IklanFlowPrivacy Policy
Last updated 2026-10-08
Draft — pending legal review. Sections marked for review are not final.
The English and Malay texts are the governing versions of this notice.
Who we areNeeds legal review
The data controller is 棠序問策股份有限公司, Taiwan Unified Business No. 62142124, registered address 台中市西區台灣大道二段2號5樓之1 (Registered address: 5F-1, No. 2, Sec. 2, Taiwan Blvd., West Dist., Taichung City, Taiwan). This is a temporary operator. A Malaysian SSM number and an SST number are not yet assigned. IklanFlow is an independent advertising service. It is not an official TikTok or ByteDance product.
Personal data we processNeeds legal review
We collect your phone number, email, chosen locale, marketing-consent choice, order and wallet records, and payment references. We do not store full card numbers. After you authorize a video we may process TikTok open_id, the post id you choose, that post authorization status and expiry, and the performance of that campaign. We never ask for your TikTok password and we do not read direct messages.
What you must provideNeeds legal review
A phone number, an email for receipts, and a TikTok video authorization are required to place an order. If you do not provide them, we cannot create the boost or send the receipt. Language, marketing consent, and optional audience interests are not required. If you skip them, we still process the order using the defaults on the form, and we do not send marketing.
Where the data comes fromNeeds legal review
You give us the phone number, email, language, consent choice, and order details. TikTok provides the authorization status, post id, and campaign performance after you authorize a video. The payment processor provides a payment reference. We do not buy personal data from brokers.
Why we process itNeeds legal review
We use this data to create and manage the Spark Ads boost you order, take payment, keep the prepaid wallet, show review status and results, provide support by email or WhatsApp, and meet legal duties. Marketing messages are sent only if you opt in.
Who we share it withNeeds legal review
We disclose personal data to TikTok, so it can run the Spark Ad; to the payment processor that handles FPX, DuitNow, e-wallet, or card payments (the demo checkout does not send a real payment); to Render, which hosts IklanFlow in Singapore; and to WhatsApp if you contact support there. We do not sell personal data.
ProcessorsNeeds legal review
Besides the parties named above, we use an SMS and one-time-password provider to send login codes, and an email provider to send receipts and service messages. These are categories of processor. Vendor names are not listed here because they are not fixed in this draft.
Cross-border transferNeeds legal review
Personal data is hosted in Singapore by Render and may be accessed by the operator in Taiwan, and by TikTok where it operates the ads platform. A transfer impact assessment is still required and has not been completed. This section needs legal review.
Your rightsNeeds legal review
You may ask for access to your personal data. We will respond within 21 days, as the Personal Data Protection Act 2010, as amended in 2024, requires. You may ask us to correct inaccurate data, withdraw consent for future processing, and ask for a portable copy of the data you provided. Withdrawal does not undo processing that already happened. Some requests can be refused where the Act allows.
How to limit processingNeeds legal review
You can turn off marketing in account settings or by email. You can revoke the TikTok authorization in the TikTok app, which stops further delivery on that video. You can ask us to stop using the data for a stated purpose, except where we must keep it for a legal duty or an open order. Limiting processing of data required for an open order can pause or cancel that order.
RetentionNeeds legal review
Draft proposal: order, payment, and performance records are kept for 24 months after delivery ends, unless tax law or a dispute requires longer. This period needs legal review. Authorization tokens are deleted when you revoke access or when account deletion finishes.
If data is breachedNeeds legal review
If a personal-data breach is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and, where required, notify you. The Personal Data Protection Commissioner data breach notification guideline describes notice to the Commissioner within 72 hours and notice to affected people within 7 days. Counsel still has to confirm how those duties apply to IklanFlow. This section is a draft commitment, not a finished notice.
MarketingNeeds legal review
You can opt out of marketing at any time from account settings or by emailing the support address. Messages about an order you placed are service messages, not marketing.
How to reach usNeeds legal review
Send privacy requests to tangxuwence@gmail.com. A data protection officer has not been appointed. Whether this business must appoint and register one is not yet confirmed.
How tokens are storedNeeds legal review
Access tokens stay on the server and are encrypted with AES-256-GCM before storage. They are not rendered into pages and are not written to ordinary logs.
How to revoke TikTok accessNeeds legal review
In the TikTok app: Settings and privacy > Security > Manage app permissions. After you revoke access we can no longer deliver against that authorization.
How to delete your dataNeeds legal review
Request deletion from account settings or email the support address. If an order is open or the wallet has a balance, that is settled first. Records required by tax law are an exception and need legal review.