What TikLive knows about you
Last updated: 21 September 2026
This page lists the data TikLive actually records, one item at a time, with the reason it exists. It is written from the database schema, not from a generic template.
What this page does not cover
TikLive is neither affiliated with nor controlled by TikTok. What TikTok collects on its side falls under TikTok's policy, not this one.
The software connects to your TikTok live from your own computer, directly. Live content (messages, gifts, viewer names) does not pass through our servers, except for the two features that say so explicitly: the live recap and the published leaderboard.
1. Who processes this data
The data controller is TikLive, publisher of the tiklive.eu website and of the TikLive Launcher software.
Contact for anything related to personal data: support@tiklive.eu. support@tiklive.eu
No Data Protection Officer has been appointed: the activity meets none of the three mandatory cases in Article 37 GDPR.
2. What we do not collect
- No payment card details. Payments happen entirely on Stripe or PayPal pages. Card numbers never reach our servers and are stored nowhere on our side.
- No plain-text passwords. Passwords are hashed, and a hash cannot be read back.
- No advertising tracker, no audience measurement, no profiling. There is no Google Analytics, no social network pixel and no ad network on this site.
- No selling, no sharing, no renting of data to anyone.
- No recording of your live content or of your TikTok chat messages, outside the two features mentioned below.
3. Data inventory, item by item
Each row is a piece of data actually stored. "Contract" refers to Article 6(1)(b) GDPR (performance of the requested service), "Legitimate interest" to Article 6(1)(f), "Consent" to Article 6(1)(a) and "Legal obligation" to Article 6(1)(c).
Account
| Data | Why it exists | Legal basis | Retention |
|---|---|---|---|
| Username, e-mail address | Identify the account, sign in, receive service e-mails. | Contract | Life of the account |
| Hashed password | Verify sign-in without ever keeping the password itself. | Contract | Life of the account |
| Profile picture (optional) | Shown in the app and on the public leaderboard. | Contract | Life of the account |
| Discord ID (optional) | Link the account to the Discord server, grant the Premium role. | Consent | Until withdrawn |
| Verified e-mail flag · verification token | Make sure the address exists, before the mailing list and referrals. | Contract | Token expires, flag remains |
| E-mail language | Write in the language picked in the app rather than French by default. | Legitimate interest | Life of the account |
| Role (free, premium, admin) · Premium end date | Open or close paid features. | Contract | Life of the account |
| Referral code · referees · credited days · sign-up IP | Run the referral programme and stop one person from referring themselves with several accounts. | Contract and legitimate interest | Life of the account |
| Country and country code | Audience statistics per country in the admin area. The country is derived locally from a table of public IP ranges, with no call to an outside service. | Legitimate interest | Life of the account |
| Last sign-in · last IP address | Spot an abnormal access, answer a support request. | Legitimate interest | Overwritten on each sign-in |
| Password reset and address change tokens | Allow those two operations safely. | Contract | Expire on their own then are deleted |
| Software session token | Keep the app signed in between launches. | Contract | Until expiry or sign-out |
Purchases and subscription
| Data | Why it exists | Legal basis | Retention |
|---|---|---|---|
| Orders: reference, amount, discount, promo code, status, dates | Deliver the purchase, keep the accounts, handle a dispute. | Contract and legal obligation | 10 years (Art. L123-22 French Commercial Code) |
| Purchase e-mail address (guest checkout) | Send the key and the download link. No account is created. | Contract | 10 years (accounting record) |
| Stripe or PayPal order ID | Match a payment, handle a refund or a chargeback. | Contract and legal obligation | 10 years |
| Waiver of the right of withdrawal: date and IP address | Prove the box was ticked before payment. Without that trace, the "no refund" rule cannot be enforced. | Legal obligation | 10 years |
| Subscription: ID, plan, status, next billing date | Run the Premium subscription and its charges. | Contract | Life of the subscription, then 10 years for the accounting part |
| Licence keys: key, machine fingerprint, activation IP, revocation | Activate the purchased game, limit sharing of one key between several people, revoke a key after a refund. | Contract and legitimate interest | Life of the licence |
| FiveM licence and six-digit linking code | Link the game account to the app account, manage the server whitelist. | Contract | The code expires within minutes |
| Promo code usage | Stop a single-use code from being used twice. | Legitimate interest | Life of the code |
Software usage
| Data | Why it exists | Legal basis | Retention |
|---|---|---|---|
| Live recap: TikTok handle, duration, diamonds, likes, gifts, peak viewers, new followers, top gifters | Show the live summary in the app and its history. Top gifters contain public TikTok handles of third parties. | Contract | Until deleted on request |
| Online configuration backup | Get profiles, actions and sounds back after changing computer. Sent when the user asks for it. | Contract | Until overwritten or deleted |
| Published leaderboard: public link, TikTok handle, viewer points | Publish a leaderboard the user chooses to make public. Contains third-party TikTok handles. | Consent | Until unpublished |
| Shared configuration: twelve-character code, name, contents | Let one user hand their configuration to another. Triggered by the user. | Consent | Until disabled |
| Dismissed announcements | Avoid showing an announcement that has already been read. | Legitimate interest | Life of the account |
Support and reviews
| Data | Why it exists | Legal basis | Retention |
|---|---|---|---|
| Support conversation: name, e-mail, language, messages, IP address of each message | Answer a request and keep the thread. From the website, a person may stay anonymous: a random token is enough. | Contract and legitimate interest | Until the conversation is deleted |
| Feedback: e-mail, message, username, Discord, software version, browser identifier | Understand and reproduce a reported problem. | Legitimate interest | Until deleted |
| Published review: rating and text | Show reviews on the site and in the app. Written and sent voluntarily. | Consent | Until withdrawn |
| Troubleshooting report | Diagnose a fault: the app log since launch and a machine inventory, sent by the user themselves. | Consent | Until handled |
E-mails
| Data | Why it exists | Legal basis | Retention |
|---|---|---|---|
| Mailing list consent | Receive software news. Can be turned off in one click from any e-mail, without signing in. | Consent | Until withdrawn |
| Patch note sending log: version, status, error, date | Know who already received what and avoid sending the same message twice. | Legitimate interest | Until deleted |
Security and logs
| Data | Why it exists | Legal basis | Retention |
|---|---|---|---|
| Admin sign-in attempts: IP address and number of tries | Block a brute-force attempt. | Legitimate interest | Cleared on the first successful sign-in |
| Web server logs: IP address, requested page, browser identifier, date | Security, fault diagnosis, abuse prevention. | Legitimate interest | Server rotation |
| Daily database backups | Restore the service after an incident. | Legitimate interest | 14 days |
4. Who this data is passed to
The list is short and it is complete. No other recipient exists.
| Provider | Role | What it receives | Where |
|---|---|---|---|
| Contabo GmbH | Hosting of the site, the database and the game servers | Everything stored, by nature | Lauterbourg data centre, France |
| Stripe | Card payments | E-mail address, amount, order reference. The card is entered on Stripe's side. | Ireland, with framed transfers to the United States |
| PayPal | PayPal payments and subscriptions | E-mail address, amount, order reference | Luxembourg |
| LWS | Sending the service's e-mails | Recipient e-mail address and message content | France |
| Google Fonts | Website typefaces | Visitor IP address, when the font is loaded | United States |
5. Transfers outside the European Union
Hosting, the database and e-mail stay in France. Three providers may nevertheless involve a transfer outside the EU:
- Stripe — Stripe Payments Europe (Ireland), with processing that may reach Stripe Inc. in the United States, framed by Standard Contractual Clauses and the Data Privacy Framework.
- PayPal — PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg).
- Google Fonts — the site's fonts are loaded from fonts.googleapis.com and fonts.gstatic.com. That request passes your IP address to Google. No cookie is set by this load, but the transfer exists. Moving to self-hosted fonts is on the list of things to fix.
6. How long data is kept
- Account data is kept for as long as the account exists.
- Accounting records (orders, invoices, amounts) are kept for ten years, as required by Article L123-22 of the French Commercial Code. They therefore survive account deletion: that is an obligation, not a choice.
- Tokens (software session, password reset, address change, support tickets) expire on their own and are deleted.
- Daily database backups are kept fourteen days then overwritten. Deleted data may therefore remain up to fourteen days in a backup.
- No automatic purge is currently in place for live recaps, reviews, support messages and feedback. They are deleted on request.
7. Your rights
The GDPR gives you a right of access, rectification, erasure, restriction, objection and portability over your data, plus the right to withdraw consent at any time for processing that relies on it.
To exercise them, write to support@tiklive.eu from the address linked to the account. Answer within one month at the latest.
What you can already do without writing to us: change your e-mail address and password from the app, unsubscribe from e-mails in one click from the link in every message, unpublish a leaderboard, delete a shared configuration.
Full account deletion is currently done manually, on written request. There is no delete button in the app yet.
If our answer does not satisfy you, you may lodge a complaint with the CNIL (cnil.fr) or with your country's data protection authority.
8. Security
- The site and the APIs are reachable over HTTPS only, with HSTS enabled.
- Passwords are hashed with PHP's native algorithm.
- Admin area logins are rate-limited per IP address.
- Database queries go through prepared statements.
No measure makes a system unbreakable. In the event of a data breach likely to create a risk for individuals, the CNIL is notified within 72 hours and the people concerned are informed, under Articles 33 and 34 GDPR.
9. Minors
The service is not aimed at children. The terms of use set a minimum age of 18, or the agreement of a legal guardian. No data is knowingly collected from a child under 15. If such a collection is reported to us, the account is deleted.
10. Cookies
Cookies and local storage have their own page, with the exact list of what is stored.
11. Changes
This page may change. The date at the top is authoritative. A substantial change — a new purpose, a new recipient — is announced by e-mail to account holders.