1. Who We Are
Dodo (“Dodo,” “we,” “us,” or “our”) provides software for managing creator campaigns, tracking public social media posts against posting schedules, and delivering campaign alerts. This Privacy Policy covers our website, application, and related services.
It applies to account holders, creators who join campaigns or whose public profiles are added by campaign owners, and people who contact us. Our Terms of Service govern use of Dodo.
Contact: support@usedodo.app
2. Information We Collect
Account information
We collect your email address, account identifier, and any display name or organization name you provide, along with your notification preferences. Sign-in uses email magic links through our authentication provider; Dodo does not ask you to create a password.
If you enable WhatsApp alerts, we also process your phone number, connection and verification records, messaging consent, opt-out requests, and delivery information.
Campaign and creator information
- Campaign names, descriptions, dates, timezones, and posting schedules.
- Creator names, social handles, platforms, and public profile links.
- Information submitted through campaign invitations or imported by campaign owners.
- Posting deadlines, check results, public post links and identifiers, posting times, review decisions, and notification history.
Campaign owners may provide creator information directly. We also obtain public post information from supported social platforms and, for TikTok, through the creator’s authorization described below.
Technical and communication information
We and our infrastructure providers may process IP addresses, browser and device information, request and authentication logs, error details, and security events. We retain the information you include in support requests, privacy requests, or abuse reports, and records needed to deliver service messages.
3. TikTok Connections
When you choose “Connect TikTok and join,” you are directed to TikTok to authorize access to your account. We use TikTok’s official API to confirm the connected account and check whether it published public videos within a campaign’s posting window.
The current integration processes:
- Your TikTok account identifier and username to match the correct creator profile, and your avatar to display that profile.
- Public video identifiers and creation times, from which we generate public post links.
- Access and refresh tokens, granted permissions, token expiry times, and connection status. Tokens are stored encrypted and used to maintain your authorized connection.
The permissions requested are basic profile access, profile information, and your public video list. We do not receive your TikTok password. This integration does not publish or edit content, read private videos or direct messages, or download video or audio files. TikTok API data is not sent to our AI verification provider.
By connecting for a campaign, you authorize Dodo to make your creator profile, connection status, posting schedule, and verification results available to that campaign’s owner. This includes public post links and posting times; it does not include your access or refresh tokens.
You can use Manage my connections to stop sharing with one campaign, disconnect TikTok from all Dodo campaigns, or request deletion. These controls are free and do not require the campaign owner’s permission. Continue with TikTok verifies your account identifier to restore access to existing controls without enrolling you in campaigns or restarting tracking. It requests basic profile permission; credentials obtained for this identity check are not stored as tracking credentials. You can also verify an email address to return using a magic link. This recovery email is not shared with campaign owners. You can also revoke Dodo’s access in TikTok’s connected-app permissions. Campaign owners can disconnect your profile from their campaign in Dodo. Revoking TikTok access stops further authorized checks once the revocation is received or detected. Removing a connection from one campaign does not remove connections you authorized for other campaigns.
TikTok check history is retained for up to 90 days. Records tied to a verified TikTok connection are removed within 90 days after sharing with a campaign stops. You can request earlier deletion from Manage my connections: checks stop immediately, and the background cleanup removes linked creator profiles, posting history, queued alerts, and notification records from our active database. A minimal request receipt is kept for 30 days after processing. Credentials needed to retry TikTok revocation are kept for at most seven days after a deletion request. Delivered messages outside Dodo cannot be recalled; backups expire through their normal retention cycle and deletion requests must be reapplied if a backup is restored.
For connections you cannot recover, or to request deletion of other associated personal data, contact support@usedodo.app with your TikTok handle and enough campaign information to locate the records. We may need to verify that the account belongs to you. Never send us your password or access tokens.
TikTok processes information under its own Privacy Policy.
4. Public Instagram Checks and AI
For Instagram campaigns, Dodo checks public profiles and posts to help verify posting activity. Our verification service may send screenshots of the public pages it is checking, the creator’s handle, relevant posting windows, and limited observations of the page to OpenAI to help identify visible posts and navigate the verification process. Screenshots may contain public images, names, captions, or other information visible on the page.
Dodo’s verification records retain post links, timestamps, check outcomes, and limited evidence about how a result was reached. We do not retain the screenshot images in those records or download full videos or audio for these checks. Our AI requests are configured not to store responses; the provider may separately retain data under its applicable security and retention policies.
Dodo does not train AI models on your campaign data. Automated checks can be incomplete or incorrect. Campaign owners can review results and should verify them before making decisions that affect creators.
5. How We Use Information
We use information to:
- Provide Dodo, authenticate users, and maintain account settings.
- Manage campaigns, invitations, creator profiles, and posting schedules.
- Check public posting activity and display results to campaign owners.
- Send sign-in links, campaign alerts, support responses, and service notices.
- Investigate errors, protect the service, and prevent fraud or abuse.
- Respond to requests, enforce our terms, and meet legal obligations.
Where a legal basis is required, we rely on performing our agreement with you, legitimate interests in operating and securing the service, your consent where required, and compliance with legal obligations. You can withdraw consent where processing depends on it without affecting processing that occurred before withdrawal.
We do not sell or rent personal information, or share it for cross-context behavioral advertising.
6. Third-Party Services
We use service providers to operate Dodo. They process information needed to provide their services, subject to applicable agreements and their own privacy practices.
- Supabase: authentication, account and campaign databases, and related infrastructure.
- Polar: hosted checkout, subscriptions, invoices, and the customer billing portal. We send your account identifier and email to link your purchase to Dodo. Polar processes billing details and payments; Dodo stores subscription status, plan, billing period, and provider identifiers, not full payment card details.
- Resend: transactional email, including recipient addresses, message content, and delivery records.
- Twilio and WhatsApp: optional campaign notifications, including phone numbers, message content, delivery status, and connection, consent, and opt-out records.
- Upstash: request rate limiting and abuse prevention, including IP addresses or request identifiers.
- OpenAI: assistance with public Instagram verification, as described above.
- Hosting and infrastructure providers: serving the application and running scheduled posting checks.
TikTok provides the authorized social connection described in this policy. Messaging providers receive the information needed to deliver notifications when you choose to enable that channel.
We may update or replace providers as the service evolves. We will update this policy when changes materially affect how we handle your information.
7. Data Sharing
We may share information:
- With the owner of a campaign in which your creator profile is tracked, as described above.
- With service providers supporting the purposes described in this policy.
- When required by law or to respond to valid legal requests.
- To investigate abuse, enforce our terms, or protect people and the service.
- In connection with a merger, acquisition, or transfer of the business, subject to applicable protections.
- At your direction or with your consent.
Campaign owners are responsible for how they use creator information and may have their own privacy notices. Where we process campaign data on an organization’s behalf, we act according to that organization’s instructions and applicable agreements. This policy does not replace the campaign owner’s obligations to creators.
8. Cookies and Similar Technologies
We use cookies and browser storage for authentication, session security, connecting TikTok, remembering a pending sign-in email, and saving interface preferences such as your theme and table settings. Blocking these technologies may prevent parts of the service from working.
Dodo does not currently use advertising cookies, cross-site advertising trackers, product session replay, or third-party product analytics in the application. Hosting and security logs are described separately above.
9. Communications and Your Choices
Account holders can turn campaign email notifications on or off in Account settings. Essential messages, such as requested sign-in links and necessary security or service notices, may still be sent.
WhatsApp notifications are optional and require a separate opt-in and connection. Providing a phone number or accepting our terms alone does not subscribe you. You can withdraw consent by replying STOP in WhatsApp, turning off WhatsApp alerts in Account settings, or contacting us.
We do not share mobile numbers or messaging consent with third parties or affiliates for their own marketing. We may share this information with messaging providers only as needed to deliver the messages you requested and honor your choices.
10. Security and Data Retention
We use safeguards such as access controls, secure authentication, encryption of stored TikTok tokens, and abuse prevention to protect information. No system can guarantee absolute security. We will provide notice of a personal data breach where required by law.
We retain information for as long as needed to provide the service, handle disputes, protect against abuse, and meet legal obligations. The period depends on the type of information, the purpose of processing, and applicable requirements.
- Account information is retained while needed to maintain your account.
- Campaign and posting records are retained while needed for campaign history and review, subject to the shorter TikTok retention periods described above.
- TikTok credentials are retained while needed for authorized connections. Revoked credentials are cleared after revocation is received or detected and processed; previously collected TikTok campaign records follow the retention and deletion process described above. Browser access sessions expire after 30 days; unused email connection claims expire after 30 minutes.
- Security, delivery, and support records are retained as needed for their operational or legal purposes.
Pausing or archiving a campaign, disconnecting a social account, or signing out does not itself request deletion of all related data. You can request deletion using the contact details below. Where deletion applies, data will be deleted or anonymized, subject to necessary legal or security exceptions and backup retention cycles.
11. Your Rights and Requests
Depending on where you live, you may have the right to:
- Know about and access the personal information we hold about you.
- Correct inaccurate information or request a portable copy.
- Request deletion of your information or closure of your account.
- Object to or restrict certain processing, or withdraw consent.
- Appeal a decision about your request or complain to a privacy regulator.
Send requests to support@usedodo.app. Tell us whether you are an account holder or a creator, and provide the email address or social handle associated with your data. We may verify your identity or the authority of someone making a request for you. We will respond within the timeframe required by applicable law and will not discriminate against you for exercising your privacy rights.
If a campaign owner provided your information, you may also contact that owner. Where they control the processing, we may coordinate with them to handle your request.
12. International Processing
Dodo and its providers may process information in countries other than where you live, including the United States. Privacy laws may differ between countries. Where applicable law requires safeguards for international transfers, we use the safeguards required for those transfers, such as appropriate contractual protections. Contact us for information about transfers relevant to your data.
13. Children
Dodo is intended for people aged 18 and over. We do not knowingly collect personal information from children under 18. If you believe a child’s information has been provided to Dodo, contact us so we can investigate and take appropriate steps to remove it.
14. Changes to This Policy
We may update this Privacy Policy as Dodo evolves. We will update the date above and provide notice through the service or email when changes are material. Where required, we will obtain consent before using information for a new purpose.
15. Contact
For privacy questions, data requests, or concerns about creator information, contact Dodo at support@usedodo.app.