This Privacy Policy explains how ObsCast (https://obscast.com, https://app.obscast.com, https://api.obscast.com) processes personal data when you use our web application and related services, including TikTok Content Posting API integrations.
1. Controller
The controller under the GDPR is the operator of ObsCast. Contact: familie.koerner@levi-x.de.
2. Data we process
- Account data: email, optional display name, hashed password, plan/tenant information, audit events
- Usage data: login sessions (cookie), IP/device metadata in security logs, product settings
- Content data: recording plans, stream metadata, recordings/clips, transcripts, AI results, publish jobs and captions
- TikTok OAuth: open_id, display name/avatar (if provided), access/refresh tokens (encrypted at rest), granted scopes, publish status/IDs from TikTok
- Optional session cookies: TikTok session values you supply solely to access restricted lives (separate from publishing)
3. Purposes and legal bases
- Contract performance / pre-contractual steps (Art. 6(1)(b) GDPR): providing the platform, recording, clips, publishing
- Legitimate interests (Art. 6(1)(f) GDPR): security, abuse prevention, operations and product improvement
- Consent (Art. 6(1)(a) GDPR): where you enable optional features (e.g. OAuth scopes, cookie session)
- Legal obligations (Art. 6(1)(c) GDPR) where applicable
4. TikTok and processors
When you connect a TikTok account and upload videos, data is transmitted to TikTok (ByteDance) via the official Content Posting API. TikTok's privacy terms also apply. We use hosting/infrastructure providers (servers, database, object storage, mail) to deliver the service.
5. Retention
Account data is kept for the lifetime of the account. Recordings and clips follow plan retention and are then deleted or made inaccessible. OAuth tokens are stored while the account remains connected; you can disconnect at any time. Logs are retained for a limited period for security and operations.
6. Cookies / session
Authentication uses a session cookie (ts_session) required for login (necessary). We do not currently set additional tracking cookies for the core product.
7. Your rights
Under the GDPR you may request access, rectification, erasure, restriction, portability and objection, and you may withdraw consent. You also have the right to lodge a complaint with a supervisory authority.
8. Security
We apply technical and organisational measures (TLS, access controls, encryption of secrets/tokens, tenant isolation). Absolute security cannot be guaranteed.
9. Changes
We may update this policy when services or law change. The current version is always available at this URL.
10. Related documents
See also our Terms of Service.