Privacy Policy · 31 July 2026

Your accounts remain yours.

This Policy explains how MediaManager, operated by Elashera, handles personal information when you use the service or connect a third-party social account. Contact: contacto@elashera.com.

1. Information we process

• Account and organization data: sign-in identity, membership, roles, preferences and the brands or profiles you manage.
• Connected social account data: provider, account identifiers, display name, username, avatar, granted scopes and connection status.
• OAuth credentials: access and refresh tokens supplied by the provider. They are exchanged server-side, encrypted before storage and never intentionally exposed to the browser.
• Content and campaign data: titles, descriptions, assets, campaign associations, publishing settings and operational history you choose to store.
• Provider content: information made available through approved APIs, such as a connected creator's public TikTok videos, links and engagement counters.
• Technical data: security, audit and diagnostic records, including timestamps, request identifiers, device/browser information and errors.

2. TikTok data

When you connect TikTok, MediaManager currently requests user.info.basic to identify the authorized account and video.list to retrieve that creator's public videos. We use this information to display the connected account, browse its public video inventory and associate selected videos with campaigns. We do not request TikTok publishing permission in this review phase.

3. Why we process information

We process information to provide the service you request; authenticate and authorize users; preserve organization boundaries; connect and revoke provider access; organize, synchronize and display content; prevent abuse; diagnose incidents; respond to support; and meet legal obligations. Depending on context, processing is based on performance of the service agreement, steps you request before entering it, legitimate interests in secure operation, your authorization of a provider connection, or legal obligations.

4. Sharing and processors

We do not sell personal information. Information may be handled by infrastructure and service providers needed to host, secure and operate MediaManager, under appropriate contractual controls. We transmit data to connected social platforms only when needed to perform an action you authorize. We may disclose information when required by law or to protect users and the service.

5. International transfers

Some technology or social platform providers may process information outside the European Economic Area. Where European data protection law applies, we use or rely on an applicable transfer mechanism and safeguards required for the relevant provider and processing.

6. Retention and deletion

We retain information while the account or organization is active and as needed to provide the service. After disconnection, the provider token is revoked and no longer used. Some records may be retained when reasonably required for security, audit, dispute resolution, backup integrity or law. Retention depends on the type and purpose of the record; information is deleted or anonymized when it is no longer needed.

7. Security

MediaManager applies organization-level access controls, encrypted provider credentials, server-side OAuth exchanges and operational logging designed not to include tokens or authorization codes. No system can guarantee absolute security; contact us promptly if you suspect unauthorized access.

8. Your choices and rights

You can choose whether to connect a social account and can disconnect it to revoke access. Depending on applicable law, you may request access, correction, deletion, restriction, objection or portability of personal information. Send a request to the contact address above. We may verify your identity and authority for the relevant organization. In the EU, you may also complain to your local supervisory authority; in Spain, this is the Agencia Española de Protección de Datos.

9. Children

MediaManager is a professional service and is not directed to children. Users must have legal capacity and authority to manage the accounts they connect.

10. Cookies

MediaManager uses cookies or equivalent browser storage needed for authentication, security, language and essential preferences. If non-essential analytics or advertising technologies are introduced, this Policy and any required consent controls will be updated before use.

11. Changes and contact

We may update this Policy to reflect changes to the service, providers or legal requirements. The effective date above identifies the current version. Questions or requests can be sent to contacto@elashera.com.