Privacy Policy

This Privacy Policy explains how CN Creator App (the “app”) and this website, operated by Devign LLC (“we”, “us”), handle information about you. Devign LLC is registered in Casper, Wyoming, USA, and our team works from Lebanon. Effective date: 23 October 2026. Document version: 2026-10-23.

The app and this website are both run by Devign LLC.

2. What we collect

The list below is meant to be complete. If we start collecting something that is not on it, we will add it here first.

2.1 Information you give us

2.2 Information your agency records about you

2.3 Information read from TikTok

2.4 Information collected automatically

2.5 What we do not collect

We do not collect payment card, bank account or wallet details — when an owner buys a plan, Apple, Google or our payment processor takes the payment on its own screen and tells us only that it happened (section 2.4); health information; your contacts; your microphone or camera; or advertising identifiers. The app does not pay creators, moves no money between an agency and its creators, and holds no balance for anyone. There are no third-party advertising, analytics or tracking software libraries in the app; the measurement of our own app described in 2.4 is done by us, on our own servers.

About a phone number, precisely. Nothing in the app asks you for one. The setup step in 2.1 asked for a phone number when it was first built and does not any more, and the field it used is cleared. One route is left: an agency owner registering an agency may supply a WhatsApp number so that a verification code can be sent to it, and where that channel is switched on the number is stored against the agency and marked verified when the code comes back. That channel is switched off, so today no phone number is asked for, sent to or stored by this service. We are naming the route rather than writing a flat “we never hold a phone number” that a configuration change would quietly falsify.

About location, precisely. We do not use GPS and we do not ask your device for its location. The country in your setup answer is a country you typed. But your IP address indicates roughly where you are, and we record it on security-relevant actions (2.4); and we guess a market from your device’s time zone when you sign up. We use neither for anything but the purposes in section 4.

3. Where the information comes from

3.1 From you, when you register, sign in, fill something in, or write something.

3.2 From your agency, when its staff add you to a roster or record something about you.

3.3 From TikTok’s Backstage portal, through the agency’s own connection.

3.4 From your device, automatically, as described in 2.4.

4. Why we use it

4.1 To run the app — managing a roster, showing monthly figures and levels, running the Points programme where an agency has switched it on, and powering the AI growth coach where an agency has enabled it. Both of those are off for every agency until its owner turns them on, and neither collects anything while it is off.

4.1a To sell and run a plan — where an agency’s owner buys a plan through the App Store or Google Play, or arranges one directly with us: confirming the purchase with the store or processor, switching the plan’s features, seats and regions on and off as it starts, renews, lapses or is refunded, giving each agency one free month only, locking and unlocking the agency, sending the owner billing reminders and the warnings and export links that come before data is deleted (section 11), answering a question about a charge, and meeting tax and accounting duties. We use the subscription and billing record for nothing else, and do not use it for advertising.

4.1b To offer the AI setup and brand assistants — where an agency has them switched on and an owner uses one. Section 8A.

4.2 To manage your account — creating and securing it, signing you in, sending verification, reset and deletion codes.

4.3 To keep the service safe — detecting and investigating abuse, attacks, account takeover and attempts to reach another agency’s data. This is what the IP address and user-agent records are for.

4.4 To keep the service working — knowing that the service is up, and knowing which versions of the app are in use so a fault can be reproduced and fixed.

4.4a To report to TikTok on how each agency is using the app. TikTok’s regional teams ask us how much the tool is actually being used, and we answer them. What goes to TikTok, for each agency, is: the agency’s name; how many staff seats and creator accounts it has; how many staff and how many creators opened the app in the period; how many TikTok Backstage connections it has and how many are failing; whether the Backstage connection is working; whether the agency has set up its own payout scheme or is on the default; and how many creator accounts and staff seats are new in the period. Platform-wide totals for the same measures go with it.

No individual is named in it. The counts are counts of distinct people and the report does not say who they were. No creator handle, no diamonds, no earnings, no message, no note and no coach conversation is in it.

It is segmented. A TikTok team is shown only the agencies in its own audience, and the totals it sees are the totals for those agencies. An agency in one region’s report does not appear in another’s.

How often, honestly. The daily activity records described in 2.4 are what it is built from, and they are written every day. The report itself covers a period — usually the previous day — and is produced and sent by a person at Devign. There is no automatic job that generates or delivers it.

How to be left out. An agency that does not want to be in the report can tell us at info@devignlb.com and we will exclude it. Terms of Service section 9A covers the same ground from the agency’s side.

4.5 To recognise an account — what you told us about yourself at the setup step is kept so that an account which looks wrong can be checked against what its holder said. It is a statement and we treat it as one; nothing in the app relies on it being true.

4.6 To meet a legal obligation or answer valid legal process.

4.7 We do not use your information for advertising, for building a marketing profile, or for training anyone’s AI model, and we do not use it for any purpose incompatible with the ones above.

5. Where your information is stored

5.1 Our servers and databases are hosted in the European Union, at a commercial hosting provider.

5.2 Our team works from Lebanon and reaches those servers from there.

5.3 Our users are in the United States, in the Gulf and the Levant, and in Turkey. If you are in any of those places, your information is being stored and processed outside your own country. By using the app you understand that.

5.4 Backups are kept at the same hosting provider. Backups are covered by section 11.

6. Who else processes it

6.1 We do not sell your personal data. We do not share it for advertising. Two different kinds of outside party see something, and we separate them because they are not the same: the service providers we need to run the app, and TikTok.

6.2 The service providers. We name them by category:

• A cloud hosting provider in the European Union, which runs our servers and stores our databases.
• An email delivery provider, which sends your sign-in, verification, password-reset and deletion codes.
• A push notification service, which passes app notifications to Apple’s or Google’s push systems (on Android, Google’s Firebase Cloud Messaging). It handles your push token and the text of each notification.
• An app update service, which the app asks whether a newer version of its code is available. Like any web request, it sees the device’s IP address, together with the app version, platform and update identifier the app sends.
• Anthropic, the third-party AI provider (its model is called Claude) that powers every AI feature in the app: the AI growth coach (section 8), the creator reports (section 8B), and the AI setup and brand assistants (section 8A). Anthropic acts as our processor. It receives only what the signed-in person could already see in the app, to write the reply, and does not use it to train its models.
• Stripe, our payment processor for plans arranged directly with us. It collects and holds the card and billing details under its own privacy policy and tells us the identifiers, the plan, the dates and the status of the subscription.
• Apple and Google, as the stores that sell and bill a plan. They are not our service providers in the ordinary sense: the buyer has their own relationship with the store, under the store’s own privacy policy, and we exchange with them only what is needed to confirm and keep up to date a purchase (the transaction identifier, the plan, the dates and the status).
• An operational monitoring service, which receives alerts about errors and events on our own systems so we can keep the service running.

What none of them is sent. The contents of anything you type. What reaches the monitoring service is that a screen was opened or a button was pressed, and never what was entered in it.

6.2a TikTok. TikTok’s regional teams receive a report from us on how much each agency is using the app. This is the one place where information leaves us for somebody else’s own purposes, and we would rather name it than let a general sentence about not sharing cover it over. What is in the report, what is not, how it is segmented and how often it goes are set out in full at section 4.4a. It names agencies; it names no individual; it contains no creator’s handle or figures.

6.3 These providers are bound by written terms to use the information only to provide their service to us and to protect it: Anthropic by its Data Processing Addendum; Stripe, where it acts for us, by its Data Processing Agreement; Google’s Firebase Cloud Messaging by the Firebase Data Processing and Security Terms; and our app update and push notification service by the data protection terms in its terms of service. Where any of them receives information outside the EU or the UK, those terms include the EU Standard Contractual Clauses, and Anthropic’s and Stripe’s also cover transfers from the UK. Our hosting provider is a company in the European Union, so the GDPR applies to it directly. Sections 8.5 and 8A.5 say how long the AI provider keeps what we send.

6.4 We may disclose information if we are required to by law or by valid legal process.

6.5 Where the law or an app store requires it, we name the provider (sections 8B and 13A.4 do). Elsewhere we describe providers by category. If you need to know which company sits behind a category — because your own agreement with your creators requires it, or because you are assessing us as a supplier — write to info@devignlb.com and ask.

7. The TikTok Backstage connection

7.1 The monthly figures in the app — diamonds, valid days, LIVE hours and the rest — are read through the agency’s own TikTok LIVE business account, which TikTok calls Backstage. This is the agency’s own business data about its own creators. The app reads it and does not post, message or change anything.

7.2 This is never a creator’s personal TikTok account. A creator is never asked for their TikTok password and their personal account is never connected.

7.3 When an agency chooses to connect, the username and password for that business account are stored encrypted at rest on our servers. They are used for one purpose only: to sign in to that same agency’s Backstage and fetch that agency’s own figures for its own creators.

7.4 Those details are never used for anything else and are never shared with another agency or with any third party. They are never shown on any screen and never returned by any address the app or the website answers on.

What is true rather than what sounds better. They are encrypted with a key we hold, so our systems have to decrypt them to sign in on the agency’s behalf. That happens only inside the processes that make the connection and in limited maintenance of our own systems. Every decryption is recorded in our audit log. Section 10.3 says the same thing in the list of protections.

7.5 An agency can disconnect its Backstage account at any time, and the stored credentials are deleted when it does. Where an agency’s workspace is closed, the credentials stay inside that workspace and are deleted with it, under the 30-day process in Terms of Service section 13.4.

8. The AI growth coach

8.1 The app includes an optional AI growth coach that answers questions about growing LIVE performance. It is off for every agency until an owner switches it on, a creator uses it only after agreeing for themselves (8.2a), and each person has a weekly allowance of turns.

8.2 It is off until an agency owner switches it on, and the software enforces that. Only a person holding the owner role can enable it, and they do so for the whole agency, not just for themselves. Until an owner has given that consent, the coach refuses to answer anybody in the agency — including the owner. We record which owner enabled it, the versions of the Terms and this policy shown to them, and the date and time. An owner can withdraw the consent at any time, which stops anything further being sent and puts the coach back to refusing everyone in the agency.

8.2a A creator agrees for themselves too, and the software enforces that. The owner’s agreement does not cover a creator’s own conversation. Before a creator’s first question the app shows them a screen that says what is sent, to whom and where, with “Turn on” and “No thanks” as equal choices. Until the creator taps “Turn on”, our server refuses their coach turns. We record the creator’s yes, the version of the wording they saw, and the date and time, and when they turn it off we record that time too. Saying no costs nothing: a creator’s pay and every other screen work the same either way. The same yes is what lets the coach name the creator’s TikTok handle to their agency’s staff (8.3); the creator reports consent in section 8B is a separate agreement and does not.

8.3 What we send to the AI provider. Every time someone asks the coach a question, we send the question, the recent conversation, and the working context needed to answer it. Depending on who is asking, that context includes:

• for agency staff, their display name; for everyone, their role in the agency and its permissions, and their language. A creator’s name is not sent with their own questions;
• the agency’s name and the market it operates in;
• the asking creator’s own figures — diamonds, diamonds from PK and matches, valid LIVE days, PK battle count, LIVE hours, Points balance, level, tier, the distance to the next one, and the agency’s monthly Coins figure for them;
• when an owner or a member of agency staff is asking, up to eight of that agency’s creators, ranked by diamonds for the current month, with that creator’s diamonds, valid days, LIVE hours and level, plus roster headcounts and roster totals. A creator in the eight is named by TikTok handle only if they have turned the coach on for themselves (8.2a); every other creator is sent as a number with no name or handle. The eight are picked on figures alone. A creator who has been paused is included if their figures put them in the eight; a creator who has left the agency is not sent. This goes with every question, whether or not the question is about them;
• the agency’s own reward settings — its share curve, payout components and percentages, Points earn rates, daily caps and reward catalogue.

8.4 If you are a creator at an agency that has enabled the coach, your monthly figures may be sent to the AI provider when your agency’s owner or staff use the coach, even if you never open it yourself, have no account with us, and have never seen this document. Your TikTok handle goes with them only if you have turned the coach on for yourself; otherwise you are sent as a number with no name. Your agency authorises sending the figures on your behalf, and it has warranted to us that it is entitled to and that it has already told you. We do not check that and we hold no record of it — the Terms of Service, sections 8.6, 8.7 and 9.4, set out exactly what the agency promises us. A creator can keep their name out by leaving the coach off, or turning it off, for themselves (8.8). A creator who wants their figures out as well should ask their agency’s owner to switch the coach off, and may also write to us.

8.5 The AI provider, Anthropic, processes what we send in order to return a reply. It acts as our processor under its Data Processing Addendum, uses what we send only to provide its service to us, and may not train its models on it. Anthropic’s standard terms for its API, which are the terms we use it on, say that it deletes what we send and what it returns within 30 days of receiving or producing it. It keeps them longer only where its automated safety systems flag a request as breaking its usage policy (then for up to 2 years, and the safety scores for up to 7 years), or where the law requires it. We have not arranged a shorter or zero-retention period with Anthropic, and we do not claim one. We do not use coach conversations for advertising or to build a marketing profile, and we do not use them to train anyone’s model.

8.6 We do not keep your coach conversation on our servers. The only thing our systems store about coach use is a count of how many coach turns each person has spent in the current week, which is what enforces the weekly allowance. The conversation itself lives on your device.

8.7 Please do not put sensitive personal data into a coach message — government identifiers, bank or card details, or health information. The coach does not need them.

8.8 How to take an agreement back, in the app.

• A creator turns their own coach agreement off with the power button at the top of the coach screen, or under Account → AI help → AI coach. It takes effect from the next message: our server refuses the creator’s next question, and the staff coach stops naming them.
• An agency owner turns the coach off for the whole agency with the power button at the top of the coach screen, or by switching off “Let AI help” under Account → AI help. Nothing more is sent for anyone in the agency from that moment.
• Deleting your account removes your own agreements with it (section 12.2).

8A. The AI setup and brand assistants

8A.1 The app has two optional helpers for an agency’s owner. The AI setup assistant asks how the agency pays its creators and turns the answers into a draft of the app’s pay settings; where we have switched it on for the agency it can also match the columns of a spreadsheet the app does not recognise. The AI brand assistant suggests colours and a look for the agency’s branding from a short typed request. The AI home-layout suggestion suggests which cards the staff and creator home screens show, and in what order, from a short typed request. They are separate from the AI growth coach in section 8, and use the same provider, Anthropic.

8A.2 They are off until we switch them on for the agency; only an owner can use them; and the owner must agree first. Our server sends nothing for them while the owner’s “Let AI help” switch under Account → AI help is off. Before first use the app also shows a screen that says what is sent, to whom, and how to stop. Nothing is sent before the owner taps to agree. Tapping one of the ready-made answers does not call the AI; only text the owner types does. An owner can stop using an assistant at any time and set things up by hand instead. We can also switch the assistants off for one agency, or for everyone at once.

8A.3 What we send to the AI provider.

• For the setup assistant: the words the owner types and the conversation so far, with a few facts about the agency — its market and currency, its level targets and how many creators it has. The owner’s own words go in as typed.
• For the brand assistant: the colours in use, three sets of colour codes our server worked out from the logo, the layout choices available, the interface language, and the short request the owner typed (up to 300 characters).
• For the home-layout suggestion: the names of the cards the home screens can show, the order the agency uses now, the interface language, and the short request the owner typed. No creator’s name or figures.
• For spreadsheet matching: the column headings and the kind of value in each column (for example “a number” or “text”). The spreadsheet itself and the values in it are not sent, and the file is not kept after the import.

8A.4 What we never send. Not the logo image. Not the agency’s name in the brand assistant. Not any creator’s name, TikTok handle, email address, phone number or figures. Not passwords or Backstage sign-in details. But the owner’s typed words go as they are typed, so if an owner types a creator’s name or a sensitive detail into a message it goes to the provider with it. Please do not — government identifiers, bank or card details and health information in particular. The assistants do not need them.

8A.5 What the provider does with it. The AI provider, Anthropic, processes what we send in order to return a reply. It acts as our processor under its Data Processing Addendum, uses what we send only to provide its service to us, and may not train its models on it; we do not use any of it for advertising, to build a marketing profile, or to train anyone’s model. How long Anthropic keeps what we send is set out in section 8.5. Anthropic is in the United States, outside the European Economic Area, so what we send leaves the European Union to reach it.

8A.6 What we keep.

• The setup assistant’s conversation is kept on our servers, with the agency it belongs to, so the owner can carry on later, see what was proposed and undo it. A session is deleted 30 days after it was last used. A setup the owner saved can be undone for 7 days.
• What the owner saves — the pay settings, or the colours and layout — becomes part of the agency’s own settings, like anything an owner enters by hand. Only values our server has checked are saved; text the AI wrote is never saved as settings.
• The brand assistant’s and the home-layout suggestion’s request and reply are not stored. We store one line in the audit log that each was used — the agency, the person, the time and the language.
• A spreadsheet is not stored. The import keeps the rows it creates in the roster; the file itself is not kept.
• Section 11 lists the periods.

8A.7 Limits. Each agency has a small number of setup sessions and brand requests a day, and we cap what we spend on the provider each month, so an assistant can stop answering. Nothing in the app depends on using one.

8A.8 How to switch it off. An owner switches every assistant off for the agency with “Let AI help” under Account → AI help; from then on nothing more is sent, and setup works by hand. The same screen deletes the stored setup conversations at once (“Delete AI chat history”). An owner can also write to info@devignlb.com to have the assistants turned off for the agency or a stored session deleted before its 30 days. Terms of Service section 9B says what the agency is responsible for.

8B. Weekly and monthly creator reports

8B.1 On the Elite plan an agency can give its creators a written report each week and each month. The report is built from figures the app already holds for the creator: daily diamonds, valid LIVE days and LIVE time, the creator’s LIVE sessions (when each started and ended, and how long it ran) as read from the agency’s Backstage account, and the creator’s month and level.

8B.2 Each creator decides for themselves. Nothing is sent to an AI provider for a creator until that creator turns reports on in the app, on a screen that says what is sent and to whom. The agency’s agreement to the AI coach does not cover it, and neither does the creator’s own coach agreement. A creator turns reports off at any time on the reports screen or under Account → AI help → Written reports, and nothing more is sent after that.

8B.3 What we send. A short digest of the period’s numbers (totals, changes on the previous period, the level) so the AI provider, Anthropic (Claude), in the United States, can word a short summary. No name, TikTok handle or other identifier goes with it. The numbers in the report itself are written by our server, not by the AI. Anthropic keeps what we send for as long as section 8A.5 says. Section 13A.4 explains what sending information outside the EU and the UK means; turning reports on is the creator’s explicit agreement to it.

8B.4 What we keep. The report, the figures it was built from and the creator’s yes or no, with the agency’s other figures and for as long as section 11 keeps them. The agency’s owner and staff can read a creator’s reports, as they can read the figures they come from.

9. Push notifications

9.1 If you turn notifications on, your device’s operating system issues a notification token that identifies your device to Apple’s or Google’s push service. We store that token with your device platform (iOS or Android), against your account.

9.2 We use it for one purpose only: to deliver the notifications you have enabled to your own device. Delivery is handled by a push notification service that passes each notification to Apple or Google on our behalf and is bound to use it only for that.

9.3 You can turn notifications off in your device settings at any time, and choose which kinds reach you in the app’s own notification settings.

9.4 A token from a device that has uninstalled the app is deleted as soon as the push service tells us that device is gone.

10. How your information is protected

10.1 Traffic between your device and our servers is encrypted in transit.

10.2 Passwords are stored only as a secure one-way hash and cannot be read by anyone, including us.

10.3 TikTok Backstage credentials are encrypted at rest, are never shown to a person, and are never returned by any address the app or the website answers on. Our systems decrypt them only to sign in to Backstage for the agency, and every decryption is recorded. Section 7.4 explains it fully, including the fact that we hold the key.

10.4 Each agency’s data is kept separate from every other agency’s.

10.5 Agency staff see only what their role permits, and creators see only their own information. You can see the devices signed in to your account and sign any of them out.

10.6 Security-relevant actions are written to an audit log that is not edited. The only change ever made to a row is that, 13 months after it was written, its IP address and user-agent are blanked.

10.7 Who at Devign can reach your agency’s workspace. A platform administrator account at Devign can enter any agency’s workspace and see what is in it. It has no second factor. Entering a workspace that way is logged, but the access is not time-limited and is not tied to a stated reason. We tell you this because an agency is entitled to a true answer about who can see its data.

10.8 We have no security certification and we do not claim one. We have not had a penetration test. No system is perfectly secure.

11. How long we keep things

Read this first. We run one deletion timetable, for an agency whose plan has ended, and it is the first row of the table below. Apart from that and the few periods the table gives, we do not run a general deletion timetable. Our position is deliberate and we would rather state it plainly than imply otherwise:

• Operational and audit records are kept indefinitely; the IP address and user-agent on them are kept for 13 months. That includes the security and audit log, which records what was done, by which account, from which IP address and with which browser or app user-agent, and when. The IP address and user-agent are blanked 13 months after the record was made; the record of the action stays. We keep the records for security, for accountability, and so that a dispute between an agency and a creator, or between an agency and us, can be settled by looking at what actually happened rather than at what anybody remembers.
• The audit log is not edited. The only change ever made to a row is that the IP address and user-agent are blanked after 13 months. It stays that way when an account is deleted.
• What that means for a deletion request. The personal data held in your account is removed (section 12.2). The record of the actions taken on the service — including the IP addresses and user-agents attached to them while they are under 13 months old, and the account identifier they were recorded against — remains, as does the record that you accepted these documents and confirmed you were 18. In short: we delete your account, not the history of what was done with it.
• A closed agency is deleted on a clock. Where we close an agency, its workspace — its data, and the records of who belonged to it — is deleted 30 days after the closure if nobody has asked for a copy in that time (Terms of Service section 13.4). For agencies closed before this process existed we hold no recorded closure date, so there is no day from which to count the 30; those workspaces are left alone rather than deleted on a guessed date. The audit record of any deletion, like every other, is permanent.

The table below sets out the rest.

12. Deleting your account and your data

12.1 You can delete your CN Creator App account in two ways:

• In the app: Account → Delete your account, and confirm with your current password.
• On the web: visit https://creatorapp.devignlb.com/account/delete, enter the email address on your account, and confirm with the code we email you. No app and no password are needed.

The two routes delete the same things, with one difference worth knowing before you choose. If you are the last owner of an agency, only the in-app route can close that agency for you as part of the same request (12.6). The web route refuses, names the agency that is in the way, and deletes nothing.

12.2 What deletion removes. Your email address and any other sign-in identity, your password, your display name, your profile image, your contact email address and everything you told us at the setup step — your role, your agency’s name, your agency’s TikTok handle and your country — every session and token, your memberships and any invitation still outstanding, your notes and free text, appeal message bodies, request details, daily-challenge answers, workspace notifications addressed to you, and TikTok’s own identifier for you on any agency roster. Your AI history goes too: the setup assistant conversations you started (a session holding an open to-do for the agency keeps the to-do without the words), your own yes or no to the AI coach and to written reports, your written reports, and the notes you wrote under creators’ reports. If you signed in with Apple (or with TikTok), we also ask that provider to revoke this app’s access to your account before we delete the stored token; if the provider does not answer, the deletion still goes ahead and the failed attempt is noted in our audit log without the token. Your account record is left pointing at nobody.

12.3 It is immediate. The deletion runs inside the same request. There is no queue and no waiting period, and there is no recovery afterwards.

12.4 What deletion does not remove.

• The agency’s business record of you — your TikTok handle, the months you worked there, and the figures for those months. This is the agency’s record, kept so it can reconcile what it owes and answer its own legal and tax obligations.
• Our security and audit records, including the IP address and user-agent recorded against actions you took, and the account identifier they were recorded against. These are append-only and cannot be deleted by anyone including us. The records are kept indefinitely; the IP address and user-agent on them are blanked after 13 months. Deleting your account removes the personal data in the account; the audit trail of actions taken on the service remains. We think you should know that before you delete, rather than after.
• Your record of accepting the Terms and this policy, with the version of each and the date, and the date you confirmed you are 18. These say that an attestation was made and carry no name, address or number, and they are the only evidence that it was made at all.
• Your daily activity records and session presence records — the rows saying that the account was used on a given day, for how long, and from which app version and device model.
• A subscription. Deleting your account does not cancel a plan bought through the App Store or Google Play or arranged directly with us, and the store or Stripe will keep charging until it is cancelled where it was bought: the App Store or Google Play subscription settings or, for a plan arranged directly with us, the Stripe Customer Portal. The app tells an owner with an active subscription before the deletion goes ahead. The agency’s subscription and billing record stays with the agency.
• Anything already written to a backup, until that backup is rotated out on the schedule in section 11.

12.5 If you want a copy first, ask before you delete. Deletion is immediate. An agency owner can export the agency’s figures from the app as CSV files first. For a copy of any other personal data, request it under section 13 and wait for it to arrive before you delete the account, because afterwards there is less for us to produce.

12.6 A sole agency owner cannot delete their account first. If you are the last owner of an agency, the app will refuse and tell you which agency is in the way. Nothing is deleted when it refuses. To proceed:

• Make someone else an owner in the app under Team, and wait until they have accepted — an invitation nobody has opened does not count. Then request deletion again.
• Or close the agency along with your account. The app offers this on the deletion screen as a separate, clearly marked choice that names the agency it will close. It is never the default and never happens unless you choose it. Choosing it closes that agency, ends everyone’s access to it including yours, and deletes your account in the same request. Figures already collected are kept, and the workspace is deleted afterwards under the 30-day process in Terms of Service section 13.4.
• The web deletion page cannot do that second thing. It has no agency-closing choice: it refuses, names the agency, and deletes nothing. Use the app, or email info@devignlb.com and a person at Devign will close the agency with you.

12.7 We do not charge for a deletion request and we will not ask you why.

13. Your rights

13.1 We offer the rights below to everyone who uses the app, wherever they live, rather than asking you to work out which law covers you:

• Access — ask what personal information we hold about you, and get a copy of it.
• Correction — ask us to correct something that is wrong. Note that figures read from TikTok can only be corrected by TikTok, and a record your agency wrote can normally only be corrected by that agency.
• Deletion — delete your account and its personal data, subject to section 12.
• A copy in a portable form — ask for your data in machine-readable files. An agency owner can export the agency’s figures from the app as CSV files, including after a plan has ended, and we send the owner an export link before the agency’s data is deleted. An owner can also remove one creator’s personal data from the agency in the app, and any staff member can delete their own stored Backstage login at once. For anything else, a person at Devign gathers the data from our systems by hand and sends it to you.
• Object or restrict — ask us to stop or limit a particular use.
• Withdraw the AI coach authorisation — an agency owner can switch the coach off for the whole agency at any time. There is no per-creator exclusion: the software has no way to keep one creator out while the agency’s consent stands, so a creator who wants out has to ask their agency’s owner to switch it off. You may also write to us, and we will pass it on.
• Complain — to us, and to your local privacy regulator where you have one.

13.2 If you are in the United States. Several US states now give residents privacy rights of this kind, and whether a particular state law applies to a business depends on its size and how much data it handles. We do not claim that any specific state law applies to us or that we comply with it. We answer the request either way. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of on that basis. If we ever refuse a request, we will tell you why and how to ask us to reconsider.

13A.1 If you are in the European Union, the European Economic Area or the United Kingdom. Sections 13A.2 to 13A.7 add what the GDPR and the UK GDPR require us to tell you. Everything else in this policy applies too.

13A.2 Who is responsible. Devign LLC, 5830 E 2ND ST, STE 7000 #23016, CASPER, WY 82609, USA, is the controller of the account, sign-in, plan, billing and usage information of agency owners and staff. Ask us anything about it at info@devignlb.com. For creator information that an agency puts into the app or reads through it, the agency decides why and how it is used and is the controller; we act for it as its processor, on the terms in the Terms of Service, section 7A.23. A creator who wants to use a right over that information should write to their agency, and may also write to us. We have not appointed a data protection officer, because we do not believe the law requires one for what we do.

13A.3 Why we use your information, and the legal basis.

• To run your account and the app, to sell and run a plan, and to send sign-in codes and billing messages (sections 4.1 and 4.1a): it is needed to carry out our contract with you or your agency (Article 6(1)(b)).
• To keep the service secure, to prevent abuse and fraud, to fix errors, to count visits to the public pages, to keep the audit log, and to keep a record of what you accepted and of the warnings we sent before an agency’s data is deleted: our legitimate interest in running a safe, working service (Article 6(1)(f)). You can object to this at any time (section 13.1), and we will stop unless we have a compelling reason that outweighs your interests.
• To keep tax and accounting records of purchases: a legal obligation (Article 6(1)(c)).
• The AI features and push notifications, which are off until they are switched on: consent (Article 6(1)(a)). The agency owner gives it for the agency, you can withdraw it at any time by switching the feature off (section 13.1), and that does not affect what was done before.

We do not set out to collect information of a special kind (health, beliefs and similar), and ask you not to put it in the app. Giving us the information in section 2.1 is needed to have an account; without it we cannot open one. We make no decision about you by automated means that has legal effect or a similarly significant effect on you, with one note: our servers decide automatically whether an agency is still entitled to the free month (Terms 7A.3) and lock an agency whose plan has ended (Terms 7A.12). A person at Devign will look again at either on request.

13A.4 Sending information outside the EU and the UK. Our servers are in the European Union. Our team reaches them from Lebanon, and Devign LLC is in the United States; neither has an EU or UK adequacy decision for this purpose, and we do not rely on the EU-US Data Privacy Framework. Information you give us directly is sent by you to us. Where an agency in the EU, the EEA or the UK uses the app for its creators’ information, the Standard Contractual Clauses and the UK Addendum in Terms 7A.23 cover the transfer to us. Some providers we use are outside the EU and the UK too: Anthropic and Stripe in the United States. The AI features that use them are off until an agency owner agrees to them on a screen that says what is sent and to whom. For Anthropic (every AI feature), the United States has no EU or UK adequacy decision for this use, as we do not rely on the EU-US Data Privacy Framework, so EU and UK protections may not apply there. When an owner switches the coach on, or a creator turns the coach or their reports on for themselves, the screen says so, and switching it on is that person’s explicit consent to the transfer (Article 49(1)(a)). Section 6.3 says which written terms bind each provider. You can ask us at the address in section 16 for the safeguards that apply to any of them.

13A.5 How long we keep it. Section 11 says, for each kind of information, how long we keep it and why. Those periods apply in the EU and the UK as they do everywhere.

13A.6 Your rights and how fast we answer. The rights in section 13.1 are yours under the GDPR and the UK GDPR, and so is the right to withdraw consent at any time. We answer within one month (up to three where the request is complex; we tell you if so), free of charge, and may ask you to prove who you are.

13A.7 Complaints. Please write to us first at the address in section 16. You also have the right to complain to the data protection authority of the country where you live or work, or where you think your rights were infringed (list of EU and EEA authorities), and in the United Kingdom to the Information Commissioner’s Office (ico.org.uk).

13.3 If you are in the Gulf, the Levant or Turkey. Your country may give you rights under its own data protection law — for example Turkey’s KVKK, or the personal data protection laws of Saudi Arabia and the UAE. We do not claim that any particular one applies to us or that we comply with it. We answer the request either way.

13.4 How to ask, and how long we take. Use the in-app or web deletion flow for a deletion, or write to info@devignlb.com for anything else. We will confirm we received it and answer within 30 days of the day your request reaches us. The clock starts on receipt, not on anything we do afterwards. We do not charge, and we will not ask you why.

This is a promise kept by people, not by software. We record a request and its due date, but nothing in our systems watches that date or reminds anybody it is coming, and one person does this work. No request has yet been made or answered under this policy. We are telling you so that you hold us to the 30 days rather than assume something is counting them for us.

13.5 We will check that the request really comes from you before we act on it — normally by emailing a code to the address on the account, and for an agency’s data by confirming that the person asking is one of its owners. We do this so that nobody else can obtain your data by asking for it. That check happens inside the 30 days and does not extend them. If you cannot complete it, we will tell you what is missing and why we cannot answer without it.

13.5a If you are a creator on an agency’s roster and have no account with us. Your TikTok handle and your monthly figures may be in this app because your agency put them there, without you ever installing it. Our identity check is built around an account, and you have none, so we cannot email a code to an address we do not hold. Write to info@devignlb.com and say which agency and which handle: we will tell you what is held against that handle, and we will do what we reasonably can to satisfy ourselves that you control it before we say anything. We may not be able to verify you, and where we cannot, we will say so rather than guess. Your agency is the party that put the information here and is the faster route for most requests; Terms of Service sections 8.6 and 8.7 set out what your agency has promised us about telling you.

13.6 If a law that applies to your request sets a shorter deadline than 30 days, the shorter one is the one we keep. We do not use the 30 days here to take longer than a law allows.

13.7 If your account or your agency has been closed by us, you have 30 days from the closure to ask for a copy of the data that was in it. Terms of Service section 13.3 sets that out. After that window the personal data is deleted and we cannot produce it.

13.8 What a request produces. For a person: your profile, your memberships, your record of accepting the Terms and this policy, and your activity records. For an agency, on an owner’s request: the roster, the monthly figures, the reward and payout configuration, and the agency’s notifications. Our security and audit records are not part of a routine copy; if you want to know what the audit log holds about you, say so in the request and we will tell you.

13.9 An agency using the app is responsible for its own relationship with its creators. Where a request concerns something the agency recorded, we may need to pass it to the agency.

14. Children

14.1 CN Creator App is for adults. You must be 18 or older to hold an account. We ask you to confirm it by ticking a box reading “I am 18 or older, and I accept the Terms and the Privacy Policy”, and we record who confirmed it, against which versions of these documents, and when. Nothing in the app checks anyone’s age — we do not ask for a date of birth, and the confirmation is a statement you make. It is asked on the registration screen when you create an account, and again at the acceptance step when a document changes, as section 2.1 describes. Accounts that existed before that step was built have not made it.

14.2 TikTok LIVE is not open to under-18s.

14.3 We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has an account, contact us and we will close it and delete the personal data on it.

15. Changes to this policy

15.1 We may update this policy. When we do, we will change the effective date and the version at the top and post the new version here. The version at the top of this page is always the version in force, and it is the only version anybody can accept — an acceptance is recorded against the version that was published when it was given, and against no other.

15.2 Publishing a new version asks everybody again. Every acceptance already recorded names the older version, so once a new one is posted the app treats everyone as owing an answer on it and asks them for it. The earlier acceptance is kept as the record of what was agreed and when.

15.3 How you will find out — and you should not rely on us telling you. We do not email, message or send a notification when this policy changes. There is no such mechanism. The only way the app tells you is by asking you, the next time you open it, to accept the new version. If you do not open the app you will not be told. Where a change materially affects how we handle your information we will ask you to acknowledge the new version through that same prompt; today the prompt asks and does not block, so a person who declines can still use the service. If you want to know when this document changes, check this page or write to us. Every version we publish stays readable at its own permanent address once it is superseded, so an acceptance recorded against a version number names a document you can still read; the list at the foot of this page links to each one.

16. Contact us

Questions, requests and complaints about privacy all go to the same place: info@devignlb.com.

Devign LLC, 5830 E 2ND ST, STE 7000 #23016, CASPER, WY 82609, USA

Previous versions

Every version we publish stays readable at its own address, so that an acceptance recorded against a version number names a document you can still read.

• 2026-10-23 — in force since 23 October 2026. This document. It adds the plans bought through the App Store and Google Play or arranged directly with us, with purchase history and billing identifiers (sections 1.5b, 2.4, 4.1a, 6.2, 12.4), the timetable for an agency whose plan has ended and the export of an agency’s figures (sections 1.10, 11, 12.5, 13), Sign in with Apple revocation on deletion (12.2), the AI setup and brand assistants (section 8A), Anthropic as a provider (6.2), the weekly and monthly creator reports (section 8B), what the GDPR and the UK GDPR require us to say (13A) and the 7-year period for billing records (11). Revised without a new version on 31 October 2026 to describe what the software now enforces: each creator’s own agreement to the AI coach and the handle rule that goes with it (1.5, 8.1 to 8.4, 8.8), Anthropic’s 30-day retention (6.3, 8.5, 8A.5, 11), the “Let AI help” switch and the home-layout suggestion (1.5a, 8A), how each AI agreement is taken back in the app (8.8, 8A.8, 8B.2), and the AI records account deletion removes (12.2).
• 2026-10-22 — in force 22 October 2026 to 23 October 2026. Superseded. The only change from the version below it is the statement, in the notice under the definitions, that Devign is an official TikTok LIVE agency partner and TikTok games partner and that the app is not a TikTok product.
• 2026-10-07 — in force 7 October 2026 to 22 October 2026. Superseded.
• 2026-09-09 — in force 9 September 2026 to 7 October 2026. Superseded. The only change in the version after it is one added row in section 2.4, about the dv_utm cookie.
• 2026-08-10 — in force 10 August 2026 to 9 September 2026. Superseded.