Privacy Policy

1. Who we are

Mons Media (the “Service”), available at media.mons.health, is a TikTok publishing tool for creators, brands and agencies, operated by MONS SUPPLIES LLC (“MONS”, “we”, “us”), a Florida limited liability company that also uses Mons Media for its own brands. MONS is the controller of the personal information described in this policy.

2. What this policy covers

This policy explains what information Mons Media obtains when you connect a TikTok account, how we use it, how long we keep it and the choices you have. It applies only to Mons Media. TikTok’s own handling of your data is governed by TikTok’s Privacy Policy.

3. Information we obtain from TikTok

When you choose “Continue with TikTok”, TikTok asks you to approve specific permissions (“scopes”). We only receive the information covered by the scopes you approve:

We also receive OAuth access and refresh tokens, their expiry times and the list of scopes you granted. Tokens let Mons Media act only within the permissions you approved; we never receive your TikTok password.

4. Information you provide

• Content you upload: videos or photos you choose to send to TikTok, with the title, description, privacy, interaction and disclosure settings you select.
• Content prepared for review: if you turn on team access, videos or photos that the team’s tools prepare for your account, with a suggested title or description. They wait in your dashboard and are never sent to TikTok unless a person reviews and confirms them.
• Your settings: whether team access is on for your account.
• Messages: if you email us, the content of your message and your email address.

5. Information collected automatically

• Cookies: we use only strictly necessary cookies: a session cookie that keeps you signed in, a short-lived cookie that protects the TikTok sign-in against forgery, and, for authorized team members, a team session cookie. We do not use analytics, advertising or tracking cookies, and we load no third-party scripts or fonts.
• Security information: your IP address is used in memory to limit abusive requests and is not stored in our records.
• Activity records: we record which action was taken on a connected account (for example “draft sent” or “account disconnected”), when, by whom (the account owner, a team member or a team’s tool) and whether it succeeded. These records do not contain tokens, captions or media.

6. How we use information

• To provide the Service: show your profile, statistics and videos, and send drafts or publish posts that you request.
• If you turn on team access: to let the authorized members of that team view your account and prepare or publish posts through the posting form, and to let the team’s tools prepare content that waits for review. You can turn team access off at any time.
• To keep the Service secure, prevent abuse, troubleshoot problems and keep an audit trail of actions.
• To comply with legal obligations and enforce our Terms of Service.

We do not use TikTok data to build advertising profiles, we do not sell it, and we do not use it for any purpose unrelated to the Service.

7. How we share information

We do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising. We disclose information only:

• To TikTok, to carry out the actions you request (for example uploading a video or checking a post’s status).
• To our cloud hosting provider, which stores and processes data on our behalf under confidentiality and security obligations and may not use it for its own purposes.
• With the team you authorize, only if you turn on team access: its authorized members can see your profile, statistics, videos, publishing activity and pending items. Its tools connected through our API can read the same account information and prepare content for review. Nobody on the team ever receives your TikTok tokens.
• Within MONS, only as needed to operate, secure and support the Service.
• When required by law, or to protect the rights, safety and security of our users, MONS or others.
• In connection with a merger, acquisition or sale of assets, subject to this policy.

8. Where and how we store information

Data is stored on servers of our cloud hosting provider in the United States. Each connected account is stored encrypted at rest with AES-256-GCM, and all traffic uses HTTPS. Access tokens are never displayed in the Service, never returned by our internal API and never written to logs. Team areas require a separate access key and only show accounts whose owners turned on team access. No method of transmission or storage is completely secure, but we work to protect your information with industry-standard safeguards.

9. How long we keep information

• Tokens, granted scopes and basic profile (display name, username, avatar link, union_id): while the account is connected. They are deleted immediately when you disconnect or when TikTok informs us that you removed access.
• Accounts that need to be reconnected (for example after the authorization expires) and are not reconnected within 90 days are deleted.
• Videos list and statistics are fetched from TikTok when you open your dashboard and are not stored.
• Uploaded videos and photos are kept only while they are transferred to TikTok and are deleted as soon as the transfer ends, and in any case within 2 hours.
• Content prepared for review is kept until it is posted, sent as a draft or discarded, and at most 7 days.
• Publishing records (post ID, type, status and timestamps) and activity records: up to 90 days.

10. Your choices and rights

• Disconnect: use “Disconnect TikTok account” in your dashboard. We ask TikTok to revoke Mons Media’s access and delete all data we store for that account; if TikTok does not confirm the revocation, we tell you so you can also remove Mons Media in the TikTok app.
• Revoke in TikTok: you can also remove Mons Media from the TikTok app settings where you manage connected apps. TikTok notifies us and we delete the account’s data.
• Choose permissions: you can decline optional permissions on TikTok’s consent screen; the related features will simply not be available.
• Team access: off by default; turn it on or off in your dashboard at any time.
• Access, correction and deletion: email info@mons.health. We will verify the request and answer within 30 days. Depending on where you live (for example California or the European Economic Area), you may have additional rights, such as to know, port or object to processing, and to complain to a data protection authority. We will not discriminate against you for exercising them.

11. Children

Mons Media is a business tool intended for adults (18 or older) who manage TikTok accounts. It is not directed to children and we do not knowingly collect personal information from anyone under 13 (or under 18 where the law requires). If we learn that we have collected such information, we will delete it promptly. Contact us at info@mons.health if you believe this has happened.

12. International users

MONS is based in the United States and the Service is hosted there. If you use Mons Media from another country, your information will be transferred to and processed in the United States, where data protection laws may differ from those of your country. Where required, we process information on the basis of your consent (granted on TikTok’s consent screen), the performance of our agreement with you and our legitimate interest in operating a secure service.

13. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new effective date and, if the changes are material, we will notify connected users in the Service or by email before they take effect.

14. Contact us

Questions or requests about privacy: