Bold Evolution Agency provides software and tools for live streaming, content creation, AI video generation, and creator management on platforms like TikTok. This privacy policy applies to all of our products and explains what information we collect, how it is used, with whom it is shared, and the security measures we implement to protect your data.
This policy covers the following products:
•Toklytics-LiveIQ– Live streaming analytics and AI coaching platform
This Privacy Policy describes how Bold Evolution Agency ("we", "us", "our") collects, uses, discloses, and protects your personal information when you use our software products and services for live streaming, content creation, and creator management. Bold Evolution Agency is a brand operated by TPC Global LLC. It applies to all Bold Evolution Agency products, including Toklytics-LiveIQ, Kling-Director, Discord 3rd Party Verify, and TikTok-Live-Event-Graphic-Engine (collectively, the "Services"). For the personal data described here, TPC Global LLC is the "data controller" (GDPR/UK GDPR) and the "business" (CCPA/CPRA). Where we rely on your consent (for example, non-essential cookies and analytics), we ask for it separately — using the Services does not by itself constitute consent to non-essential processing.
2. Information We Collect
We collect information to provide and improve our services. The categories we collect include:
Account Information: display name, username/handle, avatar URL, and platform identifiers (e.g. TikTok open_id, union_id) when you register or authenticate via TikTok Login Kit.
Contact Information: email address, phone number, and Discord ID or username where you provide them.
Creator Intake Survey Responses: the answers you submit to our onboarding surveys (goals, niche, experience, and any free-text you include).
Live Streaming Analytics: performance metrics, viewer and gift/revenue data, and stream session details captured for creators rostered with the agency.
Live Interaction Data: where you go LIVE, we process publicly visible interactions on your stream (e.g. chat messages and gift events, including the sending account’s public handle) to produce your analytics.
Payment Information: if you purchase paid services, our payment processor (Stripe) collects card details and billing information. We do not store full card numbers.
Device & Technical Information: IP address, user agent/browser, and login metadata recorded for security and abuse prevention.
Usage & Telemetry: features accessed, actions taken, and error/diagnostic events. Product analytics and session replay are collected only where you have consented (see Cookies).
Communications: the content of support requests, suggestions, and feedback you send us.
3. How We Use Your Information & Our Legal Bases
We use personal information for the purposes below. For individuals in the EEA and UK, the GDPR/UK GDPR legal basis for each purpose is shown in brackets:
Service Delivery: authenticate you, run your dashboards, and provide analytics and coaching [Contract].
Account & Security: manage accounts, maintain sessions, run MFA, and detect fraud/abuse [Contract; Legitimate Interests; Legal Obligation].
AI Coaching & Reports: generate performance insights and coaching using AI providers, based on your creator profile and survey answers [Contract; Legitimate Interests].
Communications: send service, security, and support messages [Contract; Legitimate Interests], and marketing messages only where permitted or with your consent [Consent].
Product Analytics: understand and improve the product via analytics and session replay [Consent].
Payments: process transactions and meet tax/accounting duties [Contract; Legal Obligation].
Legal Compliance: respond to lawful requests and enforce our terms [Legal Obligation; Legitimate Interests].
You may withdraw consent at any time where we rely on it; this does not affect processing already carried out.
4. How We Share Your Information (Sub-Processors)
We do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information to vendors ("processors"/"service providers") who act on our behalf under contractual data-protection terms, including:
Supabase — primary database, storage, and backups (United States).
Vercel — application hosting and content delivery (United States).
Railway — hosting for the live-stream monitoring service (United States).
Anthropic (Claude) and Google (Gemini) — AI processing that generates coaching insights from creator profile and survey context.
Google — Forms/Sheets for survey intake and BigQuery for aggregated session-flow analytics.
Euler Stream — TikTok LIVE status, rankings, and live analytics keyed to creator handles.
Resend — transactional email delivery (welcome, login, and notification emails).
Amplitude — product analytics and session replay (only where you have consented).
Discord and Slack — optional community and operational notifications configured by administrators.
We may also disclose information to agency staff for creators rostered with us, to authorities where legally required, and to a successor entity in a merger or acquisition.
5. International Data Transfers
Bold Evolution Agency Services is operated and hosted in the United States, and our processors are primarily US-based. If you are in the EEA, the UK, or another region with data-transfer rules, your personal information is transferred to and processed in the United States.
For transfers from the EEA we rely on the European Commission’s Standard Contractual Clauses (SCCs); for transfers from the UK we rely on the UK International Data Transfer Addendum to the SCCs (or the UK IDTA).
For transfers from Switzerland we rely on the SCCs as recognized by the Swiss Federal Data Protection and Information Commissioner.
We apply supplementary technical and organizational measures (encryption in transit and at rest, access controls) to protect transferred data.
You can request more information about the safeguards for a specific transfer using the contact details below.
6. Data Retention
We keep personal information only as long as necessary for the purposes above and to meet legal obligations:
Account and profile data: while your account is active and for up to 90 days after access is revoked, unless you request earlier deletion.
Login security logs: the IP address and device/user-agent fields are anonymized within 90 days; aggregate login history is retained for security monitoring.
Payment records: retained as required by tax and accounting law (typically 7 years).
Creator analytics and stream data: retained to provide historical performance context for as long as you are an active creator, then deleted or anonymized.
Aggregated or de-identified analytics that can no longer identify you may be retained indefinitely.
7. Data Security
We implement industry-standard measures to protect your information:
Encryption in transit (HTTPS/TLS) and provider-managed encryption at rest.
Passwords stored only as bcrypt hashes; MFA secrets and OAuth tokens encrypted (AES-256-GCM).
Row-level security on our database and least-privilege access for staff.
Regular access reviews, key rotation, and monitoring for suspicious activity.
Incident-response procedures to detect, investigate, and notify affected users and regulators as required by law.
No method of transmission or storage is 100% secure; please keep your credentials confidential.
8. Your Rights & How to Exercise Them
Depending on where you live, you have rights over your personal information. Signed-in creators can exercise most of these directly from Portal → Privacy & Your Data:
Access & Portability: download a machine-readable copy of your data from the portal, or request one from us.
Correction: ask us to fix inaccurate or incomplete information.
Deletion / Erasure: ask us to delete your data, subject to legal retention limits.
Opt-Out: withdraw analytics consent (via the cookie banner) and opt out of any sale or sharing of personal information (we do not sell or share it).
Restriction & Objection: ask us to restrict or object to certain processing.
Withdraw Consent: where we rely on consent, withdraw it at any time.
To make a request, use Portal → Privacy & Your Data, or email support@boldevolution.net. We respond within 30 days (within one month for GDPR/UK GDPR requests), and will not discriminate against you for exercising your rights.
You may authorize an agent to submit a request on your behalf; we may ask you to verify your identity and the agent’s authority.
9. EEA & UK Privacy Rights (GDPR / UK GDPR)
If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the rights described in Section 8, plus the following:
Our legal bases for processing are set out in Section 3.
You have the right to lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner’s Office (ICO); in the EEA, your national data protection authority.
We do not use solely automated decision-making that produces legal or similarly significant effects about you. AI-generated coaching is advisory and reviewed within our workflows.
We have not appointed a Data Protection Officer or an EU/UK Article 27 representative; if you have questions about our processing, contact support@boldevolution.net and we will route your request appropriately.
10. California Privacy Rights (CCPA / CPRA)
California residents have rights under the California Consumer Privacy Act as amended by the CPRA. In the past 12 months we have collected the categories of personal information described in Section 2 (identifiers, contact data, commercial/payment information, internet and device activity, and inferences), used them for the purposes in Section 3, and disclosed them to the service providers in Section 4.
Right to Know / Access: the categories and specific pieces of personal information we collect, use, and disclose.
Right to Delete: request deletion of your personal information.
Right to Correct: request correction of inaccurate personal information.
Right to Opt-Out of Sale/Sharing: we do NOT sell or share personal information (including for cross-context behavioral advertising), so no opt-out is required; we honor Global Privacy Control signals where applicable.
Right to Limit Use of Sensitive Personal Information: we do not use sensitive personal information for purposes beyond providing the Services.
Right to Non-Discrimination: we will not discriminate against you for exercising these rights.
To exercise these rights, use Portal → Privacy & Your Data or email support@boldevolution.net. You may use an authorized agent.
11. Other U.S. State Privacy Rights
Residents of Virginia, Colorado, Connecticut, Texas, Utah, Oregon, Montana, and other states with comprehensive privacy laws have rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, sale of personal data, and certain profiling.
We do not sell personal data or use it for targeted advertising.
You may exercise your rights via Portal → Privacy & Your Data or support@boldevolution.net.
Where your state provides an appeal process, you may appeal a decision on your request by replying to our response; if an appeal is denied you may contact your state attorney general.
12. Cookies & Tracking Technologies
We use a small number of cookies and similar technologies, grouped into two categories:
Strictly Necessary: keep you signed in and protect against cross-site request forgery and OAuth abuse. These are always on and cannot be declined, as the Services will not work without them.
Analytics & Session Replay (optional): help us understand and improve the product. These run ONLY after you opt in via our cookie banner, and you can decline or change your choice at any time.
We do not use advertising cookies and do not share cookie data for cross-context behavioral advertising.
Cookieless, aggregate performance measurement (e.g. Vercel Analytics/Speed Insights) may run to keep the site reliable; it does not use cookies or identify you.
13. Children's Privacy
Our Services are not directed to individuals under 18, and we do not knowingly collect their personal information. If we learn we have collected information from someone under 18, we will delete it promptly. Please contact us if you believe a minor has provided us personal information.
14. Third-Party Links & Services
Our Services may link to or integrate with third-party platforms (such as TikTok, Discord, and Stripe). We are not responsible for their privacy practices; please review their privacy policies.
15. Updates to This Policy
We may update this Privacy Policy to reflect changes in our practices or the law. When changes are material we will update the "Last updated" date and, where appropriate, notify you by email or a prominent notice. Where a change relies on consent, we will ask for fresh consent.
16. Contact Us
For questions, concerns, or to exercise your rights regarding this Privacy Policy, contact us:
Email: support@boldevolution.net
Data controller / business: TPC Global LLC (operating the Bold Evolution Agency brand)
Signed-in creators: Portal → Privacy & Your Data
We aim to respond within 30 days (within one month for GDPR/UK GDPR requests).