Privacy Policy

1. Information We Collect

1.1 Information You Provide

Account Information:

• Email address
• Password (stored as a secure bcrypt hash, never in plain text)
• Business name (optional)

If you sign in via Google OAuth, we receive your email address and display name from Google. We do not access your Google password or other Google account data.

Financial Data You Input:

• Product costs (COGS) that you manually enter or import via CSV
• Custom expense categories

1.2 Information from TikTok Shop

When you connect your TikTok Shop account via OAuth, we access:

• Order Information: Order ID, date, status, item quantities, prices, shipping fees
• Product Information: Product ID, SKU, name, price, inventory status
• Financial Information: Platform fees, payment processing fees, settlement amounts

We do NOT access:

• Your TikTok Shop login credentials
• Your customers' personal contact information
• Payment card details

1.3 Information Collected Automatically

• Log Data: IP address, browser type, pages visited, time and date of visit
• Device Information: Device type, operating system
• Cookies: Authentication cookies and security tokens (see Section 7)

2. How We Use Your Information

We use your information solely to:

• Provide the Service: Calculate and display your profit metrics
• Maintain Your Account: Authenticate your identity, manage your subscription
• Improve the Service: Analyze usage patterns, fix bugs, develop new features
• Communicate with You: Send service notifications, weekly profit digest emails (opt-in), and respond to support requests
• Ensure Security: Detect and prevent fraud, unauthorized access

We do NOT:

• Sell your personal data to third parties
• Use your data for advertising purposes
• Share your business data with competitors

3. How We Share Your Information

3.1 Service Providers

3.2 Legal Requirements

We may disclose your information if required by law, legal process, or government request.

3.3 Business Transfers

If MARGN is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your data becomes subject to a different privacy policy.

4. Data Storage and Security

Your data is stored on servers in the United States, operated by Railway.

We implement industry-standard security measures:

• Encryption in Transit: TLS 1.2+
• Encryption at Rest: AES-256
• OAuth Token Security: AES-256-CBC encryption
• Password Security: bcrypt with unique salts
• Access Control: MFA for production systems

In case of a data breach, we will notify affected users within 72 hours.

5. Data Retention

We retain your data while your account is active. When you delete your account:

• Personal data permanently deleted within 30 days
• Backups purged within 90 days
• Anonymized, aggregated data may be retained for analytics

6. Your Rights

6.1 All Users

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and data
• Export: Download your data in JSON/CSV format
• Withdraw Consent: Disconnect your TikTok Shop at any time

6.2 EEA Residents (GDPR)

Additional rights: object to processing, restrict processing, data portability, lodge complaint with supervisory authority.

6.3 California Residents (CCPA)

Right to know what is collected, whether it is sold (we do not sell data), and equal service regardless of privacy choices.

6.4 How to Exercise Your Rights

Email [email protected] or use Settings → Privacy. We respond within 30 days.

7. Cookies and Tracking

We do NOT use advertising cookies, cross-site tracking, or social media pixels.

8. TikTok Shop Integration

We use OAuth 2.0. We never see or store your TikTok password.

Disconnect anytime via Settings → Connections, or TikTok Seller Center → Authorized Apps.

9. International Data Transfers

Your data may be transferred to the United States. We ensure appropriate safeguards including Standard Contractual Clauses (SCCs) and data processing agreements.

10. Children's Privacy

MARGN is not intended for users under 18. We do not knowingly collect data from children. Contact [email protected] if you believe a child has provided personal information.

11. Changes to This Privacy Policy

We may update this policy from time to time. We will notify you by posting the new policy, updating the "Last Updated" date, and sending email for significant changes.

12. Contact Us

If you have questions about this Privacy Policy:

Email: [email protected] · Response Time: Within 5 business days