Habba Habba Privacy Policy
In short: Habba ("Habba", "we", "us") collects only what it needs to publish videos to the TikTok accounts you connect and to show you how they perform. We do not sell your data or use it for advertising. You can disconnect an account at any time, and its data is then deleted.
- Who we are and scope
- Information we collect
- Information we receive from TikTok
- How we use information
- Legal bases
- Sharing and service providers
- Retention and deletion
- Security
- Your rights and choices
- International transfers
- Children
- Cookies
- Changes to this policy
- Contact
1. Who we are and scope
Habba is a web application, available at https://habbah.nine9.sa, that lets a business schedule and publish videos and photo posts to TikTok accounts it owns or manages, and review the results. This policy explains how Habba handles personal information of (a) people who use the Habba dashboard ("Users"), and (b) TikTok account holders who connect their accounts to Habba ("Connected Accounts"). Habba is operated from the Kingdom of Saudi Arabia.
2. Information we collect
Information you give us
- Dashboard login details: the name and username of each team member, and a password stored only as a salted hash (scrypt). The owner account uses a password set by the operator.
- Content you upload: videos, photos, cover choices, captions, hashtags, on-video text and subtitles you type or approve, campaign names and schedules.
- Settings: account labels, niches and hashtags you add, posting preferences, templates, and an optional Telegram chat used for notifications.
Information collected automatically
- Activity records: what was scheduled, posted, approved or failed, which team member created it, and when.
- Technical data: a session cookie to keep you signed in, and standard server logs (IP address, browser type, time of request) kept by our hosting provider for security.
3. Information we receive from TikTok
When you choose "Connect with TikTok", TikTok asks you to approve specific permissions ("scopes"). Habba receives only the data covered by the scopes you approve:
| Scope | Data | Why Habba needs it |
|---|---|---|
| user.info.basic | Open ID, display name, avatar | To identify the connected account and show it in the dashboard. |
| user.info.profile | Username, bio, profile link, verified status | To show the account's profile and help you keep it complete. |
| user.info.stats | Follower, following, like and video counts | To show account growth in analytics and the weekly report. |
| video.list | Your public videos and their view, like, comment and share counts | To show how videos posted through Habba perform and to suggest the best posting hours. |
| video.upload | Permission to send a video to your TikTok inbox as a draft | To deliver drafts you choose to finish in the TikTok app. |
| video.publish | Permission to post a video or photos to your profile | To publish the posts you schedule, with the caption and privacy setting you chose. |
We also receive OAuth access and refresh tokens from TikTok. We never receive or store your TikTok password. We use TikTok data only to provide Habba's features to you, and in line with the TikTok Developer Terms of Service.
4. How we use information
- To publish or send as drafts the posts you create, at the time you choose, and to report their status.
- To show analytics about your connected accounts and the posts made through Habba.
- To generate caption suggestions and subtitles when you turn these features on (see section 6).
- To run team roles and approvals.
- To send notifications you set up (for example, to your Telegram chat).
- To keep Habba secure, fix problems and prevent misuse.
We do not sell personal information, do not use it for advertising or profiling, and do not use TikTok data to train artificial-intelligence models.
5. Legal bases
We process information to perform our agreement with you (providing the service you asked for), with your consent (connecting a TikTok account and turning on optional features, which you can withdraw at any time), and for our legitimate interests in keeping Habba secure. Where the Saudi Personal Data Protection Law (PDPL) or other applicable laws apply, we process information in line with them.
6. Sharing and service providers
We share information only as needed to run Habba:
- TikTok, to authenticate your account and publish the content you choose.
- OVHcloud (hosting provider), which provides the server that runs the application and stores its database.
- Anthropic, only if caption suggestions are turned on: the campaign brief, base caption and account niche are sent to generate captions. No TikTok tokens are sent.
- OpenAI, only if automatic subtitles are turned on: the audio track of the video is sent to produce a transcript.
- Telegram, only if you connect a Telegram chat: notification messages and optional database backups are sent to that chat.
- Authorities, if required by law or to protect rights and safety.
These providers process information on our behalf and may not use it for their own purposes beyond their published terms.
7. Retention and deletion
- Videos and photos are deleted from our servers automatically after the post is completed, unless you saved them to the media library. You can delete library items at any time.
- Connected account data and tokens are kept while the account is connected. When you disconnect an account, Habba revokes its access with TikTok and deletes the account, its tokens and its statistics from the database.
- Post and campaign records are kept for as long as the dashboard is in use, so you can see your history; the owner can delete campaigns.
- Backups are kept for up to 14 days and then deleted.
You can also revoke Habba's access from the TikTok app at any time (Settings and privacy → Security and permissions → Apps and services permissions). To ask us to delete all of your data, contact us at the address below; we respond within 30 days.
8. Security
Access and refresh tokens are encrypted at rest with AES-256-GCM. Connections use HTTPS. Dashboard passwords are hashed, sessions expire, and team members only see the features their role allows. No system is perfectly secure, but we work to protect your information and will notify affected users of a breach where required by law.
9. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete or obtain a copy of your personal information, to object to or restrict its processing, and to withdraw consent. You can disconnect TikTok accounts and delete content from the dashboard yourself, or contact us to exercise these rights. You may also complain to your data protection authority, such as the Saudi Data and AI Authority (SDAIA).
10. International transfers
Habba is hosted on a dedicated server in the United Kingdom (London), and some providers listed in section 6 may process information in other countries, including the United States. We rely on these providers' safeguards for international transfers.
11. Children
Habba is a business tool and is not directed to children. You must be at least 18 years old to use it. We do not knowingly collect information from children; if you believe a child has provided information, contact us and we will delete it.
12. Cookies
Habba uses one essential cookie to keep you signed in. We do not use advertising or tracking cookies. The public pages load fonts from Google Fonts, which may receive your IP address.
13. Changes to this policy
We may update this policy. We will change the date at the top and, for significant changes, notify Users in the dashboard before the change takes effect.
14. Contact
Questions or requests about this policy or your data: h.vaalletta@gmail.com.