The short version
- Goarau is a TikTok Ads management tool used by invited agencies and professional media buyers. There is no public sign up.
- We access TikTok advertising data only after you authorize it through TikTok's official OAuth flow, and only to show and manage that data inside your own Goarau account.
- Your TikTok access tokens are encrypted at rest (AES-GCM) and are deleted immediately when you disconnect.
- We do not sell your data, share it for advertising, or use third party advertising or analytics cookies.
- You can disconnect TikTok and request deletion of your data at any time by writing to [email protected].
1. Who we are
Goarau ("Goarau", "we", "us" or "our") is operated by NRT WORLDWIDE LLC, a limited liability company with its principal office at 8722 E Laurel St, Mesa, AZ 85207, United States, together with its Brazilian affiliate NRT SERVIÇOS ADMINISTRATIVOS LTDA, a company registered in Brazil under CNPJ 39.828.030/0001-26, with its registered office at Avenida Ayrton Senna da Silva, 200, Sala 310, Gleba Fazenda Palhano, Londrina, PR, 86050-460, Brazil. Goarau operates a web platform that helps advertisers manage their TikTok Ads campaigns. Together, these companies are the controller of the account information described in this policy. For advertising data that our customers access through Goarau, our customer (the agency or advertiser that owns the connected TikTok ad accounts) decides what data is connected and why, and Goarau processes that data on the customer's behalf and under the customer's instructions.
You can reach us about anything in this policy at [email protected].
2. Scope and who the Service is for
Goarau is a business tool. Access is limited to subscribing customers, such as advertising agencies and professional media buyers. There is no public registration: user accounts are created by the Goarau team by invitation, and access can be requested by email at [email protected].
This policy covers information about the people who use the Service (our users) and data we access from TikTok on their behalf. It does not cover how TikTok itself processes data; that is governed by TikTok's own privacy policy and terms.
3. Information we collect
3.1 Account information
- Name and email address of each user, provided by the customer or by the Goarau team when the account is created.
- Password, which we never store in readable form. We store only a salted hash generated with PBKDF2.
- Account settings and preferences, such as the team or workspace the user belongs to, saved templates and automation rules.
3.2 Data from the TikTok API for Business
When you connect a TikTok For Business account, we receive an OAuth access token and use it to read and manage advertising data you have authorized. This is described in detail in Section 4, TikTok data.
3.3 Files you upload
Videos, images and product feed files you upload to build ads, creatives or catalogs are stored in Cloudflare R2 object storage within your account and are sent to TikTok only when you choose to use them in your ad accounts.
3.4 Technical and security information
To keep the Service secure and working, our infrastructure processes basic technical data such as IP address, browser type, request timestamps and error logs. We use this only for security, abuse prevention and troubleshooting, not for advertising or profiling.
3.5 Communications
If you email us, we keep the content of the conversation and your contact details so we can answer and keep a record of support requests.
We do not collect payment card numbers through the Service, and we do not knowingly collect sensitive personal data (such as health, religious or biometric data).
4. TikTok data
Goarau integrates with TikTok exclusively through the official TikTok API for Business. You connect your account by signing in on TikTok's own authorization page and approving the permissions requested by the Goarau app. Goarau never asks for, sees or stores your TikTok password. After you approve, TikTok redirects you to our callback at https://app.goarau.com/api/tiktok/callback and issues an access token to Goarau.
4.1 What we access
Depending on the permissions you approve, Goarau may access the following data for the ad accounts and Business Centers you authorize:
| Data | Why we access it |
|---|---|
| Advertiser and Business Center information (account IDs, names, status, currency, time zone, balance) | List your accounts, let you pick which to manage, and show balances and transactions for Business Center budget management. |
| Campaigns, ad groups and ads (settings, budgets, targeting, schedules, status) | Display your structure and let you create, edit, pause or activate items. Anything Goarau creates from a template is created paused until you activate it. |
| Reporting metrics (spend, impressions, clicks, conversions and similar) | Power your dashboard, reports, P&L views and the automation rules you define. |
| Creative assets (videos, images), identities and Display Cards | Manage your creative library and attach assets to ads you build. |
| Product catalogs, products and feeds | Create and maintain catalogs and feeds for catalog (DSA) campaigns. |
| Pixels and Events API configuration and diagnostics | Help you set up and verify pixels and event tracking. Goarau does not use your pixel or event data to build its own profiles of anyone. |
| Audiences and lookalike audiences (names, sizes, status) | Let you create and manage audiences for targeting. Goarau does not download the underlying lists of TikTok users. |
| Comments on your ads | Let you read, reply to, hide or moderate comments on your own ads. Comment text and public commenter names are shown only to your team. |
4.2 How we use TikTok data
- Only to provide the features of Goarau to the customer that connected the account: displaying, reporting on and managing that customer's own advertising.
- Write actions (creating or editing campaigns, uploading creatives, running automation rules, moderating comments, Business Center top ups or deductions) are carried out only when a user requests them or when a rule the user created and enabled is triggered. Financial operations always require explicit confirmation by the user.
- Data is isolated per customer. One customer's TikTok data is never visible to, mixed with or used for another customer.
- We do not sell TikTok data, use it for our own advertising, share it with data brokers, or use it to train machine learning models.
- We use TikTok data in accordance with the TikTok API for Business terms and developer policies.
4.3 How we store it
- OAuth access tokens are encrypted at rest using AES-GCM and are only decrypted on the server at the moment an authorized request is made to TikTok. Tokens are never exposed to the browser.
- Advertising data we keep (for example cached reports or catalog records) is stored in our database on Cloudflare D1, scoped to your customer account.
4.4 How long we keep it
- Access tokens: until you disconnect the TikTok account, until the authorization is revoked or expires, or until your Goarau account is closed. On disconnect, tokens are deleted immediately.
- Advertising data and uploaded files: for as long as your Goarau account exists, so your reports and history keep working. You can ask us to delete it sooner at any time.
4.5 How to disconnect and delete TikTok data
- Disconnect in Goarau: sign in at app.goarau.com and disconnect the TikTok account from inside the app. Your access tokens are deleted immediately and Goarau can no longer access that account.
- Revoke in TikTok: you can also revoke Goarau's access at any time in your TikTok For Business account or Business Center settings, where the apps you have authorized are listed. Once revoked, our token stops working.
- Request deletion: email [email protected] from your account email and ask us to delete the TikTok data associated with your account. We will delete it, including cached reports and uploaded files, within 30 days and confirm by email.
5. How we use information
- To create and manage user accounts and authenticate sign ins.
- To provide the Service: connect TikTok accounts, display dashboards and reports, and carry out the management actions you request.
- To run the automation rules you define (for example pausing an ad, adjusting a budget or sending you a notification when a condition you set is met).
- To secure the Service, prevent fraud and abuse, and diagnose errors.
- To respond to support requests and send essential service messages (such as security or account notices). We do not send marketing email without your consent.
- To comply with legal obligations and enforce our Terms of Service.
6. Legal bases for processing
Where laws such as the EU and UK GDPR or Brazil's LGPD apply, we rely on the following legal bases:
- Performance of a contract, to provide the Service to our customers and their users.
- Consent, for connecting your TikTok account through OAuth. You can withdraw it at any time by disconnecting or revoking access.
- Legitimate interests, to keep the Service secure, prevent abuse and improve reliability, balanced against your rights.
- Legal obligation, where we must keep or disclose information to comply with the law.
9. Data retention
- Account information is kept while your account exists.
- TikTok access tokens are deleted immediately when you disconnect a TikTok account or when your account is closed.
- Advertising data and uploaded files are kept while your account exists, and deleted within 30 days after a deletion request or account closure.
- Security logs are kept for a limited period needed for security and troubleshooting.
- We may keep limited information longer when the law requires it or to resolve disputes, and only for that purpose.
10. Disconnecting TikTok and deleting your data
You are in control of your data at all times:
- Disconnect TikTok from inside the Goarau app at app.goarau.com. Tokens are deleted immediately.
- Revoke access in your TikTok For Business account or Business Center settings, under the apps you have authorized.
- Delete your data or account by emailing [email protected]. We complete deletion within 30 days and confirm by email. To protect your account, we may ask you to confirm the request from your registered email address.
Deleting data in Goarau does not delete data stored by TikTok in your TikTok ad accounts, such as campaigns you created. You can manage that data directly in TikTok Ads Manager.
11. Security
We use technical and organizational measures designed to protect your information, including:
- Encryption in transit with HTTPS (TLS) on all pages and API requests.
- Encryption at rest of TikTok access tokens with AES-GCM.
- Passwords stored only as salted PBKDF2 hashes.
- Strict separation of data per customer account and access limited to authenticated users.
- Secure, HTTP only session cookies.
- Access to production systems restricted to authorized personnel who need it to operate the Service.
No system is completely secure. If we learn of a security incident that affects your personal information, we will notify you and the relevant authorities as required by law. Please report any suspected vulnerability to [email protected].
12. International data transfers
Goarau runs on Cloudflare's global network, so your information may be processed in countries other than the one where you live, including the United States and other countries with data protection laws different from yours. When we transfer personal data internationally, we rely on appropriate safeguards, such as the standard contractual clauses offered by our infrastructure provider, as required by the GDPR and the LGPD.
13. Your privacy rights (LGPD, GDPR, CCPA)
Depending on where you live, you may have the right to:
- Confirm whether we process your personal data and access a copy of it.
- Correct inaccurate or incomplete data.
- Request deletion of your data.
- Receive your data in a portable format.
- Object to or restrict certain processing.
- Withdraw consent at any time, for example by disconnecting TikTok, without affecting processing done before.
- Obtain information about the entities we share data with.
- Lodge a complaint with your data protection authority (for example the ANPD in Brazil or your local supervisory authority in the EU or UK).
California residents (CCPA/CPRA): you have the right to know what personal information we collect, use and disclose, to request deletion and correction, and not to be discriminated against for exercising your rights. Goarau does not sell or share personal information for cross context behavioral advertising, and does not use sensitive personal information for purposes that would require an opt out.
To exercise any of these rights, email [email protected]. We will respond within the time required by applicable law, and in any case within 30 days. If your data was connected by an organization (for example your agency), we may forward your request to that organization and assist it in responding.
14. Children
The Service is a professional tool for businesses and is not intended for anyone under 18 years of age. We do not knowingly collect personal information from children. If you believe a minor has provided us with personal information, contact us and we will delete it.
15. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page, and if the changes are significant we will notify users by email or inside the app before they take effect. Your continued use of the Service after the changes take effect means you accept the updated policy.
16. Contact us
For questions about this Privacy Policy, privacy requests or data deletion, contact Goarau at:
Goarau is an independent product and is not affiliated with, endorsed by or sponsored by TikTok. TikTok is a trademark of ByteDance Ltd.