Privacy Policy — TCN Agent

App name: TCN Agent
Publisher: Devign LLC, Beirut, Lebanon (the "Company," "we," "us," or "our")
iOS Bundle ID: com.devignlb.tcnagent
Android Package: com.devignlb.tcnagent
Contact: info@devignlb.com

Last Updated: May 7, 2026
Effective Date: May 7, 2026

This Privacy Policy applies to the TCN Agent mobile application (the "App"), an internal-operations tool published by Devign LLC on the Apple App Store and Google Play. The App is intended exclusively for staff agents of the Devign Creator Agency Network ("TCN") and is used to track creator-portfolio performance, surface daily action recommendations, and compute agency bonus payouts.

This Policy describes how we collect, use, share, retain, and protect personal information processed through the App, and the rights you have over that information. By using the App you (the agent) consent to the practices described here.

1. Definitions

• "Personal information" or "personal data" means information that identifies, relates to, or can reasonably be linked with a particular natural person, as defined under the GDPR, the CCPA/CPRA, and similar laws.
• "Process" means any operation performed on personal data, including collection, storage, use, sharing, and deletion.
• "Sub-processor" means a third-party service provider that processes personal data on our behalf under contract.
• "Agent" means an authorised Devign LLC staff member or contractor with an active TCN Agent account.

2. Who Uses This App

The TCN Agent app is provisioned to Devign LLC employees and contracted agency agents. Access is gated by Auth0 single sign-on; only email addresses authorised by Devign LLC can sign in. The App is not available to the general public and there is no self-service sign-up.

3. Information We Collect

3.1 Categories aligned with Apple App Privacy

The following categories mirror Apple's App Privacy taxonomy and identically describe what we declare on the App Store:

Apple data type	What we collect	Linked to your identity?
Contact Info → Email Address	Your work email address, used as your sign-in identifier (via Auth0)	Yes
Contact Info → Name	Your full name, shown in the App header and used in audit log entries	Yes
Identifiers → User ID	Your internal agent_id, assigned by Devign LLC, links your account to your portfolio	Yes
Usage Data → Product Interaction	API requests, screen views, feature interactions; used for analytics and to operate the App	Yes
Diagnostics → Crash Data	Crash reports collected via standard Expo / React Native mechanisms	No (anonymous)
Diagnostics → Performance Data	Performance traces collected via standard Expo / React Native mechanisms	No (anonymous)
Other Data Types → "TikTok Backstage credentials"	The TikTok Backstage email and password you optionally store to enable automated portfolio sync; encrypted at rest with Fernet (see §7)	Yes
Other Data Types → "Push notification token"	Your device's push notification token, used to send in-app alerts; deleted when you remove the App	Yes

We do not use this data to track you across apps or websites owned by other companies. We do not collect or use the IDFA (iOS Advertising Identifier) or Android Advertising ID.

3.2 Information we explicitly do not collect

• Precise or coarse location data, GPS data, or IP-based geolocation
• Microphone, camera, or audio input
• Photos, videos, contacts, calendar entries, or files
• Health, fitness, or biometric data
• Browsing history, search history, or any data outside the App
• Advertising identifiers (IDFA, Android Advertising ID)
• Sensitive demographic information (race, religion, political opinion, sexual orientation, etc.)
• Payment, banking, or financial information from you (the agent)

4. Creator-Level Data Visible in the App

The App displays portfolio data about TikTok creators in your assigned roster — handles, tier, diamond totals, LIVE hours, PK match counts, etc. This data is sourced from:

• The TikTok Backstage agency portal, accessed under Devign LLC's TikTok agency partnership and, when you enable automated sync, via the credentials you store in the App;
• Devign LLC's internal agency database, populated by aggregating Backstage data over time.

Devign LLC's relationship with each creator and the corresponding privacy disclosures to those creators are governed by the separate Devign Creator Agency Member Privacy Policy and the agreements between Devign LLC and TikTok Pte. Ltd. The TCN Agent app does not present any data outside the metrics already accessible to the agency through the official Backstage portal.

5. How We Use Your Information

We process your information for the following purposes only:

• Authentication and access control — to verify you are an authorised agent and gate access to your assigned portfolio.
• App functionality — to compute and display your daily action recommendations, rank-up math, payout math, and alerts.
• Backstage sync — to log into TikTok Backstage on your behalf and refresh portfolio metrics every few hours.
• Audit and accountability — to record who took which action inside the App for internal accountability and regulatory purposes.
• Service improvement — to investigate bugs, improve the App's recommendation logic, and fix performance issues.
• Push notifications — to send you alerts about creators in your portfolio.

We do not use your data for advertising, profiling, automated decision-making with legal effects, or any purpose unrelated to operating the App.

6. Sub-Processors and Sharing

We do not sell, rent, lease, or trade your personal information to any third party.

We use the following sub-processors who process limited data on our behalf, under contract, in compliance with applicable law:

Sub-processor	Country	Data shared	Purpose
Auth0 (Okta, Inc.)	United States	Email address, name	User authentication (single sign-on)
Apple Push Notification service (Apple Inc.)	United States	Device push token, notification payload	Notification delivery on iOS
Firebase Cloud Messaging (Google LLC)	United States	Device push token, notification payload	Notification delivery on Android
Contabo GmbH	France (data centre Lauterbourg)	All App data at rest	Server hosting and storage
TikTok Pte. Ltd.	Singapore	The Backstage email + password you store, transmitted only when our worker logs in on your behalf	Automated portfolio sync via the public TikTok Backstage login page

We do not share data with advertising networks, data brokers, marketing platforms, or analytics platforms outside the standard Expo/React Native crash and performance telemetry.

7. Data Security

• All traffic between the App and our servers is encrypted in transit via HTTPS using TLS 1.2 or higher.
• TikTok Backstage credentials are encrypted at rest using Fernet (AES-128 in CBC mode with HMAC-SHA256 authentication). The encryption key is held in a server-side environment variable on a secrets-managed instance and is not shipped to the device.
• Authentication tokens issued by Auth0 are stored on the device using expo-secure-store, which uses iOS Keychain (Secure Enclave-backed where available) on iOS and the Android Keystore on Android.
• API endpoints validate JWT tokens on every request; per-agent isolation is enforced server-side using the agent_id claim.
• Database queries use parameterised statements; password hashes (where applicable for non-Auth0 credentials) use bcrypt.
• Servers run with restricted SSH access, automated security updates, and network firewalling.

While we apply industry-standard precautions, no method of electronic transmission or storage is 100% secure. We commit to notifying affected agents and the relevant data-protection authority in the event of a personal-data breach in accordance with Article 33 of the GDPR (within 72 hours where applicable) and §1798.82 of the California Civil Code.

8. Data Retention

• Account data (email, name, agent_id, settings) — retained for the duration of your active role at Devign LLC. Removed within 90 days after your role ends.
• Audit-log records — retained for up to 7 years post-deactivation for accounting, tax, and regulatory purposes; pseudonymised after deactivation so they cannot be reasonably linked back to you.
• TikTok Backstage credentials — kept until you remove them from the in-app Sync screen, then deleted within 24 hours.
• Push notification tokens — deleted when you uninstall the App or sign out.
• Crash and performance telemetry — anonymised at collection; retained for up to 12 months by the underlying platform vendors per their published policies.

9. Your Privacy Rights

9.1 Rights available to all users

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your account and personal data, subject to retention requirements in §8.
• Right to data portability — request your data in a structured, machine-readable format (JSON or CSV).

9.2 European Economic Area, UK, and Switzerland (GDPR / UK GDPR / FADP)

Legal basis for processing:

• Performance of a contract (Art. 6(1)(b) GDPR) — your employment or contractor agreement with Devign LLC, which requires use of the App to perform agency duties.
• Legitimate interest (Art. 6(1)(f) GDPR) — operating the App, preventing fraud and abuse, audit logging, and improving service quality.
• Compliance with legal obligation (Art. 6(1)(c) GDPR) — for tax, accounting, and regulatory record-keeping (audit logs).

Additional rights for EEA / UK / Swiss residents:

• Right to object to processing based on legitimate interest.
• Right to restrict processing.
• Right not to be subject to solely automated decision-making with legal or similarly significant effects (we do not engage in such decision-making).
• Right to withdraw consent (where consent is the legal basis), without affecting the lawfulness of prior processing.
• Right to lodge a complaint with your local data protection authority under Art. 77 GDPR.

9.3 California (CCPA / CPRA)

If you are a California resident:

• Right to know — what personal information we collect, use, disclose, and the categories of sources and recipients.
• Right to delete — request deletion of your personal information.
• Right to correct — request correction of inaccurate personal information.
• Right to limit use of sensitive personal information — we do not collect sensitive personal information beyond authentication credentials, which are used solely to operate the App.
• Right to opt out of sale or sharing — we do not sell or share personal information for cross-context behavioural advertising.
• Right to non-discrimination — we will not discriminate against you for exercising any CCPA right.

To exercise any right, email info@devignlb.com. We will respond within 45 days (or as required by applicable law) and may need to verify your identity before fulfilling the request.

10. Apple App Tracking Transparency

The App does not "track" within the meaning of Apple's App Tracking Transparency (ATT) framework. We do not link data collected from the App with data collected by other companies' apps, websites, or offline properties for advertising or measurement, and we do not share device-level identifiers with data brokers. You will not see an ATT prompt because we do not request permission to track.

11. International Data Transfers

Personal data may be transferred to and processed in countries outside your country of residence, including:

• France (server hosting at Contabo GmbH, Lauterbourg)
• United States (Auth0 / Okta, Apple Push Notification service, Firebase Cloud Messaging)
• Singapore (TikTok Pte. Ltd., for the Backstage credential exchange you authorise)

Where required by law, we rely on the European Commission's Standard Contractual Clauses or equivalent transfer mechanisms with sub-processors located outside the EEA.

12. Account Deletion

To request deletion of your account, email info@devignlb.com from the email address tied to your TCN Agent account, or contact your Devign LLC manager. We will deactivate the account immediately and remove personal data within 90 days, except for audit-log records as described in §8 and any data we are legally required to retain.

13. Children's Privacy

The App is restricted to Devign LLC agency staff aged 18 and older. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has been provisioned access in error, contact info@devignlb.com and we will promptly investigate and delete the data.

14. Push Notifications

When you grant the operating-system permission, the App registers your device with Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android) and stores the resulting push token on our server. Tokens are used solely to deliver in-app alerts (creator alerts, rank-up eligibility changes, payout-gap reminders). You can disable notifications at any time through your device settings; this does not affect your account or the rest of the App.

15. Cookies, Tracking Pixels, and SDKs

The App does not use cookies, tracking pixels, advertising SDKs, analytics SDKs (beyond standard Expo / React Native crash reporting), or fingerprinting techniques. The Devign LLC public website (devignlb.com) uses standard web cookies and is governed by a separate website privacy notice.

16. Third-Party Services and Links

The App may link out to TikTok Backstage and to internal Devign LLC tools. We are not responsible for the privacy practices of those external services; please review their policies independently.

17. Changes of Control

If Devign LLC is involved in a merger, acquisition, asset sale, or insolvency, your personal data may transfer to the successor or acquiring entity. We will notify you in advance through the App or by email and your rights under this Policy will continue to apply with the successor.

18. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top, post the revised version at the same URL, and notify you in-app at next sign-in. Continued use of the App after the effective date constitutes acceptance of the updated Policy.

19. Contact

Questions, complaints, or requests about this Privacy Policy or our data practices? Contact:

Devign LLC — Privacy Office
Email: info@devignlb.com
Website: https://devignlb.com

We aim to respond to all privacy enquiries within 30 days.