Seller data stays inside the seller's workspace

We process account identity and security-review status; authorized shop profile, catalog, inventory, order, return, promotion, settlement, fulfillment and analytics data; authorized Google Ads campaign metrics; authorized Facebook Page, Instagram business and Meta Ads metrics; supplier and logistics files; product images and copy; workspace decisions; support requests; and security and usage logs.

For a purchase, we process the plan, amount, currency, provider, merchant order ID, provider transaction ID, payment status, refunds and entitlement ledger. Hosted providers process the payer account or card details; TrendPilot does not store full card numbers, payment passwords or payment-provider login credentials.

We request marketplace, Google and Meta scopes only for product features visible to an authorized seller. We do not request seller passwords.

• Provide category, product, pricing, landed-cost and inventory analysis.
• Prepare listings, operating plans and after-sales workflows.
• Synchronize the seller's authorized TikTok Shop account and measure outcomes.
• Protect accounts, prevent abuse, resolve support requests and comply with law.

AI receives the minimum workspace context required for the selected task. Private seller records are treated as untrusted business data and form a longitudinal profile isolated to that account or team, so later recommendations can remain consistent without training another tenant's profile. AI outputs are estimates that require seller review before a business or TikTok write action.

Eligible retrieved public search excerpts may be de-duplicated into a platform signal pool; AI-generated research snapshots are not promoted by their self-rated quality. Anonymous operating benchmarks are off by default. Only an authorized user or team manager may opt the current workspace in. Each metric group requires at least 10 opted-in workspaces and 30 records; small groups and free-text categories are suppressed. Revocation excludes the workspace from newly computed benchmarks but does not retract previously published or exported reports. These safeguards are not a differential privacy guarantee. They never expose seller or team identity, SKU names, suppliers, private costs, private queries or raw notes.

Authorized administrators may view cross-workspace operational coverage for platform governance, support and forecasting. Identity-level administrative views require elevated data permissions, exclude credentials and raw private fields, and create an audit record.

Data may be processed by infrastructure and AI service providers acting for TrendPilot, by TikTok, Google or Meta when the seller authorizes or uses the corresponding connection, and by the selected payment provider when a user starts checkout. We do not sell personal data or disclose one seller's private strategy to another seller. Processing locations and subprocessors are documented in the applicable platform security review.

OAuth tokens are retained only while authorization remains active and are encrypted at rest. Operational records are retained only for the service, legal, security and accounting periods that apply. On deauthorization or a verified deletion request, connected customer data is deleted or de-identified unless retention is legally required.

Authorized users may request access, correction, export, restriction or deletion through Support. We verify identity before acting. TikTok Shop, Google and Meta authorizations can also be revoked in the connected provider or disconnected in TrendPilot; revocation stops new synchronization and starts the applicable deletion workflow.

Submit privacy and data-rights requests through the public Support form. Include the account email and connected shop identifier, but never send passwords, access tokens or payment credentials.