Privacy Policy — TCN Agent

App name: TCN Agent
Publisher: Devign LLC, Beirut, Lebanon (the "Company," "we," "us," or "our")
iOS Bundle ID: com.devignlb.tcnagent
Android Package: com.devignlb.tcnagent
Contact: info@devignlb.com

Last Updated: May 8, 2026
Effective Date: May 8, 2026

This Privacy Policy applies to the TCN Agent mobile application (the "App"), a read-only sync and dashboard tool published by Devign LLC on the Apple App Store and Google Play. The App connects to a user's own TikTok Backstage account and displays their roster, performance, and a projected agency bonus calculated from their own agency's published bonus formula. The App does not process payments, hold funds, transmit money, or give access to any purchasable content. Compensation between an agency and its team is paid by the agency's own payroll process, entirely outside the App.

Each agency that signs up uses the App with its own roster and its own data; agencies do not see one another's creators or numbers.

This Policy describes how we collect, use, share, retain, and protect personal information processed through the App, and the rights you have over that information. By using the App you (the agent) consent to the practices described here.

1. Definitions

• "Personal information" or "personal data" means information that identifies, relates to, or can reasonably be linked with a particular natural person, as defined under the GDPR, the CCPA/CPRA, and similar laws.
• "Process" means any operation performed on personal data, including collection, storage, use, sharing, and deletion.
• "Sub-processor" means a third-party service provider that processes personal data on our behalf under contract.
• "Agent" means a person with an active TCN Agent account — typically the owner, operator, or staff of a TikTok-recognized creator agency.
• "Agency" means a TikTok-recognized creator agency or talent management business that holds a partnership with TikTok and operates a roster of creators on the platform.

2. Who Uses This App

The TCN Agent app is open to anyone running a TikTok creator agency. There is no application process, no waiting list, and no allowlist of pre-approved agencies. Anyone can download the app, tap Continue on the welcome screen, and create an account through Auth0's standard sign-up form (email + password). Sign-up takes less than a minute.

Each account is then linked to your own TikTok Backstage credentials, which you provide once inside the app. The data we display is sourced directly from your own Backstage dashboard — you only see the creators on your own roster, never another agency's data.

There is no fee, no "internal" gating, and no restriction by company or organization. If you have a TikTok creator agency, you can use the app.

3. Information We Collect

3.1 Categories aligned with Apple App Privacy

The following categories mirror Apple's App Privacy taxonomy and identically describe what we declare on the App Store:

Apple data type	What we collect	Linked to your identity?
Contact Info → Email Address	Your work email address, used as your sign-in identifier (via Auth0)	Yes
Contact Info → Name	Your full name, shown in the App header and used in audit log entries	Yes
Identifiers → User ID	Your internal agent_id, assigned by Devign LLC, links your account to your portfolio	Yes
Usage Data → Product Interaction	API requests, screen views, feature interactions; used for analytics and to operate the App	Yes
Diagnostics → Crash Data	Crash reports collected via standard Expo / React Native mechanisms	No (anonymous)
Diagnostics → Performance Data	Performance traces collected via standard Expo / React Native mechanisms	No (anonymous)
Other Data Types → "TikTok Backstage sign-in details"	Your own TikTok Backstage email and password, stored only if you choose to enable automatic background sync of your own roster and performance data; encrypted at rest (see §7)	Yes
Other Data Types → "Push notification token"	Your device's push notification token, used to send in-app alerts; deleted when you remove the App	Yes

We do not use this data to track you across apps or websites owned by other companies. We do not collect or use the IDFA (iOS Advertising Identifier) or Android Advertising ID.

3.2 Information we explicitly do not collect

• Precise or coarse location data, GPS data, or IP-based geolocation
• Microphone, camera, or audio input
• Photos, videos, contacts, calendar entries, or files
• Health, fitness, or biometric data
• Browsing history, search history, or any data outside the App
• Advertising identifiers (IDFA, Android Advertising ID)
• Sensitive demographic information (race, religion, political opinion, sexual orientation, etc.)
• Payment, banking, or financial information from you (the agent)

4. Creator-Level Data Visible in the App

The App displays portfolio data about TikTok creators in your assigned roster — handles, tier, diamond totals, LIVE hours, PK match counts, etc. This data is sourced from:

• The TikTok Backstage agency portal, accessed under Devign LLC's TikTok agency partnership and, when you enable automated sync, via the credentials you store in the App;
• Devign LLC's internal agency database, populated by aggregating Backstage data over time.

Devign LLC's relationship with each creator and the corresponding privacy disclosures to those creators are governed by the separate Devign Creator Agency Member Privacy Policy and the agreements between Devign LLC and TikTok Pte. Ltd. The TCN Agent app does not present any data outside the metrics already accessible to the agency through the official Backstage portal.

5. How We Use Your Information

We process your information for the following purposes only:

• Authentication and access control — to verify your account and scope every request to your own data.
• App functionality — to compute and display your daily action recommendations, rank-up math, bonus projection, and alerts.
• Backstage data sync — to fetch your own roster, performance, and bonus data from your own TikTok Backstage account using the sign-in details you provide. We refresh this data automatically in the background so you don't have to.
• Audit and accountability — to record who took which action inside the App for internal accountability and regulatory purposes.
• Service improvement — to investigate bugs, improve the App's recommendation logic, and fix performance issues.
• Push notifications — to send you alerts about creators in your portfolio, and to notify you if your TikTok Backstage password changes or the connection needs renewing.

What we do not do: We do not post, message, modify, delete, or take any other action inside your TikTok Backstage account. The connection is read-only — we only fetch the data you'd see yourself if you signed into your own Backstage dashboard. We do not access the Backstage data of any other agency, and other agencies cannot access yours through this app.

We do not use your data for advertising, profiling, automated decision-making with legal effects, or any purpose unrelated to operating the App.

6. Sub-Processors and Sharing

We do not sell, rent, lease, or trade your personal information to any third party.

We use the following sub-processors who process limited data on our behalf, under contract, in compliance with applicable law:

Sub-processor	Country	Data shared	Purpose
Auth0 (Okta, Inc.)	United States	Email address, name	User authentication (single sign-on)
Apple Push Notification service (Apple Inc.)	United States	Device push token, notification payload	Notification delivery on iOS
Firebase Cloud Messaging (Google LLC)	United States	Device push token, notification payload	Notification delivery on Android
Contabo GmbH	France (data centre Lauterbourg)	All App data at rest	Server hosting and storage
TikTok Pte. Ltd.	Singapore	Your own TikTok Backstage sign-in details, transmitted to TikTok only when refreshing your own roster and performance data	Authorized read-only data fetch from your own TikTok Backstage account

We do not share data with advertising networks, data brokers, marketing platforms, or analytics platforms outside the standard Expo/React Native crash and performance telemetry.

7. Data Security

• All traffic between the App and our servers is encrypted in transit via HTTPS using TLS 1.2 or higher.
• Your TikTok Backstage sign-in details are encrypted at rest using authenticated AES-based encryption. The encryption key is held in a server-side environment on a secrets-managed instance and is never shipped to the device.
• Authentication tokens issued by Auth0 are stored on the device using expo-secure-store, which uses iOS Keychain (Secure Enclave-backed where available) on iOS and the Android Keystore on Android.
• API endpoints validate JWT tokens on every request; each account is fully isolated server-side — accounts can never read another account's data.
• Database queries use parameterised statements; password hashes (where applicable for non-Auth0 credentials) use bcrypt.
• Servers run with restricted SSH access, automated security updates, and network firewalling.

While we apply industry-standard precautions, no method of electronic transmission or storage is 100% secure. We commit to notifying affected agents and the relevant data-protection authority in the event of a personal-data breach in accordance with Article 33 of the GDPR (within 72 hours where applicable) and §1798.82 of the California Civil Code.

8. Data Retention

• Account data (email, name, agent_id, settings) — retained for the duration of your active account. Deleted within 90 days after you delete your account or stop using the App.
• Audit-log records — retained for up to 7 years post-deactivation for accounting, tax, and regulatory purposes; pseudonymised after deactivation so they cannot be reasonably linked back to you.
• TikTok Backstage sign-in details — kept only as long as automatic sync is enabled. Deleted within 24 hours after you disconnect from the in-app Sync screen, sign out, or delete your account.
• Push notification tokens — deleted when you uninstall the App or sign out.
• Crash and performance telemetry — anonymised at collection; retained for up to 12 months by the underlying platform vendors per their published policies.

9. Your Privacy Rights

9.1 Rights available to all users

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your account and personal data, subject to retention requirements in §8.
• Right to data portability — request your data in a structured, machine-readable format (JSON or CSV).

9.2 European Economic Area, UK, and Switzerland (GDPR / UK GDPR / FADP)

Legal basis for processing:

• Performance of a contract (Art. 6(1)(b) GDPR) — your employment or contractor agreement with Devign LLC, which requires use of the App to perform agency duties.
• Legitimate interest (Art. 6(1)(f) GDPR) — operating the App, preventing fraud and abuse, audit logging, and improving service quality.
• Compliance with legal obligation (Art. 6(1)(c) GDPR) — for tax, accounting, and regulatory record-keeping (audit logs).

Additional rights for EEA / UK / Swiss residents:

• Right to object to processing based on legitimate interest.
• Right to restrict processing.
• Right not to be subject to solely automated decision-making with legal or similarly significant effects (we do not engage in such decision-making).
• Right to withdraw consent (where consent is the legal basis), without affecting the lawfulness of prior processing.
• Right to lodge a complaint with your local data protection authority under Art. 77 GDPR.

9.3 California (CCPA / CPRA)

If you are a California resident:

• Right to know — what personal information we collect, use, disclose, and the categories of sources and recipients.
• Right to delete — request deletion of your personal information.
• Right to correct — request correction of inaccurate personal information.
• Right to limit use of sensitive personal information — we do not collect sensitive personal information beyond authentication credentials, which are used solely to operate the App.
• Right to opt out of sale or sharing — we do not sell or share personal information for cross-context behavioural advertising.
• Right to non-discrimination — we will not discriminate against you for exercising any CCPA right.

To exercise any right, email info@devignlb.com. We will respond within 45 days (or as required by applicable law) and may need to verify your identity before fulfilling the request.

10. Apple App Tracking Transparency

The App does not "track" within the meaning of Apple's App Tracking Transparency (ATT) framework. We do not link data collected from the App with data collected by other companies' apps, websites, or offline properties for advertising or measurement, and we do not share device-level identifiers with data brokers. You will not see an ATT prompt because we do not request permission to track.

11. International Data Transfers

Personal data may be transferred to and processed in countries outside your country of residence, including:

• France (server hosting at Contabo GmbH, Lauterbourg)
• United States (Auth0 / Okta, Apple Push Notification service, Firebase Cloud Messaging)
• Singapore (TikTok Pte. Ltd., for the Backstage credential exchange you authorise)

Where required by law, we rely on the European Commission's Standard Contractual Clauses or equivalent transfer mechanisms with sub-processors located outside the EEA.

12. Account Deletion

To request deletion of your account, email info@devignlb.com from the email address tied to your TCN Agent account, or contact your Devign LLC manager. We will deactivate the account immediately and remove personal data within 90 days, except for audit-log records as described in §8 and any data we are legally required to retain.

13. Children's Privacy

The App is restricted to Devign LLC agency staff aged 18 and older. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has been provisioned access in error, contact info@devignlb.com and we will promptly investigate and delete the data.

14. Push Notifications

When you grant the operating-system permission, the App registers your device with Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android) and stores the resulting push token on our server. Tokens are used solely to deliver in-app alerts (creator alerts, rank-up eligibility changes, payout-gap reminders). You can disable notifications at any time through your device settings; this does not affect your account or the rest of the App.

15. Cookies, Tracking Pixels, and SDKs

The App does not use cookies, tracking pixels, advertising SDKs, analytics SDKs (beyond standard Expo / React Native crash reporting), or fingerprinting techniques. The Devign LLC public website (devignlb.com) uses standard web cookies and is governed by a separate website privacy notice.

16. Third-Party Services and Links

The App may link out to TikTok Backstage and to internal Devign LLC tools. We are not responsible for the privacy practices of those external services; please review their policies independently.

17. Changes of Control

If Devign LLC is involved in a merger, acquisition, asset sale, or insolvency, your personal data may transfer to the successor or acquiring entity. We will notify you in advance through the App or by email and your rights under this Policy will continue to apply with the successor.

18. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top, post the revised version at the same URL, and notify you in-app at next sign-in. Continued use of the App after the effective date constitutes acceptance of the updated Policy.

19. Contact

Questions, complaints, or requests about this Privacy Policy or our data practices? Contact:

Devign LLC — Privacy Office
Email: info@devignlb.com
Website: https://devignlb.com

We aim to respond to all privacy enquiries within 30 days.