NRTLY
Legal

Privacy Policy

Effective date: October 25, 2026 · Last updated: October 25, 2026

This Privacy Policy explains what information Nrtly collects, why we collect it, how we use and protect it, and the rights of the people whose data we process. It applies to the website at nrtly.com and to the Nrtly web application at app.nrtly.com (together, the "Service"), including all data we access through the TikTok API for Business.

The short version

  • Nrtly is the in-house tool that NRT SERVIÇOS ADMINISTRATIVOS LTDA uses to manage the TikTok Ads accounts of its own e-commerce brands (Livgom, Pirvano and Bolmar). Only NRT employees use it. There is no public sign up and nothing is sold.
  • We access TikTok advertising data only through TikTok's official OAuth flow, and only for ad accounts that belong to our own brands.
  • TikTok data is used only to operate and report on those ads. We never sell it, share it with third parties for their own use, or use it to train artificial intelligence models.
  • TikTok access tokens are encrypted at rest and deleted as soon as an account is disconnected.
  • Privacy questions and requests: privacy@nrtly.com.

1. Who we are

Nrtly ("Nrtly", "we", "us" or "our") is developed and operated by NRT SERVIÇOS ADMINISTRATIVOS LTDA, a company registered in Brazil under CNPJ 39.828.030/0001-26, with its registered office at Avenida Ayrton Senna da Silva, 200, Sala 310, Gleba Fazenda Palhano, Londrina, PR, 86050-460, Brazil ("NRT"). NRT is the controller of the personal data described in this policy for the purposes of Brazil's General Data Protection Law (Lei Geral de Proteção de Dados, Law No. 13.709/2018, the "LGPD").

The Service is built and maintained by NRT's own development team in Brazil. NRT's managing partner is Nelson Rodrigues Tempobono.

You can reach us at privacy@nrtly.com for data protection matters, at support@nrtly.com for anything else, or by phone at +55 11 4166-3452.

2. Scope: an internal tool

Nrtly is NRT's in-house tool to manage the TikTok Ads accounts of its own e-commerce brands: Livgom, Pirvano and Bolmar. It is used only by NRT employees who work on these brands' advertising. There is no public registration and nothing is sold: user accounts are created internally by NRT, and the Service is not offered to anyone outside the company.

This policy covers information about the NRT employees who use the Service and the advertising data we access from TikTok for NRT's own ad accounts. It does not cover how TikTok itself processes data, which is governed by TikTok's own privacy policy and terms.

3. Information we collect

3.1 Employee account information

  • Name and work email address of each NRT employee who is given access.
  • Password, which we never store in readable form. We store only a salted hash.
  • Sign in and activity records, such as when a user signed in and which management actions they performed, so that every change to an ad account can be traced to a person.

3.2 TikTok OAuth tokens

When an NRT employee connects one of NRT's TikTok For Business accounts, TikTok issues an OAuth access token to Nrtly. We store that token so the Service can make authorized requests to the TikTok API for Business. We never ask for, see or store a TikTok password.

3.3 Advertising data from authorized accounts

For the ad accounts that NRT authorizes, we access campaigns, ad groups and ads, creatives, performance metrics and audiences. This is described in detail in Section 4, TikTok data.

3.4 Technical information

To keep the Service secure and working, our infrastructure processes basic technical data such as IP address, browser type, request timestamps and error logs. We use it only for security and troubleshooting, never for advertising or profiling.

We do not collect payment card numbers through the Service and we do not collect sensitive personal data as defined by the LGPD.

4. TikTok data

Nrtly integrates with TikTok exclusively through the official TikTok API for Business. An authorized NRT employee connects an NRT ad account by signing in on TikTok's own authorization page and approving the permissions requested by the Nrtly app. TikTok then redirects to our callback at https://app.nrtly.com/api/tiktok/callback and issues an access token to Nrtly. We only connect ad accounts that belong to NRT's own brands.

4.1 What we access and why

Data Why we access it
Ad account information (account IDs, names, status, currency, time zone) List the ad accounts NRT has authorized and let an employee select which one to work on.
Campaigns, ad groups and ads (settings, budgets, targeting, schedules, status) Display the account structure and let employees create, edit or pause campaigns, ad groups and ads and adjust budgets. Everything created through Nrtly starts paused so a person can review it before it runs.
Creative assets (videos and images) Upload NRT's own creatives and attach them to ads.
Audiences (custom and lookalike audiences, names, sizes, status) Create and manage custom and lookalike audiences built from NRT's own first party customer data, collected by our brands with a valid legal basis. Nrtly does not download lists of TikTok users.
Reporting metrics (spend, impressions, clicks, conversions, CPA, ROAS and similar) Build daily internal dashboards so the team can follow the performance of each brand's ads.

4.2 How we use TikTok data

  • Only to operate and report on the advertising of NRT's own ad accounts.
  • Write actions (creating, editing or pausing ads, adjusting budgets, uploading creatives, managing audiences) are carried out only when an authorized employee requests them.
  • We never sell TikTok data, share it with third parties for their own purposes, combine it with data brokers, or use it to train artificial intelligence or machine learning models.
  • TikTok data is never used to build profiles of individual TikTok users.

4.3 Compliance with TikTok terms

We access and use TikTok data in accordance with the TikTok for Business Terms of Service, the TikTok for Developers Terms of Service and the applicable TikTok API for Business policies. If we stop using the integration, or if TikTok requires it, we delete the TikTok data we hold as described in Section 9.

4.4 Disconnecting TikTok

  • In Nrtly: an authorized employee can disconnect a TikTok account from inside the app at app.nrtly.com. The access token is deleted immediately and Nrtly can no longer access that account.
  • In TikTok: access can also be revoked at any time in the TikTok For Business account or Business Center settings, where authorized apps are listed. Once revoked, the token stops working.

5. How we use information

  • To create and manage employee accounts and authenticate sign ins.
  • To provide the Service: connect NRT's TikTok ad accounts, show dashboards and carry out the management actions employees request.
  • To keep a record of who changed what in each ad account.
  • To secure the Service, prevent misuse and diagnose errors.
  • To comply with legal obligations.

7. Service providers and sharing

We do not sell personal data and we do not share it with third parties for their advertising or marketing. Data is shared only in these cases:

  • TikTok: when an employee performs an action in an NRT ad account (for example creating a campaign or uploading a creative), the necessary data is sent to TikTok through the TikTok API for Business.
  • Cloudflare: Nrtly is hosted on Cloudflare (Workers for computing, D1 for the database and R2 for file storage). Cloudflare processes data only on our behalf, under its data processing terms, and does not use it for its own purposes.
  • Legal reasons: if required by law, court order or a valid request from authorities.

8. Storage and security

  • All traffic is encrypted in transit with HTTPS (TLS).
  • TikTok access tokens are encrypted at rest with AES-GCM and decrypted only on the server at the moment an authorized request is made to TikTok. Tokens are never exposed to the browser.
  • Advertising data is stored in our database on Cloudflare D1 and uploaded creatives in Cloudflare R2.
  • Passwords are stored only as salted hashes, and sessions use secure, HTTP only cookies.
  • Access is limited to authenticated NRT employees who need it for their work.

No system is completely secure. If a security incident may cause relevant risk or damage to data subjects, we will notify the affected people and Brazil's National Data Protection Authority (ANPD) as required by the LGPD.

9. Retention and deletion

  • TikTok access tokens are deleted immediately when a TikTok account is disconnected or access is revoked.
  • Advertising data and uploaded creatives are kept while NRT uses the Service for that ad account, and deleted within 30 days after the account is disconnected and deletion is requested, or when NRT stops using the integration.
  • Employee account information is kept while the employee has access and deleted after access ends, except for activity records kept for a limited period for security and audit purposes.
  • We may keep limited information longer only when the law requires it.

10. Your rights under the LGPD

Under article 18 of the LGPD, data subjects have the right to:

  • Confirm whether we process their personal data and access it.
  • Correct incomplete, inaccurate or outdated data.
  • Request anonymization, blocking or deletion of unnecessary or excessive data.
  • Request portability of their data.
  • Obtain information about the entities with which we share data.
  • Object to processing carried out on a legal basis other than consent, when it does not comply with the law.
  • File a complaint with the ANPD.

People located in other countries may also have rights under the data protection laws that apply to them, and we will honor those rights as required.

To exercise any of these rights, email privacy@nrtly.com. We may ask you to confirm your identity, and we will respond within the time required by law, and in any case within 15 days.

11. International data transfers

Nrtly runs on Cloudflare's global network, and the TikTok API for Business is operated by TikTok outside Brazil. Personal data may therefore be processed in other countries, including the United States. These transfers are made in accordance with articles 33 to 36 of the LGPD, relying on appropriate safeguards such as the standard contractual clauses offered by our providers.

12. Cookies

We use only a strictly necessary session cookie that keeps employees signed in to app.nrtly.com. We do not use advertising cookies, third party analytics cookies, tracking pixels or cross site trackers on nrtly.com or app.nrtly.com.

13. Children

The Service is an internal business tool used only by adult NRT employees. We do not collect personal data from children through the Service.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page, and significant changes will be communicated to the employees who use the Service.

15. Contact us

NRT SERVIÇOS ADMINISTRATIVOS LTDA
CNPJ 39.828.030/0001-26
Avenida Ayrton Senna da Silva, 200, Sala 310, Gleba Fazenda Palhano
Londrina, PR, 86050-460, Brazil
Privacy: privacy@nrtly.com
General: support@nrtly.com
Phone: +55 11 4166-3452

This policy is governed by Brazilian law. Any dispute will be settled in the courts of Londrina, State of Paraná, Brazil.

Nrtly is not affiliated with, endorsed by or sponsored by TikTok. TikTok is a trademark of ByteDance Ltd.