TikTok Services Privacy Addendum

This TikTok Services Privacy Addendum ("TikTok Addendum") supplements the BellNova Privacy Policy and applies when a customer uses a BellNova service, integration, or skill that accesses TikTok Shop, TikTok for Business, or other TikTok services.

It includes the ads-tiktok-product-gmvmax-first-order-boost skill, which helps authorized users analyze Product GMV Max campaign data and prepare controlled Creative Boost action plans for eligible first-order creatives.

If this TikTok Addendum conflicts with the main policy regarding TikTok data, this addendum controls for that data.

The exact information depends on the BellNova product, the TikTok products enabled, and the scopes granted by the authorized TikTok account holder.

2.1 BellNova Dashboard

Through TikTok Shop Partner Center and TikTok for Business integrations, BellNova may process shop and advertiser identifiers, store information, product listings, inventory, orders, logistics status, advertising accounts, campaign information, spending, conversion, and performance metrics to provide store operations and reporting features.

2.2 BellNova Collabs

BellNova may process product information, creator or collaboration records made available for the authorized use case, invitation and campaign status, and attributed performance or conversion information to support creator outreach and campaign management.

2.3 BellNova Ads

BellNova may process advertiser and campaign identifiers, campaign settings, creatives, ad performance and spending data, product and inventory information, orders, and conversion metrics. This information is used to provide monitoring, reporting, recommendations, and customer-configured optimization features.

2.4 TikTok GMV Max Skill

When the GMV Max skill is used through an OAuth-authorized TikTok Remote MCP connector, the user's selected agent platform and connector may process:

• advertiser, campaign, product, video, and creative identifiers;
• Product GMV Max campaign information and settings;
• eligible GMV Max videos or creatives;
• report data, including orders and performance metrics; and
• session information used for conflict checks and readback verification.

BellNova uses this information to identify eligible first-order creative candidates, check lookback-window order history and active session conflicts, generate DRY_RUN or approved LIVE Creative Boost plans, and verify created sessions. The skill does not change campaign budgets, ROI targets, or unrelated campaign settings.

TikTok access is established through TikTok's supported authorization process. BellNova requests only the scopes reasonably necessary for enabled features and does not ask users to provide TikTok passwords or paste raw tokens, app secrets, cookies, or authorization headers into prompts, documents, logs, or configuration files.

For the GMV Max skill, TikTok authorization is handled by the user's host agent platform and TikTok Remote MCP connector. BellNova does not operate a separate backend solely to collect TikTok credentials for that skill. Other BellNova products store OAuth access and refresh tokens in AWS-hosted systems for as long as needed to maintain and administer a connection authorized by the customer.

TikTok data is used only to provide and secure features authorized by the customer, including:

• displaying and synchronizing shop, product, order, logistics, advertising, and performance information;
• generating reports, analysis, recommendations, and campaign plans;
• carrying out user-requested or customer-configured actions;
• monitoring inventory and campaign status;
• preventing conflicts, abuse, and unauthorized activity; and
• providing support and complying with applicable law and TikTok requirements.

We do not sell TikTok data, use it to build unrelated data products, or disclose one customer's non-public TikTok data to another customer.

For the GMV Max skill, users control whether the skill runs in DRY_RUN or LIVE mode. A LIVE Creative Boost action requires explicit approval, mode=LIVE, and allow_live=true. Users should review the candidates and planned operations before approving a live action.

Other BellNova products may perform recurring synchronization, monitoring, or optimization after an authorized user enables and configures the feature. The product interface or documentation describes available controls. Users remain responsible for reviewing material campaign decisions and complying with TikTok advertising, commerce, and developer requirements.

The GMV Max skill is designed to process campaign information through the user's selected agent platform and connector without requiring a separate BellNova campaign database. Temporary processing, tool output, logs, and conversation history may be retained by that platform under its own settings and privacy terms.

For other BellNova TikTok integrations, BellNova retains TikTok data while the customer account or authorized feature remains active and afterward only as reasonably necessary for legal, security, dispute, or TikTok requirements. After revocation, BellNova stops using the revoked credentials for future TikTok API access. Customers may request deletion, and BellNova will delete or restrict information as required by applicable law and TikTok requirements.

TikTok data may be processed by TikTok, BellNova, the customer and its authorized users, and vetted providers required to operate the authorized service. For the GMV Max skill, this may include the user's selected agent platform and the TikTok Remote MCP connector. Each independent platform is also governed by its own privacy terms.

BellNova does not sell or rent TikTok personal data, account data, campaign data, or advertising data. Providers used to operate a feature receive only the information needed for that function.

BellNova applies the safeguards described in the main policy and limits access to authorized personnel and services on a need-to-know basis. Users should use OAuth, restrict agent and BellNova accounts to trusted personnel, review scopes periodically, and never paste credentials into prompts or files.

TikTok data may be processed in countries where BellNova, the customer, the selected agent platform, connector, or service providers operate, but only where permitted by applicable law and TikTok requirements. TikTok-specific localization and restricted-recipient requirements take precedence.

Users may disconnect BellNova through the applicable TikTok account settings or connected host platform. They may also ask BellNova to access, correct, or delete information under the main policy by emailing marketing@bellnova.com with the subject "TikTok Privacy Request."

Where BellNova processes information for a business customer, the request may need to be handled by that customer. BellNova will assist as required by law, contract, and TikTok requirements.

BellNova's TikTok integrations are business tools and are not directed to children. BellNova does not knowingly use these integrations to collect personal information directly from children.

We may update this addendum when TikTok products, BellNova features, laws, or platform requirements change. Updates will be posted here with a revised date, and additional notice will be provided where required.

• Company: BellNova Corporation
• Website: https://www.bellnova.com
• Privacy and Security Email: marketing@bellnova.com
• Last Updated: August 3, 2026
• Effective Date: August 3, 2026