Effective date: September 28, 2026
Operator: SMAT Designs LLC (“SMAT Designs,” “we,” “us,” or “our”), Arizona, United States.
This Privacy Policy explains how CommerceOS Connector collects, uses, discloses, stores, and protects information when an authorized business operator uses this website, CommerceOS services, or supported third-party integrations.
1. Information we collect and process
Depending on the features and providers an authorized business connects, CommerceOS may process: business and account identifiers; contact or support information a user provides; provider account, shop, channel, product, catalog, inventory, order, fulfillment, analytics, and operational records; OAuth authorization identifiers, granted scopes, access and refresh tokens; webhook and reconciliation events; device, request, security, diagnostic, and audit information; and content or metadata a user expressly submits to a supported workflow.
2. Sources of information
We receive information directly from authorized users, from third-party services they choose to connect, and from operation of CommerceOS itself. We do not ask users to provide their TikTok password to CommerceOS.
3. TikTok Login Kit and Content Posting API data
For the TikTok creator integration submitted for review, CommerceOS requests only user.info.basic and video.upload. Login Kit is used to obtain user authorization and the basic TikTok identity permitted by that scope, including the identifiers and display information returned by TikTok. CommerceOS stores the authorized connection identifier, display name when returned, granted scopes, connection status, and encrypted server-side OAuth credentials needed to maintain the authorized connection.
The Content Posting API Upload workflow runs only after the user selects a video and chooses to upload a draft. In the current draft-upload implementation, CommerceOS receives the selected video bytes for that request and transfers them to the TikTok-provided upload destination; CommerceOS does not retain the uploaded video file as stored media after that transfer. CommerceOS retains operational upload metadata and status needed to reconcile delivery, such as the connection, TikTok publish identifier, filename, content type, byte size, status, failure reason if any, and timestamps. Direct Post is not requested and CommerceOS does not request video.publish for this application.
TikTok Shop seller authorization is a separate CommerceOS integration. When an authorized seller uses it, CommerceOS may process seller/shop identifiers, authorization credentials, and supported commerce records made available under that seller authorization.
4. How we use information
- Authenticate and maintain connections that users or businesses authorize.
- Associate provider identities and records with the correct CommerceOS business/channel.
- Perform user-requested workflows, including TikTok draft upload.
- Synchronize and reconcile catalog, inventory, order, fulfillment, analytics, and integration state where supported.
- Provide support, diagnose failures, maintain service reliability, prevent duplicate or unauthorized processing, and protect the service.
- Maintain appropriate operational and security records and comply with legal obligations.
5. Sharing and disclosure
We disclose information only as reasonably necessary to provide and protect CommerceOS: to a connected platform when the user directs CommerceOS to interact with that platform; to infrastructure, communications, security, and other service providers acting on our behalf; when required by law or valid legal process; when reasonably necessary to protect rights, safety, security, or prevent abuse; or as part of a business transaction subject to appropriate protections.
6. Sale and unrelated advertising
SMAT Designs does not sell TikTok authorization data or personal information processed through CommerceOS. We do not use TikTok data obtained through these integrations to build unrelated advertising profiles or to serve unrelated targeted advertising.
7. Retention, revocation, and deletion
We retain information only for as long as reasonably necessary for the purpose for which it was collected, to operate and secure CommerceOS, preserve appropriate business or audit records, resolve disputes, or meet legal obligations. OAuth credentials remain associated with an active connection until they expire, are revoked, are replaced, or are deleted. When a supported TikTok creator connection is revoked through CommerceOS, the stored credential is deleted and the connection is marked revoked. As described above, the creator draft-upload flow does not retain the uploaded video file as CommerceOS-stored media after transfer, although upload metadata and status may be retained for operational and audit purposes.
Users and authorized businesses may request deletion of eligible CommerceOS-held personal information or connected-platform data by contacting support@smatdesigns.com. We may retain information where required or permitted for security, fraud prevention, legal compliance, dispute resolution, or necessary business records.
8. Security
CommerceOS uses administrative, technical, and organizational safeguards designed to protect information. Provider credentials and authorization tokens are handled server-side and protected using access controls and encrypted credential storage. No method of transmission or storage can be guaranteed to be completely secure.
9. Your choices and privacy rights
TikTok authorization is optional. A user can decline authorization or revoke a connected account. After authorization is revoked or expires, CommerceOS must obtain valid authorization before making further protected requests. Depending on applicable law and the nature of the data, a person may also have rights to request access, correction, deletion, or a copy of eligible personal information, or to object to or limit certain processing. Requests can be sent to support@smatdesigns.com; we may need to verify the requester and authority over the relevant account.
10. Cookies and session technologies
CommerceOS may use cookies or similar session technologies when needed for authentication, security, reviewer/demo sessions, preferences, and essential service operation. Third-party services reached through an integration may use their own cookies under their own policies.
11. International processing
CommerceOS is operated from the United States. Information may be processed in the United States and in other locations where connected platforms or service providers operate, subject to applicable legal requirements.
12. Children's privacy
CommerceOS is a business operations service and is not directed to children under 13. We do not knowingly collect personal information from children under 13 through CommerceOS.
13. Third-party services
TikTok and other connected services are independent third parties with their own terms and privacy practices. This Policy describes SMAT Designs’ handling of information received or processed by CommerceOS; it does not replace a third party’s privacy policy.
14. Changes to this Policy
We may update this Policy to reflect changes to CommerceOS, connected-platform requirements, security practices, or applicable law. We will post the current version at this URL and update the effective date.
15. Contact
Privacy questions, deletion requests, or other privacy requests may be sent to support@smatdesigns.com. Operator: SMAT Designs LLC, Arizona, United States.