Privacy Policy

Whofy Den is owned and operated by Grupo WHOFY (“we”, “us”, “our”), reachable at grupowhofy.com. Grupo WHOFY is the data controller for the information described in this policy.

The Service is not offered to the public. It is used only by authorized Grupo WHOFY staff to manage advertising accounts that belong to Grupo WHOFY.

When an authorized administrator of Grupo WHOFY's TikTok Business Center grants access through TikTok's official OAuth flow, Whofy Den may access the following data via the TikTok Marketing API, limited to the ad accounts that were authorized:

• Ad account information — account IDs, names, status, currency, time zone and Business Center association.
• Campaigns, ad groups and ads — names, status, budgets, bids, schedules, targeting settings and creative metadata, as well as ad review status and rejection reasons.
• Performance reports — aggregated metrics such as spend, impressions, clicks, conversions, cost per result and conversion value.
• Pixel metadata — pixel IDs, names, setup status and aggregated event activity used to monitor tracking health, plus the results of test events we send ourselves.
• OAuth credentials — the access token issued by TikTok for the authorized accounts.

Whofy Den does not access TikTok user profiles, private messages, or personal data of people who view our ads. Reporting data is received in aggregated form.

Data about our own staff

To control access, we store the name and work email address of each Grupo WHOFY team member who is allowed to sign in, and a log of actions they perform in the Service (for example, a budget change).

The data is used solely for Grupo WHOFY's internal campaign management, specifically to:

• display performance reporting across our own ad accounts;
• pause, enable, or change budgets of our campaigns and ad groups, individually or in bulk;
• run automated rules defined by our team and log the actions they take;
• monitor pixel health and send test events to verify our own tracking setup;
• review ad rejection reasons and submit appeals through TikTok's official process.

We do not use TikTok data for advertising profiling, to build audiences outside of TikTok's platform, or for any purpose unrelated to managing our own advertising.

We do not sell, rent, or share data obtained from TikTok with third parties. Data is visible only to authorized Grupo WHOFY staff.

We rely on infrastructure providers (for example, cloud hosting and database services) that process data on our behalf under contractual confidentiality and security obligations and only to operate the Service. We may disclose information if required by law.

• OAuth access tokens are encrypted at rest and decrypted only server-side when calling TikTok.
• All traffic between users, Whofy Den and TikTok is encrypted in transit using HTTPS/TLS.
• Sign-in is restricted to authorized Grupo WHOFY staff; there is no public registration. Access is removed when a team member leaves.
• Database access is restricted by role, and changes made through the Service are logged.

No method of storage or transmission is completely secure, but we apply reasonable technical and organizational measures to protect the data.

We keep TikTok data only for as long as needed for internal campaign management and reporting. Cached report data and activity logs are periodically removed once they are no longer needed.

Revoking access. An administrator can revoke Whofy Den's access at any time from TikTok Business Center. Once access is revoked, the stored access token stops working and Whofy Den can no longer retrieve or modify any data. We then delete the stored token and associated account data.

Deletion requests. To request deletion of data held by Whofy Den, email privacy@grupowhofy.com. We will confirm and complete the request within a reasonable period, except where retention is required by law.

Whofy Den uses only strictly necessary session cookies to keep authorized staff signed in and to protect against request forgery. We do not use advertising or third-party tracking cookies on the Service.

Depending on applicable law (such as Brazil's LGPD or the EU GDPR), individuals may have rights to access, correct, or delete personal data about them. To exercise these rights, contact us at privacy@grupowhofy.com.

We may update this policy from time to time. The “Last updated” date at the top of this page shows when it was last revised.

Questions about this policy or about how Whofy Den handles data can be sent to privacy@grupowhofy.com.