AtlasCore Market

TikTok Shop Legal addendum · Legal version v1 · Last updated: July 13, 2026

TikTok Shop DPP / DSPR Compliance

Last updated: August 24, 2026

This addendum describes AtlasCore Data Protection Program (DPP) controls for TikTok Shop seller data under TikTok Shop Developer Policy and the US Data Security Questionnaire (DSPR).

Independent application status

AtlasCore is an independent software application. TikTok and related marks are trademarks of TikTok Inc. AtlasCore is not sponsored, endorsed, or affiliated with TikTok.

Retention schedules

AtlasCore retains encrypted TikTok buyer and shipping fields only as long as required for authorized fulfillment:

- 30-day post-delivery clock: After a TikTok order reaches a terminal status — `DELIVERED`, `COMPLETED`, or `CANCELLED` — cached buyer/shipping PII is redacted 30 days after `fulfilled_at`. `fulfilled_at` is first stamped from Partner `shipped_time` or `delivery_time` (never `create_time` or `paid_time`). When the order later becomes `DELIVERED` or `COMPLETED`, a prior shipment stamp is upgraded to the genuine `delivery_time` / `delivered_time`.

  • 90-day unfulfilled ceiling: Open, shipped, or in-transit orders (`IN_TRANSIT`, `AWAITING_SHIPMENT`, `AWAITING_COLLECTION`, `SHIPPED`) are governed by a 90-day creation ceiling (order date / first persisted timestamp), not the 30-day fulfillment clock. The 30-day clock requires `fulfilled_at` and does not fall back to `create_time` or `paid_time`. Cancelled orders (`CANCELLED`, `CANCELED`) that have no `fulfilled_at` also use this 90-day creation ceiling.
  • Anti-rehydration: After DPP redaction, later TikTok order syncs do not overwrite buyer name, phone, or shipping columns.

The TikTok-owned retention worker implements these clocks in `tiktok_pii_retention_service`.

Authorized write APIs

AtlasCore uses TikTok Shop write endpoints only after seller OAuth consent and only for operational features the seller enabled:

- Inventory PUT: Confirmed/paid order placement (`AWAITING_SHIPMENT`) decrements available stock at most once per order SKU. A durable `_inventory_adjusted_order_id` marker is committed per SKU immediately after a confirmed successful PUT, so a transient hook timeout cannot drop the success record.

  • Package and tracking writes: Authorized fulfillment creates or updates TikTok packages and shipping/tracking information for the seller’s own orders.

Webhook minimization

Inbound TikTok Shop notifications at `POST /api/v1/tiktok/webhooks` are HMAC-SHA256 verified. Operational topics require a declared `tts_notification_id`. The durable webhook ledger stores an allowlisted operational dictionary (event identity, shop, order, SKU/quantity, package/tracking identifiers) — not unrestricted raw buyer or shipping payloads.

Scoping model

- B2C base scope: TikTok Shop credentials, catalog, and orders belong to the signed-in seller (`user_id`). Routes under `/api/v1/tiktok/*` authenticate that user and do not treat TikTok rows as tenant-global.

  • Workspace overlays: When an enterprise workspace is bound, optional `X-Tenant` (or equivalent tenant slug) further partitions TikTok account and order rows. Absence of a workspace overlay keeps the personal/B2C scope.

Authorized PII unmask

Buyer name, phone, and shipping address lines remain masked by default. An explicit `include_pii=true` request from an authorized role returns only those recipient fields — never a full Partner order blob.

Seller controls

- Disconnect TikTok Shop in AtlasCore to stop sync and purge stored credentials and cached TikTok data for the active seller (and workspace overlay, when present).

See TikTok Shop API Compliance, TikTok Shop Data Handling, our Privacy Policy, and Disconnect Marketplace.