Privacy & data protection policy
Effective September 14, 2026. Applies to ebc.studio, the websites, and the software operated by DB3 LLC, doing business as EBC Studio (“EBC Studio”, “we”, “us”).
- 1. Who we are
- 2. What we collect
- 3. TikTok Shop data
- 4. How we use data
- 5. Who we share it with
- 6. How we protect it
- 7. How long we keep it
- 8. Your rights
- 9. Children
- 10. Cookies
- 11. Changes
- 12. Contact
1. Who we are
EBC Studio is a software studio operated by DB3 LLC, a limited liability company in the United States. We build private software tools for TikTok Shop creators, including a creator studio (analytics, coaching, and a daily content brief), a sample-tracking tool, and public creator storefront websites. DB3 LLC is the data controller for the personal data described in this policy.
2. What we collect
We collect as little as the software needs to work. What we hold depends on how you interact with us.
| If you are | We collect | Source |
|---|---|---|
| A visitor to one of our websites | Standard server logs (IP address, browser type, pages requested, timestamps). Anonymous counts of clicks on outbound shop links. | Your browser |
| A newsletter subscriber or brand contact | The name, email address, and message you submit. | You |
| A creator who uses our studio | A login name and a session cookie. Public statistics for your own TikTok account and videos. Your conversations with the coaching assistant. Notes and memories you or the assistant save. | You; public TikTok data via licensed data providers |
| A creator who connects TikTok Shop | The data described in section 3. | TikTok Shop, with your authorization |
We do not collect payment card data, government identifiers, precise location, or biometric data. We do not buy data about you from data brokers.
3. TikTok Shop data
Our software connects to TikTok Shop through TikTok’s official Affiliate Creator API. The connection exists only after a creator authorizes our app from their own TikTok Shop account. Through that connection we may read:
- The creator’s own sample applications: product, seller, status, and content deadline.
- Sample fulfillment status and deadlines.
- The product showcase.
- Affiliate orders and their attribution to the creator’s content.
- The creator’s profile identifiers and the scopes granted.
We use this data for one purpose: to show it back to the creator who authorized it, inside their private studio, and to send them reminders about it. Specifically, we do not:
- read, store, or infer data about other creators, sellers’ customers, or buyers;
- sell, rent, license, or share TikTok Shop data with any third party;
- use TikTok Shop data to build profiles of anyone other than the authorizing creator;
- post, edit, or delete anything on TikTok on the creator’s behalf without a separate, explicit action by the creator.
Access tokens issued by TikTok are stored server-side in an access-controlled database and are never sent to a browser. A creator can revoke access at any time from their TikTok Shop account or by contacting us; revocation invalidates the token immediately and triggers deletion under section 7. We comply with the TikTok Shop Partner Center terms and the TikTok Shop developer data policies.
4. How we use data
- To operate the software: log a creator in, show their data, generate briefs and scorecards, and send the notifications they have turned on.
- To answer messages you send us.
- To keep the service secure and to diagnose failures, using server logs.
- To improve the creator’s own results, by running their own data through AI models that draft scripts, grade videos, and answer the creator’s questions. We do not send data about viewers, buyers, or third parties to AI models, and we do not allow AI providers to train on the data we send.
We do not use personal data for advertising, and we do not sell personal data as that term is defined under U.S. state privacy laws.
5. Who we share it with
We share personal data only with service providers who process it on our behalf under contract, and only what each needs:
| Provider | Purpose | Data |
|---|---|---|
| Vercel | Hosting and serverless compute | All data in transit through the application; server logs |
| Neon | Managed database | Stored application data, including TikTok Shop data and access tokens |
| Google (Gemini) | AI models for briefs, scorecards, and the coaching assistant | The creator’s own video statistics, captions, and conversations |
| Telegram | Notifications the creator has enabled | Summaries of the creator’s own activity and sample updates |
| Netrows, FastMoss | Public TikTok statistics and product trend data | The creator’s public handle; public product identifiers |
We will disclose data if required by law, subpoena, or court order, or to protect the safety of a person or the integrity of our service. If DB3 LLC is ever sold or merged, data would transfer under this policy, and we would notify affected creators first.
6. How we protect it
- All traffic to our websites and APIs is encrypted with TLS.
- Data at rest is stored in an access-controlled database that encrypts storage. Credentials for third-party services, including TikTok Shop access tokens and app secrets, are kept in encrypted environment configuration and never committed to source code or sent to browsers.
- Access to production systems is limited to authorized personnel with an operational need, each with individual credentials and multi-factor authentication where the provider supports it.
- Requests to TikTok Shop are signed and scoped to the minimum permissions the feature needs. We check the granted scopes before each feature runs.
- Job endpoints and administrative routes require a secret or an authenticated session; nothing that reads private data is publicly reachable.
- If we discover a breach affecting personal data, we will notify affected creators and, where required, TikTok and regulators, without undue delay and within 72 hours of confirming it.
7. How long we keep it
| Data | Retention |
|---|---|
| TikTok Shop access and refresh tokens | Until the creator revokes access or disconnects, then deleted immediately |
| TikTok Shop sample, showcase, and order data | While the creator’s account is connected, and 30 days after revocation, then deleted |
| Creator studio data (statistics, scorecards, briefs, conversations) | While the creator uses the studio; deleted within 30 days of a deletion request |
| Newsletter and contact submissions | Until you unsubscribe or ask us to delete them |
| Server logs | Up to 30 days, as retained by our hosting provider |
8. Your rights
Wherever you live, you can ask us to tell you what personal data we hold about you, correct it, delete it, give you a copy, or stop a particular use. Creators can also revoke TikTok Shop access at any time from their TikTok Shop account, which we treat as a deletion request for the data obtained through that connection.
Residents of California, Virginia, Colorado, Connecticut, Texas, and other U.S. states with privacy laws have the rights those laws provide, including the right not to be discriminated against for exercising them. Residents of the European Economic Area, the United Kingdom, and Switzerland have the rights under the GDPR and UK GDPR; our legal bases are performance of a contract (operating the software for you), consent (the TikTok Shop connection and notifications), and legitimate interests (security and service operation). We do not currently offer the service in those regions, but we will honor requests from anyone.
To exercise any right, email hello@momfinds.co or follow the steps on delete your data. We respond within 30 days and will verify the request using the email address on the account. We never charge for a request.
9. Children
Our services are for adults. TikTok Shop creator affiliates must be 18 or older, and we do not knowingly collect personal data from anyone under 18. If you believe we have, contact us and we will delete it.
10. Cookies
Our public websites set no tracking or advertising cookies. The creator studio sets one strictly necessary session cookie so a logged-in creator stays logged in, and one short-lived cookie during TikTok Shop authorization to protect against forged requests. We do not use third-party analytics cookies.
11. Changes
When we change this policy we update the effective date at the top. If a change reduces your rights or expands what we collect from TikTok Shop, we will tell connected creators by email or in the studio before it takes effect.
12. Contact
DB3 LLC, doing business as EBC Studio
United States
General requests: hello@momfinds.co
Data protection officer: Brian Brown, bbrown@cyrenitycyber.com
Our internal personal data protection policy and information security policy are published alongside this one.