Privacy Policy

Last updated: August 5, 2026

About This Policy

ShopTruth is a service operated by ItsaYes Labs, LLC (“ShopTruth,” “we,” “us,” or “our”). This Privacy Policy explains how we handle information through the ShopTruth website, waitlist, and U.S. business-to-business closed alpha. It is a notice about our practices; it is not a request for blanket consent to every use of information.

During the closed alpha, ShopTruth is intended only for businesses in the United States and their authorized representatives who are at least 18 years old.

Information We Collect

Account, access, and support information

We collect your name, business email address, business name when provided, alpha access or waitlist details, and messages you send to support. We also maintain password hashes (never plaintext passwords), email OTP and verification records, session and essential-cookie records, authentication events, and security or abuse-prevention records.

TikTok Shop and optional TikTok Business information

When an authorized seller connects TikTok Shop through OAuth, we may receive shop and seller identifiers; region, currency, and time-zone settings; products, variants, and SKUs; orders, returns, refunds, settlements, fees, and finance records; granted scopes; authorization status; and encrypted access and refresh tokens. If you separately enable a TikTok Business or advertising connection, we may also receive advertiser, campaign, and performance-metric information. That connection is optional and separate from TikTok Shop.

Information entered in ShopTruth

We collect product costs, cost mappings, reporting preferences, integration settings, and other business configurations that an authorized user enters to operate the service.

Technical information

We may process IP address, browser and device information, timestamps, and minimized authentication, synchronization, security, and error logs needed to operate, protect, and troubleshoot ShopTruth.

Demo scheduling information

If you choose “Book a 15-minute demo,” an embedded Calendly scheduler collects the contact, appointment, and technical information you provide or generate while scheduling. ShopTruth receives the booking details needed to arrange and follow up on the demo.

Buyer-data minimization

ShopTruth is designed to avoid intentionally retaining buyer names, email addresses, phone numbers, postal addresses, free-form messages, or other buyer information that is not necessary for seller analytics, reconciliation, security, or a legal obligation. Provider payloads are filtered and minimized before storage.

How We Use Information

We use information only as needed to:

• create, verify, secure, and support business accounts;
• connect authorized shops and synchronize permitted TikTok data;
• provide product, order, finance, advertising, cost, and reconciliation dashboards;
• calculate and display business metrics requested by the seller;
• detect abuse, investigate incidents, maintain availability, and troubleshoot errors;
• respond to support, privacy, deletion, and compliance requests.

We do not sell TikTok data or personal information, use it for cross-context behavioral advertising, resell it, create independent profiles across sellers, use it to identify buyers, or use it to train general-purpose artificial-intelligence models. We do not use connected-shop data for a purpose independent of providing, securing, supporting, or complying with ShopTruth.

TikTok Data and Platform Access

ShopTruth accesses TikTok data only after an authorized seller completes TikTok's OAuth flow and only within the scopes displayed and granted. You can disconnect TikTok Shop from ShopTruth settings or revoke authorization through TikTok. Disconnecting immediately removes active OAuth tokens from our active database and stops new synchronization. TikTok may change, restrict, or revoke API access under its own terms and policies.

ShopTruth is independent and is not affiliated with, endorsed by, or sponsored by TikTok. TikTok's own privacy notices and terms govern TikTok's services.

Our Roles

ShopTruth determines how it handles its own account, waitlist, authentication, security, support, and compliance information. For TikTok and shop data processed to provide seller-requested features, ShopTruth generally acts as the seller's service provider or processor, while the seller remains responsible for its instructions, permissions, and legal basis. These roles may vary where applicable law requires a different allocation.

How We Disclose Information

We disclose information only as needed to operate the service or meet a valid obligation, including to:

• TikTok, for seller authorization and TikTok Shop or TikTok Business API operations;
• Supabase, for managed PostgreSQL database infrastructure;
• Vercel, for application hosting, delivery, and operational infrastructure;
• Resend, for transactional authentication and support email delivery;
• Calendly, for the embedded appointment scheduler that loads only after you choose to book a demo;
• Have I Been Pwned, for production compromised-password screening using a k-anonymous query that sends only the first five characters of a SHA-1 password hash—not the password, full hash, or email address;
• professional advisers subject to appropriate confidentiality obligations;
• authorities or other parties when reasonably necessary to comply with law, protect rights, or address fraud or security; and
• a successor in a merger, financing, acquisition, reorganization, or sale, subject to this Policy and applicable law.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

Cookies and Similar Technologies

On initial page load during the closed alpha, ShopTruth uses only first-party technologies that are strictly necessary for authentication, security, and OAuth. These include the Better Auth session cookie, which expires after 24 hours, and a TikTok OAuth intent/state cookie, which expires after 10 minutes. Where applicable, these cookies use HttpOnly, SameSite=Lax, and Secure attributes in production.

Calendly is not loaded on initial page load. If you open the “Book a 15-minute demo” dialog, your browser loads Calendly's embedded scheduler. Calendly may collect technical and scheduling information and use cookies or similar technologies as described in its Calendly Privacy Notice. ShopTruth does not suppress cookie banners or controls that Calendly provides; whether they are available or shown can depend on Calendly and your location.

ShopTruth itself does not currently use behavioral-advertising or non-essential analytics cookies. Before enabling a non-essential ShopTruth cookie, we will update this Policy and, where required, provide an appropriate consent choice.

Data Retention

Unless a longer period is legally required or necessary to resolve a security incident or dispute, our closed-alpha schedule is:

• active OAuth tokens are deleted immediately when a shop is disconnected, authorization expires, or access is revoked;
• minimized raw TikTok payload content is retained for no more than 30 days; a minimal hash and audit metadata may remain for deduplication, security, and traceability;
• account data, normalized TikTok data, and ShopTruth configurations are deleted from active systems within 30 days after a verified deletion request or applicable account termination;
• backups containing deleted information are overwritten through the normal backup cycle within an additional 30 days;
• waitlist records are retained for no more than 12 months;
• HMAC digests used for waitlist rate-limit buckets are retained for no more than 90 days;
• minimized security logs are retained for up to 90 days; and
• a pseudonymized record proving completion of a deletion may be retained for up to 12 months.

Security

ShopTruth uses safeguards appropriate to the closed alpha, including TLS in transit, hashed passwords, encrypted OAuth tokens and OTPs at rest, least-privilege database roles, tenant access controls, bounded rate limits, and minimized operational logs. No transmission or storage method is completely secure.

Your Choices and Rights

Depending on applicable law, you may request access, correction, a copy or export, deletion, restriction, or objection; withdraw from marketing communications; appeal a denied privacy request; and exercise rights without unlawful discrimination. You may also disconnect TikTok at any time. We may need to verify your identity and authority to act for the business before completing a request.

Send every access, correction, export, privacy, or deletion request to contact@shoptruth.app. We aim to complete verified account-deletion requests within 30 days.

U.S. Business Service and Age Restriction

The closed alpha is offered to U.S. businesses, not to consumers for personal or household use. It is not directed to children. You must be at least 18 years old and authorized to represent the business whose account or shop you connect.

Changes to This Policy

We may update this Policy as ShopTruth changes. We will post the revised date and provide reasonable notice of material changes where practicable. Expansion outside the United States, billing, new material data uses, or a new subprocessor may require an updated notice or additional agreement.

Contact Us

See also our Terms of Use.