1. Who operates Pitmetric
WEBORATORY CAPITAL S.R.L. is the data controller and operator of https://pitmetric.com. We are established in Romania, European Union. CUI: 43276159; VAT ID: RO43276159; Trade Register: J2020014619403 (formerly J40/14619/2020).
Registered office: Intrarea Mesteacănului nr. 16U, Otopeni, Ilfov, Romania. Correspondence address: Intrarea Mesteacănului nr. 16U, Casa 1, Otopeni, Ilfov, Romania.
For privacy questions or requests, email contact@weboratory.ro. This policy addresses the GDPR and applicable Romanian data protection and electronic communications rules, including Law 190/2018 and Law 506/2004 where relevant.
2. The website today
Pitmetric is in development. This public marketing website explains the planned product and accepts inquiries and early-access interest when email delivery is enabled. It does not offer accounts, paid subscriptions, social account connections, or live AI analytics. All performance visuals use illustrative data.
Simply visiting does not authorize access to your social accounts. The separate application at app.pitmetric.com has its own account and authorization controls when enabled. Its implemented processing is described in the application section below; its availability depends on deployment and platform permissions. This notice does not claim that TikTok has approved the application.
3. The separate Pitmetric application, when enabled
This section applies when you use app.pitmetric.com. Signing in uses your email address and a six-digit, single-use code sent through Resend. The server stores a keyed hash of the code for up to ten minutes, and a hashed session identifier for up to seven days. Your browser receives an essential HTTP-only session cookie. Authentication and service-security records support access to the service you request and abuse prevention; signing in does not subscribe you to marketing.
You may separately authorize a TikTok connection through TikTok’s official consent page. Basic profile access is required; profile details, account statistics, and public-video access depend on the scopes actually granted. Data can include platform identifiers, display name, avatar, profile details and counts, and available public-video identifiers, titles, captions, publishing dates, duration, covers, links, views, likes, comments counts and shares. We do not request publishing access or collect private messages, comment text, retention or watch-time metrics through this integration. OAuth credentials are encrypted on the server, and are not provided to the browser or AI provider.
Application data is stored separately in MongoDB on our DigitalOcean backend. Resend receives the email delivery information needed to send sign-in codes. The application hosting provider, operational backup arrangements, processing locations and applicable transfer safeguards must be identified and assessed before live access is enabled; you can request current details from our privacy contact. This notice does not represent a completed production launch or a guarantee about provider retention.
Current connected-account metadata and posts remain while the account is connected. Metric and account snapshots expire after the configured retention period, shown in application Settings (365 days by default); security audit records expire after 30 days. Database expiry cleanup is asynchronous. Saved AI analyses remain until you remove them, disconnect an account, or delete your Pitmetric account. Short-lived pseudonymous rate-limit records expire automatically. Hosting logs, backups and provider records have separate operational retention arrangements.
AI analysis is optional and requires a separate affirmative choice. The request identifies the configured provider before you submit. Up to 100 recent videos’ titles, captions, dates, duration and performance metrics may be sent for analysis. Email addresses and OAuth credentials are excluded. The default integration supports OpenAI; the operator must identify any alternative provider before enabling it. Metadata may itself contain personal information. Provider practices and transfer safeguards must be assessed before activation; we do not promise that a provider has no retention. You can delete saved analyses in Settings. Suggestions concern content planning, require your judgment, and do not constitute decisions with legal or similarly significant effects.
Disconnecting immediately hides the connection’s analytics and cancels further synchronization. Deleting your Pitmetric account signs out existing sessions and prevents further sign-in while deletion is pending. A background job starts cleanup after a four-minute allowance for in-flight requests, requests TikTok revocation and removes local account data. Temporary provider failures are retried; local tokens and data are purged after a seven-day retry allowance even if remote revocation cannot be confirmed. These jobs require an operating worker and may be delayed by outages; the operator monitors the backlog. You may also revoke Pitmetric directly in TikTok’s app-permission settings or contact our privacy address. Mandatory privacy rights continue to apply.
4. Information we receive
Our forms receive your email address, optional role, consent selection and, for contact inquiries, your name and message. Please avoid including sensitive personal information or information about other people.
The hosting service necessarily receives technical request information, such as IP address, requested URL, browser headers and timing, to deliver and protect the website. Hosting logs and retention depend on the selected deployment provider. We do not deliberately log form contents or email addresses in application logs. A network identifier derived by hashing your IP address with a secret key is used for rate limiting when configured. Production limiting uses Upstash Redis and expires the stored identifier and request count after ten minutes.
5. Early-access interest
If configured, the early-access form sends your email, optional role, and a record of the consent text and submission time to our business inbox via Resend. This records interest only: it does not create an account or guarantee an invitation or launch date.
When delivery is not configured, the form reports that submissions are unavailable rather than claiming your interest was saved. You can contact us by email instead. Failed requests are not maintained in a website signup database.
6. Purposes and lawful bases
We use early-access information to communicate about launch and access on the basis of your consent (GDPR Article 6(1)(a)). You can withdraw consent by contacting us or following an unsubscribe method included in launch communications. Withdrawal does not affect earlier lawful processing.
We use contact details and messages to respond to your request, relying on steps at your request before entering a contract where applicable (Article 6(1)(b)), or our legitimate interest in handling business correspondence (Article 6(1)(f)). Checking the contact-form notice acknowledges this processing; it does not subscribe you to marketing.
We may process limited technical data for our legitimate interests in website delivery, security, abuse prevention and legal claims, taking your rights into account. We process information to meet legal obligations when required (Article 6(1)(c)). We do not sell form submissions or use them for advertising profiles.
8. Future accounts and authentication
The future product may process account identifiers, contact information and authentication-related records needed to provide access. No account registration or authentication operates on this website. Specific account handling, security controls and lawful bases will be disclosed before account creation becomes available.
10. OAuth tokens and API access
Future integrations may require access tokens, refresh tokens, granted scopes and expiry information. These are credentials that enable authorized API requests. We intend to restrict access and use server-side protection appropriate to the risk before integrations launch.
The marketing website does not collect OAuth tokens or social platform passwords. We will not ask you to send passwords or tokens through the contact form.
12. AI-assisted processing
No submitted form information or connected social data is sent to an AI model by this marketing implementation. The planned product may use selected AI providers to identify content patterns and suggest possible next steps using authorized information.
Before introducing such processing, we will explain the data involved, providers and their relevant practices, legal basis, safeguards and user choices. We do not make an unverified promise that AI providers never retain data or use it for their own purposes. Planned recommendations are intended to assist human judgment, not make decisions with legal or similarly significant effects.
13. Service providers and disclosure
When enabled, Resend processes form-delivery data to send submissions to our designated inbox. Upstash Redis processes the hashed network identifier and request count for production rate limiting. Our hosting provider processes website requests, and our business email provider processes correspondence. These providers may use subprocessors under their applicable arrangements. The actual hosting and mailbox providers must be confirmed for deployment; you may ask us for current details.
We may disclose information where lawfully required, to protect rights or investigate abuse, or in a business reorganization subject to applicable safeguards. Future infrastructure or AI processors will be identified before product processing launches. We do not claim that personal data is never shared.
14. International transfers
Providers may process information outside Romania or the EEA. We do not claim that all data remains in the EU. Before using a provider for restricted transfers, the operator must assess the locations and apply a lawful transfer mechanism, such as an adequacy decision or appropriate safeguards including standard contractual clauses, with supplementary measures where necessary.
Contact us for information about applicable safeguards and how to obtain a copy. Future provider choices and transfer arrangements will be reflected in an updated notice.
15. Storage and security
The website uses server-side form validation, same-origin request checks, anti-spam measures, limited rate limiting and security headers. Email credentials stay on the server. The application does not store a signup database. Successful submissions are delivered to the operator’s inbox.
No internet system is completely secure. Access permissions, provider configuration, mailbox security and deployment monitoring are operational responsibilities. We do not promise absolute security or unverified certifications.
16. Retention and deletion
We retain early-access correspondence while needed to manage interest and launch communications, or until consent is withdrawn, subject to a limited record needed to respect your choice or meet legal obligations. Contact correspondence is retained as necessary to resolve the inquiry and address applicable legal or business record requirements.
The operator reviews retention against purpose, applicable law and provider settings; there is no automatic deletion scheduler in this marketing implementation. Requests may involve the operator’s mailbox and provider records. We do not promise a specific deletion time that has not been implemented. Retention for the separate application, when enabled, is described in its section above.
17. Future disconnection and revocation
There are no active social connections on this website. When connections launch, we intend to provide disconnection controls and explain how to revoke access in the relevant platform’s settings. Revocation would stop further authorized access but does not itself erase every previously processed record.
A separate deletion request may be needed for retained information, subject to applicable legal requirements and platform policies. Actual disconnection, token revocation and deletion procedures will be published with the integrations.
18. Your privacy rights
Subject to applicable conditions, you may request access to your personal information, correction, erasure, restriction of processing, or portability. You may object to processing based on legitimate interests and to direct marketing. Where we rely on consent, you can withdraw it at any time.
Email our privacy contact to exercise your rights. We may request proportionate information to verify identity. We respond within the periods required by applicable law, and explain any lawful restriction or extension. Your use of this website does not waive mandatory privacy rights.
If another jurisdiction provides applicable privacy rights, contact us to exercise them. We will assess requests under the law that applies to the processing.
19. Complaints and supervisory authority
You may contact us to raise a concern and may also complain to a competent supervisory authority. In Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), at dataprotection.ro. You may also contact the authority in your EEA country of habitual residence or work.
20. Children and eligibility
This website and early-access communications are intended for people aged 18 or older acting for themselves or an organization. We do not knowingly solicit children’s information. If you believe a child provided information, contact us so we can investigate and take appropriate action.
21. Updates and contact
We may revise this notice when the website, providers or planned product change. The date above identifies the latest revision. Material changes will be communicated appropriately. For questions, access, correction, deletion or withdrawal requests, email contact@weboratory.ro or write to our correspondence address above.
Reference information: European Commission information on individual rights and EDPB guidance on international transfers.
11. Future social analytics information
Depending on permissions and official API availability, future processing may include authorized account or channel identifiers, profile information, published-content metadata and performance metrics such as views and engagement. Available metrics vary by platform and account type.
We do not claim access to private messages, unavailable audience information or metrics an API does not provide. The product notice will specify the categories actually processed, the purpose of each, and relevant retention periods before collection begins.