Effective 14 August 2026

Privacy Policy for Luca

This policy explains how personal data is processed when authorized users access Luca or connect a TikTok account. The general Llama League website privacy information remains available in the company legal notice.

1. Controller

Llama League GmbH, Trübnerweg 4, 22607 Hamburg, Germany. Email: julian@llamaleague.de.

2. Luca account and operation data

We process the name, business email address, role and login information of authorized Luca users. We also process campaign content, uploaded media, review decisions, captions, operational job status and security logs required to provide and protect the service.

3. TikTok connection and video delivery

When an authorized user connects TikTok, TikTok sends Luca an account identifier, basic profile information made available by the granted scope, access and refresh tokens, token expiry data and the granted permissions. Tokens are encrypted at rest. Luca uses this data to display the connected account, maintain the authorized connection and send user-approved MP4 files to that account's TikTok posting inbox.

For each delivery Luca may retain the associated customer, batch and video reference, the TikTok publish identifier, delivery status, timestamps, a caption snapshot and technical error details. Luca does not use the connection to read unrelated TikTok content and does not request permissions that are unnecessary for the documented workflow.

4. Purposes and legal basis

Processing is performed to provide the contracted production workflow and at the user's request, to maintain service security and reliability, and to document delivery status. Depending on the relationship, the legal bases are Article 6(1)(b) GDPR and Article 6(1)(f) GDPR. TikTok authorization is initiated explicitly by an authorized user.

5. Recipients and international processing

Data is shared only with service providers required to operate Luca and with TikTok when a user connects an account or requests video delivery. TikTok processes data under its own terms and privacy information. Processing by providers may take place outside the European Economic Area subject to the safeguards applicable to the respective service.

6. Retention and disconnection

Connection tokens are retained while the TikTok connection is active and are deleted from Luca when the connection is removed. Delivery records, campaign data and logs are retained only as long as required for the service, contractual documentation, security and applicable legal obligations. Disconnecting TikTok stops future Luca uploads; users can also revoke app access in TikTok.

7. Cookies

Luca uses a strictly necessary session cookie to authenticate users and protect account access. The public information pages do not use advertising cookies.

8. Your rights

Subject to the GDPR, data subjects may request access, rectification, erasure, restriction, portability or object to processing. They may also lodge a complaint with a competent data protection authority. Requests can be sent to julian@llamaleague.de.

9. Changes

We may update this policy when Luca's functionality or legal requirements change. The effective date above identifies the current version.