Sismo is a business-to-business service that measures how many app downloads the videos of a brand bring in. This policy explains what personal data Sismo processes, why, for how long, and your rights. It is also available in French; in case of discrepancy, the French version prevails.
1. Data controller
The data controller is Kevin Koudache, publisher of the website sismohq.com and of the Sismo service (see the legal notice), reachable at contact@sismohq.com. The registration details of the operating company will be added once it is created.
2. What Sismo processes, and what it does not
Sismo measures the effect of social videos on aggregated counters. By design:
- Sismo reads public counters of videos (views, likes, comments, shares), the same figures anyone viewing the video sees;
- Sismo receives aggregated counts from its clients (downloads per day, product events per hour), and never personal data about its clients' end users: no individual query, no end user email address, no advertising identifier;
- Sismo sets no pixel, rewrites no link and tracks no person.
3. Processing, purposes and legal bases
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Public metrics of TikTok and Instagram videos (views, likes, comments, shares, posting dates) | Measure the audience of client brands' videos and estimate their effect on the client's counter | Legitimate interest (Art. 6(1)(f)) for public counters; performance of the contract (Art. 6(1)(b)) for accounts connected by the client; consent (Art. 6(1)(a)) for accounts connected by their holder through TikTok's login | Duration of the contract, then deletion or anonymisation |
| Email address of Members invited to the platform | Account creation, sign-in, service notifications | Performance of the contract (Art. 6(1)(b)) | Duration of the contract, then archived for 5 years (limitation period) |
| Aggregated counts of product events provided by the client | Build the reference counter of the measurement | Performance of the contract (Art. 6(1)(b)) | Duration of the contract |
| Correspondence (emails sent to contact@sismohq.com) | Answer requests | Pre-contractual measures / legitimate interest | 3 years after the last contact |
| Hosting technical logs (IP address, timestamp) | Security and proper operation of the website | Legitimate interest (Art. 6(1)(f)) | 12 months at most |
4. Data received from TikTok
The holder of a TikTok account (a client brand, or a creator who works with a client brand) can connect the account to Sismo through TikTok's official APIs (Login Kit and Display API). Sismo then receives, within the limits of the permissions the holder grants on TikTok's consent screen:
- the account's basic profile: technical identifier (open_id), display name and avatar;
- the list of the account's public videos and their public counters: identifier, link, caption, posting date, views, likes, comments and shares.
This data is used for a single purpose: measuring the audience of the connected account's videos and their effect on the downloads of the client brand the account works with. Sismo builds no profile of third parties, does not use this data for advertising, and never sells it. Nothing is collected beyond the permissions granted, and Sismo cannot post, comment or act on the account.
The account holder can revoke this access at any time from the settings of their TikTok account; Sismo then stops collecting data from the account. When access is revoked, when the client's contract ends, or on request at contact@sismohq.com, the data obtained from TikTok is deleted. The same rules will apply to Instagram accounts connected through Meta's official APIs.
5. Recipients and processors
Data is neither sold nor rented. It is accessible only to:
- Sismo's team, to run the Service;
- its technical processors: Vercel Inc. (hosting of the website and of the platform), Supabase (database, hosted in Paris, France), Railway (background processing that reads the counters and computes the measurements), Resend (sign-in emails), and a technical provider that reads public video counters. The precise, up-to-date list of processors is available on request.
6. Transfers outside the European Union
Some processors are established in the United States. Transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the processor is certified (Vercel is), and otherwise on the European Commission's standard contractual clauses included in the processor's data processing agreement.
7. Your rights
Under the GDPR and the French Data Protection Act, you have the rights of access, rectification, erasure, restriction, objection and portability over your data. To exercise them, write to contact@sismohq.com. We answer within one month. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
8. Cookies and trackers: none
This website sets no cookie, embeds no tracker or third-party analytics tool, and loads no resource from a third-party domain. This is why no consent banner is shown. Only the host's technical logs are produced (section 3).
9. Changes to this policy
This policy may change with the Service; the version in force is the one published on this page, with its update date. Material changes are notified to active clients.