Privacy

Who we are

This service is provided by HookGoat. On these pages “HookGoat”, “we” and “us” mean HookGoat. Contact us through https://hookgoat.com/contact.

What we collect

• Your application. Email address, TikTok username, monthly GMV, follower count, months selling, any notes you add, and the review decision.
• Sign-in and security. Email verification and sign-in codes stored only as keyed hashes, a salted scrypt hash of your password if you set one, a signed session cookie, and your IP address for rate limits and abuse protection.
• Passes, credits and payments. Orders, invoice and payment status from NOWPayments, manual invoice records where used, and your credit balance history. We never receive your wallet keys or card details.
• Your workspace. Your saved character photos or chosen preset, product photos, reference slides, source videos and their audio that you upload or copy, the changes you ask for, generated images and videos, exports, and the job records for each.
• Referrals. Your referral code, the referral link an application came through, the orders and rewards linked to it, any reward rate agreed for your account, and payout requests with their review and payment records. The member who referred you sees only a numbered entry, its application date and status, and whether you bought, never your name or email.
• Create chat. Your messages, the product you chose for context, the assistant’s replies and drafts.
• Support and feedback. Contact form requests, “Was there an issue?” reports with any image you attach, support emails, and our admin review notes and audit records.
• Connected accounts (optional). If you connect TikTok or Discord: the account ID, names, avatar link, permissions you granted, cached account and post statistics, and for Discord your verification and role status and any private ticket. Access tokens are encrypted with AES-256-GCM before they are stored.

Public research data

The research pages show public information about public TikTok Shop listings, posts and creators, such as handles and public view counts. This is about public creators and products, not about you as a member. Your own uploads, generated media and account data stay private to your account.

Site analytics

To run and improve the service, HookGoat records which pages are viewed, clicks on its own buttons, how quickly pages load and errors that happen. Visitors who are not signed in get no cookies or local storage for this: each visit is counted with a one-way code made from the IP address and browser together with a random value that changes every day, so the address itself is never stored and visits can’t be linked from one day to the next. For signed-in members these records are linked to the account. We never record what you type into forms. We do this under our legitimate interests. These analytics records are kept for 30 days and then deleted automatically. They are never sold or shared for anyone else’s use: the only outside service that sees any of them is Anthropic, whose Claude model reads error reports and service health totals, with personal details removed, to help us find and fix problems.

Why we use it

• To provide the service you signed up for (contract). Accounts, passes, credits, generation, downloads and support.
• Legitimate interests. Reviewing applications, security, fraud and abuse prevention, checking generation quality and fixing problems you report.
• Legal obligations. Keeping payment and accounting records.
• Your consent. Optional TikTok and Discord connections. You can withdraw by disconnecting.

Who receives it

• Cloudflare hosts the app, database, private file storage and email routing, and applies rate limits.
• Email delivery through Cloudflare Email or Resend sends sign-in codes and service emails.
• NOWPayments processes cryptocurrency payments.
• AI providers. Google Gemini reviews the source video, its audio and the changes you ask for before a copy video is generated, and checks public source clips for our labels. Higgsfield (Kling video models) receives your character photos, product photos and source video for video generation. OpenAI receives your slideshow prompts, reference slides and product photos for images, and your Create chat messages with the chosen product’s name, seller and market.
• Our media processing service combines the source audio with generated videos and makes the exports you choose.
• Market data providers receive product or video IDs for research. They never receive your personal data or account credentials.
• TikTok and Discord receive sign-in requests only when you connect an account, and Discord receives messages you send in a private ticket. Public TikTok players on our pages load from TikTok in your browser, so TikTok receives your browser’s request under its own policy.

What we do not do

• We do not sell your personal data or use it for advertising.
• We do not show your email address, uploads or tokens to other members.
• We do not make automated decisions with legal or similarly significant effects. Applications are reviewed by a person.

Where it is processed

Some providers above process data outside the UK, including in the United States. Ask us if you want details of how a transfer is protected.

How long we keep it

We keep your account data while your account is active. Disconnecting TikTok or Discord deletes that connection, its tokens and cached statistics. Clearing the Create chat hides your messages but keeps them on record. Payment and credit records are kept for as long as accounting rules require. We have not yet set fixed automatic deletion periods for every other record. Ask us to delete data and we will, apart from records we must keep for accounting, security or legal reasons.

Cookies

We use a signed session cookie to keep you signed in, which the service needs to work. If you open a member’s referral link, a second cookie holds that link’s code for 30 days so the referral counts if you apply. We do not use advertising cookies. Embedded TikTok players may set their own cookies.

Your rights

You can ask for a copy of your data, a correction, deletion, restriction, a portable copy, or object to how we use it. You can withdraw consent for optional connections at any time. Contact us through https://hookgoat.com/contact. If you are unhappy with our answer, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.