1. Who We Are
This Privacy Policy explains how New 8 Records Co., Ltd. (“LIVE CITY”, “we”, “us”) collects, uses, discloses, and protects personal data when you use the LIVE CITY OS platform at www.livecityhub.com and related products (the “Service”). We act as a data controller for personal data processed in connection with the Service, unless we are processing data on behalf of a brand or operator client under a separate Data Processing Agreement.
2. Personal Data We Collect
We collect personal data in the following categories:
- Account & profile data: name, legal name, role, email, phone number, profile picture, language preference.
- Authentication data: hashed passwords, OAuth identifiers (Google, LINE, TikTok), session tokens.
- Identity verification (KYC): for creators — national ID number, date of birth, address, payout bank details, government-issued document images.
- Commercial data: campaign briefs, contracts, invoices, GMV, conversion metrics, payout records, tax identifiers.
- Content data: photos and videos uploaded for QC, campaigns, or content scheduling, including computer-vision analysis results.
- Usage & device data: log files, IP address, browser and OS version, referring URL, pages visited, actions taken, error reports.
- Cookies & local storage: authentication cookies, language preference, brand-selector state, anti-CSRF tokens.
- Communications: messages you send us, support tickets, in-product notifications.
3. Data From Third-Party Integrations (TikTok, Google, LINE, Meta, Shopify)
When you connect a third-party account to the Service, we access only the data necessary for the feature you have requested, in accordance with the scopes you approve. For TikTok integrations this may include:
- your TikTok open_id, union_id, display name, avatar, and bio;
- your public video metadata (titles, descriptions, cover images, view counts, like counts, share counts) when explicitly authorised;
- creator-account information (follower count, video count) used to compute performance scores;
- OAuth access tokens, refresh tokens, and token expiry timestamps, stored encrypted at rest.
We do notaccess your TikTok private messages, draft videos, or any data outside the scopes you approved. You can revoke TikTok’s connection at any time from your TikTok Apps & Services settings, or from inside the LIVE CITY Service under Settings → Connections.
4. How We Use Personal Data
We process personal data to:
- operate, secure, and improve the Service;
- authenticate you and maintain your session;
- verify your identity (KYC) and prevent fraud;
- match creators to brand campaigns and compute performance scores;
- calculate payouts, issue invoices, and file the required withholding-tax and e-Tax documents;
- publish or schedule content to your connected third-party accounts at your direction;
- send transactional notifications (e.g. campaign approvals, payout receipts);
- respond to support requests and enforce these Terms;
- comply with applicable law and lawful requests from public authorities.
5. Legal Bases (GDPR / PDPA)
We rely on the following legal bases:
- Performance of a contract — to deliver the Service you signed up for;
- Consent — for sensitive data, marketing, or optional analytics; you may withdraw consent at any time;
- Legal obligation — tax filings, KYC, anti-fraud, and lawful requests;
- Legitimate interests — service security, abuse prevention, and product improvement, balanced against your rights.
6. How We Share Personal Data
We share personal data only when necessary:
- With brands and operators when you accept a campaign — limited to data needed to execute the campaign;
- With third-party platforms you have connected (TikTok, Google, LINE, Meta, Shopify) for the features you have enabled;
- With service providers who help us operate the platform — hosting (Vercel, Neon), email delivery (Resend), push notifications (Firebase), rate limiting (Upstash), AI analysis (Google Gemini), payment partners — all bound by confidentiality and data-protection terms;
- With public authorities when required by law or to protect rights, property, or safety;
- In a merger, acquisition, or asset sale, subject to continued protection of your data.
We do not sell personal data, and we do not share data with third-party advertising networks for cross-context behavioural advertising. Data accessed through TikTok integrations is used only for the features you authorised and is never shared with parties other than as expressly stated above.
7. Data Retention
We retain personal data only for as long as necessary to provide the Service and to comply with our legal obligations. Account data is retained while your account is active and for up to 12 months afterwards (or longer where law requires, e.g. 5 years for tax records). OAuth tokens are deleted within 30 days of account closure or revocation of the integration. KYC documents are retained for the period required by Thai anti-money-laundering regulations.
8. Your Rights
Subject to applicable law, you have the right to:
- access the personal data we hold about you;
- request correction of inaccurate data;
- request deletion of your data (“right to be forgotten”);
- restrict or object to certain processing;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, without affecting prior processing;
- lodge a complaint with your local data-protection authority (in Thailand, the PDPC).
To exercise your rights, email dpo@livecityhub.com. We will respond within 30 days. For account deletion, you may also use the self-service Settings → Delete my account control inside the Service.
9. Security
We protect personal data with administrative, technical, and physical safeguards, including encryption in transit (TLS 1.2+), encryption at rest for credentials and tokens, role-based access controls, audit logging, and constant-time HMAC verification on webhook signatures. No system is perfectly secure; in the event of a breach affecting your data we will notify you and the relevant authority as required by law.
10. International Transfers
We host data primarily in regions covering Asia-Pacific and the United States. Where personal data is transferred outside your country of residence, we rely on lawful transfer mechanisms such as Standard Contractual Clauses or the recipient’s adequacy decision.
11. Children
The Service is not directed to children under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us and we will delete it.
12. Cookies & Similar Technologies
We use first-party cookies to keep you signed in, remember your preferences, protect against CSRF, and measure service performance. We do not use third-party advertising cookies. You can configure your browser to block or alert you about cookies; some features of the Service may not function correctly without them.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be posted on this page with a new effective date and, where appropriate, communicated through the Service. Your continued use of the Service after the changes take effect constitutes acceptance of the revised policy.
14. Contact Us
New 8 Records Co., Ltd.
Bangkok, Thailand
General privacy enquiries: privacy@livecityhub.com
Data Protection Officer: dpo@livecityhub.com