TOVANOWORLDAI FILM STUDIO

Legal

Privacy Policy

Last updated: 18 October 2026

1. Who is responsible

The controller responsible for this website and the services described here is TOVANOWORLD, represented by owner's full legal name — to be supplied, postal address — to be supplied, email contact email — to be supplied. Until these details are added you can reach us through the contact form.

2. Visiting this website

This website is a static site hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). When you open a page, Cloudflare processes technical data needed to deliver it and to protect the service, such as your IP address, the requested address, the time, your browser type and security signals. We do not set cookies, do not use analytics or advertising tools, do not embed third-party fonts, videos or social media plugins, and do not track you across websites. The legal basis is our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR). Cloudflare may process data in the USA; information on Cloudflare's data processing and the transfer safeguards it relies on is in Cloudflare's privacy policy.

3. Inquiries through the contact form

If you send an inquiry we store the name, email address, topic and message you enter, the time of sending, and a privacy-preserving hash of the request that helps us block abuse. The data is stored in our Cloudflare account (Cloudflare Workers KV) and is used only to answer you and to handle the matter you raise. The legal basis is your request and steps before a possible contract (Art. 6(1)(b) GDPR) and your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. Inquiries are deleted automatically about 13 months after they are received, or earlier on request, unless the law requires us to keep them longer. The abuse-limiting hash expires after two days.

4. Our TikTok integration

Our studio software, which runs only on the studio's own computer, uses TikTok's official Login Kit and Content Posting API to connect the studio's own TikTok account so that videos the studio owner has approved can be uploaded to that account's TikTok inbox as drafts. We request only the permissions user.info.basic (basic account information such as the account's display name, avatar and open ID) and video.upload (uploading drafts).

  • We do not use TikTok to collect data about other people, and we do not log in on behalf of visitors to this website.
  • The TikTok sign-in uses the OAuth 2.0 authorisation code flow with PKCE and a random state value. The page /auth/tiktok/callback on this website only passes the one-time authorisation code back to the studio software on the same computer; it stores nothing.
  • The access and refresh tokens (access_token, refresh_token) issued by TikTok are kept only on the studio's computer, encrypted for the studio's Windows user account. They are never stored on this website, never shown and never shared. The app's credentials (including the client_secret) are stored the same way.
  • Nothing is published publicly by our software: drafts are finished and posted by the studio owner in the TikTok app.
  • To end the connection, the account owner can remove TOVANOWORLD in the TikTok app under Settings and privacy, Security and permissions, Apps and services permissions. On disconnection, or on request, we delete the stored tokens.

TikTok processes data under its own terms and privacy policy: TikTok Privacy Policy (EEA).

4a. Our Instagram and YouTube publishing connections

In the same way, the studio software can connect the studio's own Instagram professional account (Instagram API with Instagram Login; permissions instagram_business_basic and instagram_business_content_publish) and the studio's own YouTube channel (Google OAuth; scopes youtube.upload and youtube.readonly) to publish clips the studio owner has authorised. The Instagram sign-in returns through /auth/instagram/callback on this website, which only passes the one-time code back to the studio software; YouTube's sign-in returns directly to the studio computer. Tokens are kept only on the studio's computer, encrypted for the studio's Windows user account. Instagram fetches a video it publishes from a public address, so a clip the owner has authorised for Instagram is placed at an unlisted address under /media/clips/ on this website before publishing. Either connection can be ended in the platform's settings (Instagram: Settings, Apps and websites; Google: Your account, Third-party apps); on disconnection or request we delete the stored tokens.

5. YouTube API Services

Screenhouse uses the YouTube Data API (YouTube API Services) to read public information, for example a public channel's name or whether a public video is offered under a Creative Commons licence. We do not access any YouTube user account and do not store personal data of YouTube users beyond what such public records contain. By using features that rely on YouTube data you are also subject to the YouTube Terms of Service; Google's privacy policy is at policies.google.com/privacy.

6. Openly licensed source material

Screenhouse works with videos published under open licences (for example on Wikimedia Commons). For each source we record the public licence information and the author's credit as published there, to give correct attribution and to document our rights.

7. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. To exercise these rights, use the contact form (topic "Other") or the email address above once it is published. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live.

8. Children

This website and our services are not directed at children under 16.

9. Changes

We will update this policy when our services or legal requirements change. The date at the top shows the latest version.