PRIVACY NOTICE

This U.S. Privacy Notice ("Notice") describes how Entropi Martech LLC ("we," "us") collects, uses, discloses, and safeguards personal information in connection with the Entro.ly website, dashboard, APIs, and related services (the "Service"). It applies to creators and other users located in the United States and to international users outside Indonesia. It supplements, and should be read together with, our U.S. Terms of Service.

01Scope & who we are

Entro.ly is operated by Entropi Martech LLC, which is responsible for your personal information under this Notice.

This Notice applies to: (a) U.S. residents using the Service, and (b) international users who are not residents of Indonesia. If you are a resident of Indonesia, see our Indonesia Privacy Policy instead.

02Notice at collection (summary)

The table below summarizes the categories of personal information we collect, in accordance with Cal. Civ. Code § 1798.100(a). Full detail is in §03–§07, and retention is explained in §11.

03Personal information we collect

3.1 Information from TikTok

When you connect your TikTok account through "Login with TikTok" or connect a TikTok Shop account, we collect:

• Profile information: TikTok username, display name, profile photo, unique user ID (open_id), bio, and verification status
• Account statistics: Follower count, total likes, total video count
• Video information: Titles, descriptions, hashtags, posting date/time, thumbnails
• Performance metrics: Views, likes, shares, comments, watch time (where available)
• Commission and GMV data: TikTok Shop commission and GMV figures tied to your affiliate activity

What we do not collect from TikTok

• Private or direct messages
• Draft videos (unless you explicitly upload them through a future feature)
• Your TikTok password or login credentials
• Financial account information (see §07 for how we separately collect tax/payout information directly from you)
• Precise location data

3.2 Information you provide directly

• Email address
• Contact preferences and communication settings
• Tax information if you receive payouts (§07)
• Feedback and support requests

3.3 Automatically collected information

• Device information (browser, operating system)
• IP address and general location (city/country)
• Usage data (pages visited, features used, time spent)
• Cookies and similar technologies (see §17)

3.4 Payout details

If you receive rewards or payouts, you connect a payout account through Stripe Connect. Your bank account details are entered on Stripe's hosted pages and held by Stripe; we do not receive or store your full bank account number.

04Sensitive personal information

Access to this information is limited to the staff who handle tax reporting, and we keep it as described in §11.

Under the California Privacy Rights Act (Cal. Civ. Code § 1798.140(ae) and § 1798.121), you have the right to direct us to limit the use of sensitive personal information to what is necessary to perform the services you requested. See §14 to submit a request.

05TikTok and TikTok Shop data

We use the data we receive from TikTok only to provide the Service to you, as described in this Notice and permitted by TikTok's developer terms.

• Profile information: TikTok username, display name, profile photo/avatar, unique user ID (open_id), bio/description, and verification status
• Account statistics: Follower count, total likes, total video count
• Video information: Video titles, descriptions, hashtags, posting date/time, thumbnail images
• Performance metrics: Video views, likes, shares, comments, watch time (where available)
• Commission/GMV data: TikTok Shop commission and GMV figures tied to your affiliate activity

What we do not collect from TikTok

• Private or direct messages
• Draft videos (unless you explicitly upload them through a future feature)
• Your TikTok password or login credentials
• Financial account information
• Precise location data

If you disconnect: When you disconnect your TikTok Shop account from Entro.ly, or our integration with TikTok Shop ends, we stop accessing your TikTok Shop data, revoke the access tokens we hold, and delete the TikTok Shop data we stored about you within 30 days (and purge it from backups within 90 days), except where we must keep a record by law (for example, payout records under §07).

06How we use your information

We use your information to:

• Provide core services: Your creator dashboard, analytics, and performance metrics
• Build your portfolio: A creator showcase page (with your consent)
• Meet tax reporting obligations: Form 1099-K and IRS backup withholding rules — see §07
• Improve our services: Analyze usage patterns to improve features
• Customer support: Respond to inquiries and resolve technical issues
• Security and legal compliance: Protect the Service, meet regulatory requirements, and enforce our U.S. Terms of Service

What we will never do with your data

• We do not sell your personal information for monetary consideration, as "sell" is defined by the CCPA
• We do not share your performance metrics with other creators without your permission

See §08 for our disclosure on "sharing" for cross-context behavioral advertising, consistent with our U.S. Terms of Service §11.

07Tax & financial data

If you earn commissions or rewards through Entro.ly, U.S. tax law may require us (or our payment partner) to collect a Form W-9 (U.S. persons) or Form W-8 (non-U.S. persons), and to report your earnings on Form 1099-K under 26 U.S.C. § 6050W once you cross the applicable reporting threshold.

• We collect your Taxpayer Identification Number (TIN), which may be a Social Security Number (SSN), Employer Identification Number (EIN), or Individual Taxpayer Identification Number (ITIN);
• If you do not provide a valid TIN, or if the IRS notifies us of a mismatch, we may be required to withhold 24% of your payments as "backup withholding" under 26 U.S.C. § 3406;
• Payouts are made through Stripe Connect, which may collect and verify tax and identity information directly from you under its own privacy policy.

We keep tax and payout records for 7 years after the tax year they relate to, to meet IRS record-keeping requirements.

08How we share information — "sell" and "share"

Under the CCPA/CPRA, "sell" and "share" are distinct, defined terms. We do not "sell" personal information for monetary or other valuable consideration. We may "share" limited identifiers for cross-context behavioral advertising on our public marketing site, consistent with the disclosure already made in our U.S. Terms of Service §11. You can opt out at any time — see §17 for how.

Categories of recipients

• Service providers who process data on our behalf (see §09);
• TikTok, to the extent required for the API integration you authorize;
• Payment processors, for payout and tax reporting purposes (see §07);
• Government authorities or courts, where required by law;
• A successor entity, in the event of a merger, acquisition, or asset sale, subject to this Notice continuing to apply to your data.

09Service providers & sub-processors

We work with service providers who process personal information on our behalf under contractual confidentiality and data-protection obligations. Our current providers are:

• Amazon Web Services — hosting, databases, file storage, email delivery (Singapore; United States)
• Google Cloud (Firebase) — storage of program and analytics data (United States)
• Cloudflare — network security and content delivery (Global)
• Stripe — payments and creator payouts, international (United States)
• Xendit — payments and creator withdrawals, Indonesian Rupiah
• Seedance.ai — AI video generation for the AI Video Factory feature, processing creator photos, video assets, and scripts
• Anthropic — AI features: content checks, document parsing (United States)
• Google (Gemini) — AI features: bio-link page generation (United States)
• OpenAI (Ads/Conversions API) — ad conversion measurement, receiving a signup-completion event tied to the ad click that referred you, for users who arrive via an ad we run (United States)

We will update this list when we add or change a provider that processes personal information.

10Data storage & international transfer

We store personal information on Amazon Web Services servers in Singapore (our primary region) and in the United States, and with the providers listed in §09. If you use the Service from the United States, your information is transferred to and processed in Singapore. We protect it with the safeguards described in §12 and the contractual obligations described in §09, wherever it is processed.

11Retention

• Active accounts: For as long as your account is active.
• Account deletion: When you delete your account or ask us to, we delete your personal information within 30 days, and purge it from backups within 90 days, except records we must keep by law.
• TikTok Shop data after you disconnect: Deleted within 30 days, and purged from backups within 90 days (§05).
• Usage and log data: Up to 12 months.
• Tax, payment, and payout records: 7 years after the tax year they relate to (§07).

12Security

We implement security measures designed to protect your information, including:

• Encryption: Data transmission uses HTTPS/TLS; TikTok access tokens are encrypted with AES-256, and our cloud databases and storage are encrypted at rest
• Access control: Access to personal information is role-based and limited to staff who need it, using named accounts with multi-factor authentication
• Token rotation: Access tokens are refreshed automatically before they expire
• Infrastructure: Our cloud providers maintain industry-standard security certifications such as SOC 2 and ISO 27001

13Your privacy rights

Depending on your state of residence, you may have some or all of the following rights over your personal information:

• Know and access — what personal information we have collected, used, or shared about you;
• Correct — inaccurate personal information;
• Delete — your personal information, subject to certain exceptions;
• Portability — receive a copy of your data in a portable format;
• Opt out — of the sale or sharing of your personal information, and of targeted advertising;
• Limit — use of sensitive personal information (see §04);
• Opt out of profiling — in furtherance of decisions producing legal or similarly significant effects (see §19);
• Non-discrimination — for exercising any of these rights.

Not every right is available in every state. See §16 for state-specific detail.

14How to exercise your rights

You may submit a request using either of the following methods:

• Email:

  Send your request to [email protected], including your account email, the right you wish to exercise, and your state of residence.

• Identity verification: We will verify your identity in a manner proportionate to the sensitivity of your request, and will not ask for more information than necessary.
• Authorized agent: You may designate an agent to submit a request for you. We may require proof of authorization and may still verify your identity directly.
• Response time: We acknowledge requests within 10 calendar days and respond within 45 days, with a possible one-time 45-day extension where permitted by law.
• Cost: Free. We may decline requests that are manifestly unfounded or excessive.

15Appeals

If we decline your request, you may appeal by emailing [email protected] with the subject line "Privacy Rights Appeal" and referencing your original request. We will respond within 45 days of receipt.

If we deny your appeal, you may contact your state Attorney General's office.

16State-specific notices

The following states have additional or state-specific privacy rights. This list will grow as more states enact comprehensive privacy laws.

17Cookies, tracking & Global Privacy Control

We use cookies and similar technologies as described in our Cookie Policy.

"Do Not Sell or Share My Personal Information": You can opt out of sharing at entro.ly/privacy/choices, linked in our site footer, or by emailing [email protected]. If you are signed in, your choice is saved to your account and follows you to every device.

Global Privacy Control (GPC): We detect Global Privacy Control automatically — both the Sec-GPC browser signal and navigator.globalPrivacyControl — and honor it as an opt-out the moment we see it, with no click required. When GPC is on, we do not load the TikTok Pixel or send ad-conversion events to our ad partners, and Google Analytics runs with ad signals and ad personalization off.

Do Not Track: Our systems do not respond to browser "Do Not Track" signals, which lack a common industry standard.

18Children's privacy

The Service is intended for users who are at least 18 years old, consistent with our U.S. Terms of Service §2. We do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506 and 16 C.F.R. Part 312. If you believe a child has provided us with personal information, contact [email protected] and we will promptly delete it.

19Automated decision-making & profiling

We use automated tools to calculate performance metrics, rankings, and benchmarks from your TikTok activity. Some creator programs use these rankings to determine rewards. Rewards are reviewed and confirmed by our team before they are paid, and we do not use automated decision-making to make decisions that produce legal or similarly significant effects about you without human review.

20Changes to this Notice

We may update this Notice from time to time. We will notify you of material changes by posting the updated Notice on this page with a new "Effective" date, and by email or in-app notice where required by law. Prior versions are available on request from [email protected].

21Contact us

Last updated: October 19, 2026