required by law are processed under Article 6(1)(c). Optional TikTok authorization is requested separately and may be withdrawn.

Account and submission information is needed to provide the corresponding dashboard and campaign features. If you do not provide it, we cannot register that account or assess that submission. You can read the public pages and explore the read-only demo without a Discord or TikTok connection.

How TikTok posts are checked today

When you submit a post, Kanaso checks its TikTok link and may save a preview image for the dashboard. For accounts using the official connection, public post metadata and view counts can come from TikTok’s API. The earlier workflow also checks public TikTok post or profile pages and records when each count was observed. Those checks can use a dedicated browser session operated by Kanaso; it may retain its TikTok sign-in state between checks and is separate from your own browser.

We collect submission details from you, account and role information from Discord, and authorized account details and post observations from TikTok. Automated checks apply the submission window, format minimums and other program limits, and calculate provisional earnings from eligible observed views. A submission may be blocked or rejected by those checks. Staff review payment eligibility before approval; an API view count alone does not prove that engagement qualifies for payment. Contact Kanaso support or the privacy contact above if you believe a check or decision is wrong.

Connecting your TikTok account

Where the invitation-only connection is available, you authorize your own account on TikTok’s authorization page. Kanaso does not receive your TikTok password. The video.list permission lets us query the public metadata for your submitted posts: post ID, link, view count, upload time and an available cover image for the dashboard preview. This includes supported photo/slideshow posts.

The Web connection also requests user.info.profile and reads only your TikTok username to check that you authorized the registered account. The earlier Desktop pilot uses video.list and checks ownership against a known submitted post. Kanaso receives an account identifier and access and refresh tokens. We use observed views for campaign eligibility and human payout review. We do not request permission to publish, edit or delete content, or access audience demographics. We use this optional connection only after authorization (Article 6(1)(a)).

Tokens are held in an encrypted server-side store. Disconnecting in the dashboard removes the local token pair and stops future official API checks. We also attempt to revoke the authorization with TikTok; if that cannot be confirmed, you can revoke access in TikTok itself. The local token pair stays removed even if the revocation request fails. Disconnecting does not erase existing submission, view, review or payout records that are needed for the program.

When official API tracking is selected, accounts that used the connection are not silently switched back to public-page scraping after disconnection or an API failure. Their checks remain pending until authorized data or a staff verification is available.

When configured, TikTok can notify our webhook that an authorization was removed. We verify the notification’s signature and timing before processing it. A matching notification removes the active local authorization; delayed notifications must not remove a newer connection. Limited hashed event receipts prevent duplicate processing. Removing a connection and requesting erasure of stored program records are separate actions.

Where information goes

The Creator website and backend use an operator-managed virtual private server provided by Namecheap. Creator records, saved preview images and application backups are stored in access-restricted files on that server. Separate recovery copies may also be retained by the operator.

• Kanaso staff: staff with the relevant role can access creator, review and payout records for their work.
• Namecheap hosting and email: Namecheap provides the server infrastructure and the Private Email service for our privacy contact mailbox. Hosting involves the data stored on the server and the network information needed to deliver the website. If you email us, the email service handles your address, message and any attachments. Namecheap’s Privacy Policy explains its own processing.
• Discord: we communicate with Discord for sign-in, server roles, login codes, important creator notices and staff review notices. Routine tracking updates do not generate creator direct messages. Discord’s Privacy Policy also applies to its service.
• TikTok: we communicate with TikTok for public post checks and, if you authorize a connection, account matching and submitted-post queries. TikTok’s Privacy Policy explains its own processing.
• Payout arrangements: the current program rules offer PayPal Goods & Services or USDT ERC-20. Staff arrange payments separately; the dashboard records approval and payment status rather than initiating transfers through an integrated payment provider. When arranging a payout, the chosen payment service receives the details needed to make it. PayPal’s Privacy Statement explains its processing. Cryptocurrency transactions and wallet addresses can be publicly visible on the blockchain.

Namecheap, Discord, TikTok and a chosen payment service may process information outside the European Economic Area under their applicable terms. Their privacy notices explain their own international processing. Those notices do not replace Kanaso’s responsibilities for transfers it makes. You can contact us for information about the recipients of your data and applicable international transfer arrangements.

How long information stays

Login codes expire after five minutes and signed-in sessions after twelve hours. Login state and session tokens are stored as hashes. The website uses HTTP-only, SameSite=Lax cookies needed for sign-in. We attempt to delete each login-code direct message after five minutes and retry if deletion fails; Discord controls its own copies.

Creator, post, view, review, referral, payout and audit records do not currently have a fixed automatic expiry. They are held while needed to operate the program, resolve reviews or disputes, account for payments, or meet applicable legal duties. If you leave or request erasure, we assess what can be removed or restricted and what must remain for those reasons. Some audit entries are append-only, so deletion is not automatic or universal. Automatic core-database backups rotate by count: the newest 14 verified copies are kept, not a fixed number of days. Full-store server backups and separate release snapshots may also contain sign-in records and encrypted TikTok connection records. These application recovery copies are access-restricted, do not include the encryption key, and are retained until manually removed rather than following the automatic 14-copy rotation.

Try the dashboard without connecting

The reviewer demo uses fictional accounts, posts, views and payments, with bundled public artwork. It does not query TikTok, read private creator records, create a signed-in session, or let visitors submit posts, connect accounts or request payouts. Its illustrative numbers are not live API results or evidence of real creator earnings.

The demo is separate from the real TikTok authorization and post-checking flow. Opening external Discord, TikTok or learning-app links takes you to those services, where their own privacy notices apply.

Access, correction and deletion

Depending on your circumstances, you may ask to access, correct, erase or restrict your personal data, receive a portable copy, object to processing based on legitimate interests, or withdraw consent for an optional connection. Withdrawing consent does not affect the lawfulness of processing before withdrawal. Email privacy@kanaso-creator.xyz; we may need to verify that the request comes from the account owner, without asking for your TikTok password or login code. You may also complain to a competent data-protection authority, including one where you live, work or believe an infringement occurred.