Praxio Privacy and Data Protection Policy
How Praxio processes, protects, retains and deletes data on behalf of TikTok Shop sellers.
Version 1.0 | Effective date: 6 November 2026 | Next review: no later than 6 November 2027 | Owner: Matheus Martins Abdala (sole operator)
1. Who we are and our role
Praxio is operated by 64.728.974 MATHEUS MARTINS ABDALA (CNPJ 64.728.974/0001-79), Campo Grande, MS, Brazil. For the data that sellers authorize us to read from their TikTok Shop accounts, the seller is the data controller and Praxio acts as the data processor (operador, under the Brazilian General Data Protection Law, LGPD, Law 13.709/2018), processing data only on the seller's documented instructions and for the contracted service. Data protection contact (encarregado): Matheus Martins Abdala, matheusmabdala@gmail.com.
2. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Shop identifiers and authorization tokens | Connect the seller's shop and keep the connection working | Contract and the seller's authorization |
| Product catalog and prices | Show products and calculate margin for the seller | Contract |
| Orders and financial data (fees, settlements) | Calculate margin, reconcile sales and payouts, produce reports for the seller | Contract |
| Seller account and contact data | Provide access, support and security notices | Contract and legitimate interest |
| Technical logs (IP, time, request type) | Security, troubleshooting and abuse prevention | Legitimate interest |
Praxio requests the minimum permissions required and, where order data contains personal data of buyers, processes it only to provide the service to the seller, minimizes it and does not keep it longer than necessary. Praxio does not sell personal data, does not use it for advertising and does not use it for any purpose other than the service contracted by the seller.
3. Authorization and TikTok Shop
Access is granted only through the official TikTok Shop authorization flow. Praxio never asks for or stores a seller's TikTok password. The seller can revoke access at any time in the TikTok Shop Partner Center or by contacting us. Praxio follows the TikTok Shop Partner and developer terms and policies.
4. Sharing and sub-processors
Data is shared only with providers needed to run the service (hosting, DNS and CDN) under confidentiality and security obligations, with the authorities when the law requires, and with TikTok Shop through the authorized API. We do not share data with other sellers or any other third parties.
5. Storage location and international transfers
Production data is stored on servers of a commercial hosting provider selected by Praxio. The hosting country is stated to TikTok Shop in the partner questionnaire and to sellers on request. Any transfer outside Brazil is made only to providers that guarantee a level of protection compatible with the LGPD.
6. Security
Praxio applies the controls in its Information Security Policy, including encryption in transit and at rest, multi-factor authentication, least-privilege access, per-seller data isolation, logging and monitoring, backups and an incident response procedure.
7. Retention and deletion
Data is kept only while needed for the contracted service. After revocation of authorization or the end of the contract, tokens are deleted immediately and other seller data within 30 days. Encrypted backups expire within 35 days. Data that the law requires us to keep is kept only for the required period.
8. Data subject and seller requests
Sellers, and individuals whose data is processed through a seller's store, can request confirmation of processing, access, correction, anonymization, portability or deletion, and information about sharing, by writing to matheusmabdala@gmail.com. Praxio answers within 15 days and supports the seller and TikTok Shop in fulfilling requests addressed to them, including deleting, updating or providing data on request.
9. Personal data breach notification
If a breach affects personal data, Praxio notifies the affected sellers and TikTok Shop without undue delay and no later than 72 hours after confirmation, describing the data involved, the likely impact and the measures taken, and supports the seller in notifying the ANPD and data subjects when required.
10. Records, history and review
Praxio keeps a record of its processing activities. In the last three years Praxio has had no personal data breach notified to an authority or customer and has received no complaint or notice from a regulator, customer or individual about the processing of personal data. This policy is reviewed at least once a year and whenever the service changes, and the new version is published with its date.
11. Contact
Data protection contact (encarregado): Matheus Martins Abdala, matheusmabdala@gmail.com.