Privacy Policy

Last updated 10 October 2026

Agency Battles is a scheduling tool for TikTok LIVE creator agencies, operated at agencybattles.co.uk and as an app for iPhone and Android. This page explains what it stores, who it is shared with, and how to have it removed. It is written to describe the software as it actually behaves.

Agency Battles is a trading name of TEKSPERT LTD, a company registered in England and Wales (company number 16711813), registered office 110 Pall Mall, Chorley, PR7 2LB. TEKSPERT LTD runs the service and is the “controller” of the personal information described on this page under UK data protection law, except where this page says an agency is responsible for it. “We” and “us” on this page mean TEKSPERT LTD.

Who this covers

Two different groups of people appear in Agency Battles, and it matters which one you are:

• People with an account — agency owners, managers and creators who sign in.
• People without an account — creators added to a roster by their agency who have never signed in, and opponents from other agencies who are recorded only by their TikTok handle. If that is you, the agency that entered your details is responsible for them, and the quickest route to having them changed or removed is to ask that agency. You can also contact us directly using the details below.

What is stored

If you are agency staff (owner or manager)

• Your name and email address.
• A bcrypt hash of your password, at cost factor 12. Your password itself is never stored, never logged, and cannot be recovered from the hash — only replaced.
• Your role, the agency you belong to, whether your account is active, the time you last signed in, and the last time you used Agency Battles. Your agency owner can see when each member of the team last used it.
• A record of significant actions you take — proposing, accepting or declining a battle — including your name and the time.

Owners and managers can also, if they choose, connect their own TikTok account in Settings. Before anything is saved, you are shown which TikTok account you signed in to, and asked to confirm it is yours. Connecting it:

• stores the same TikTok details a creator’s sign-in does, listed in the next section, including the encrypted tokens;
• adds you to your agency’s roster as a creator, so you can be booked into battles — or, if your agency already had a roster entry for your TikTok username, makes that entry yours;
• makes your TikTok username your chat username;
• lets you log in with TikTok as well as with your email and password.

Your account name stays the one you signed up with; TikTok never renames it. You can disconnect TikTok in Settings at any time. That withdraws our access on TikTok and deletes the TikTok details and tokens from your account. Your roster entry and its battles stay with your agency, as any creator’s do.

If you sign in with TikTok

Creators do not have a password here, and we do not ask for an email address. You sign in with TikTok — as do owners and managers who have connected it — and we receive only what you agree to share on TikTok’s own consent screen:

• Your TikTok account identifier, display name and profile picture.
• Your username. For a creator, it is how we find the roster entry your agency created for you; if no agency has added your username, you are told to contact them and no account is created. For everyone, it becomes your chat username — see Your username below.
• Your TikTok bio and whether your account is verified, which are shown on your chat profile. You can replace the name and bio shown in chat with your own; your TikTok ones are kept alongside, and come back if you clear yours.
• Your follower count, which the battle matcher uses to pair opponents.
• Access and refresh tokens, so the connection keeps working without asking you again. These are encrypted before they are stored using AES-256-GCM, and are never written down in readable form.

The daily refresh. About once a day, the server uses your stored tokens to ask TikTok for the same profile details again, so a new username, name, bio or picture reaches Agency Battles without you having to sign in. Nothing else is read and nothing is posted. If TikTok stops accepting the tokens — they have expired, or you removed our access — we delete them, and your chat username with them, until you next sign in with TikTok.

You can disconnect at any time from your TikTok account settings. TikTok tells us immediately, and we delete the tokens and your chat username. If TikTok is your only way in, you are signed out as well; an owner or manager stays signed in and can still use their email and password. Your agency’s own record of you — your roster entry and your battles — belongs to them and stays until they remove it.

As with staff accounts, we keep the time you last signed in and the last time you used Agency Battles; your agency owner can see when you last used it.

Your username, and other agencies

Your chat username is your TikTok username, exactly as TikTok confirms it to us from your own account. Nobody can type one in — not you, not your agency — and anybody without a connected TikTok simply has none.

• It is shown beside your chat name — in chats, on your profile card and on friend requests — to the people you chat with, at your agency and at others, and to the owners and managers who oversee those chats.
• Anyone using chat on Agency Battles, at any agency, can find you by entering your exact username, as long as your agency has chat. The answer shows your chat profile — name, username, picture, bio and verified tick — and the name of your agency, and lets them send you a friend request, which you can accept or decline. Nobody can browse a list of people or search by name.
• It follows TikTok. If you change your username there, the new one replaces it here, and a username TikTok has not confirmed for a week can no longer be found.

If your agency has chat

• Your messages; the photos, videos and audio files you send, with their file names; when each message was delivered and read; your friend requests and friends; who you have blocked; and any message you report.
• The chat name and bio you set, if you set your own, and when you accepted the chat notice.
• Who at the agencies can read a chat. The people in it, and the owners and managers who oversee it: an agency owner can read every chat that includes somebody from their agency, and a manager every chat a creator of theirs is in, except one the owner started. The chat notice sets this out for your role, and you have to accept it before you can use chat.
• Deleting a message hides it from the people in the chat. Its text is kept, and the owners and managers who oversee the chat can still read it, until the chat itself is deleted.
• Reporting a message sends a copy of that one message to Agency Battles support, and to your agency owner unless the report is about them. Agency Battles reviews every report against the rules in our Terms of Service. A message that breaks them is removed — hidden from everyone, its text kept only so that a removal can be undone — and the account responsible is suspended, from chat or from the service altogether. A chat suspension is stored with its reason.
• A chat is deleted 12 months after its last message, with everything in it. A report is kept until it is reviewed, and for 12 months after that.

Support tickets, posters, frames and announcements

Support tickets. What you write in a ticket, the screenshots you attach, who has read each reply, and the ticket’s history. When Agency Battles answers, the person who raised the ticket, the agency’s contact for it and the agency’s owners are emailed.

Posters, frames and announcements. Poster templates and the artwork uploaded for posters and profile frames; the posters made from them, which show creators’ names, usernames and pictures; and announcements, with the name of whoever wrote them.

Everything uploaded — screenshots, artwork, and the photos, videos and audio sent in chat, from the website or the app — is re-encoded by the server before it is stored. That removes the hidden details a phone or camera writes into a file, including where a photo was taken.

About your agency

• Its name, contact email address, timezone, country and description.
• Its subscription status, plan, billing period and trial dates, together with Stripe customer and subscription identifiers.
• Internal notes written by platform administrators. These are used for support and are not shown to the agency; you can ask for a copy.

About creators on a roster

• Display name, TikTok handle, assigned manager, tier, 18+ battle preference and free-text notes.
• Public TikTok profile information: display name, follower count, verified status, profile picture, bio and TikTok’s own account identifier. This is public information, retrieved as described under TikTok profile data below.
• Until a creator signs in, the roster entry’s name, picture and bio are what the battle and group chats they are added to show for them, to everybody in that chat — including the other agency’s staff in a battle chat.
• Battle requests — when a creator is available, their preferred start times and preferences, and the score they expect — and scheduled battles, their times, results, and any notes attached to them.

About people who are invited but never join

An invitation stores the email address and name it was sent to, plus a single-use token, until it is accepted, revoked or expires.

The Agency Battles app

Agency Battles is also an app for iPhone and Android. It signs in to the same account and shows the same agency, and everything above applies to it. This section covers what is different on a phone.

What the app keeps on your phone. Your sign-in, in the phone’s secure storage (the Keychain on an iPhone; on Android, storage encrypted with a key held in the Android Keystore), marked to stay on this phone: it is never synced or restored to another one, and signing out deletes it. A random install identifier the app makes the first time it runs — it is not your phone’s advertising identifier or any other identifier the phone provides, and it is kept when you sign out, so the app can recognise the same phone. On an iPhone, the secure storage it lives in can keep it even if you delete and reinstall the app. Copies of pictures and files you have opened, which are deleted when you sign out. A few settings, such as the admin console’s colour theme.

What the app sends when you sign in. The install identifier, whether the phone is an iPhone or an Android, the app’s version and the phone’s model name — “iPhone 15”, for example. They are stored with that sign-in, so it can be recognised and ended, and so an app that is too old to work safely can be asked to update. Every request the app makes also says which version it is. A sign-in the app has not used for 60 days ends by itself; for platform administrators, after 7 days.

Camera, photos and microphone. The app asks for each only when you use the feature that needs it, and you can say no:

• the camera, to take a photo or film a video to send in a chat, or to take a photo for a profile picture;
• your photo library, to choose the pictures or videos you want to send in a chat, add to a support ticket, or use for a poster, a frame or a profile picture. Only what you choose is read;
• saving a poster or picture asks only to add to your library, never to read it;
• on iPhone, the microphone records the sound of a video you film in the app to send in a chat. The app never records sound on its own. On Android, videos are filmed with your phone’s own camera app.

Anything you upload is re-encoded before it is stored, as described above, so the location a phone can write into a photo or video is never kept.

The profile picture maker works entirely on your device. In the app and on the website alike, the photo you choose is combined with your agency’s frame on your phone or in your browser, and you save or share the result from there. It is never uploaded.

Face ID and fingerprints. Platform administrators confirm it is them, with Face ID, a fingerprint or the phone’s passcode, before acting on someone’s behalf or deleting a record. The phone does the check and tells the app only whether it passed; no face or fingerprint data reaches the app or us.

Signing in with TikTok opens TikTok’s own page in your phone’s sign-in sheet. What you type there goes to TikTok, not to us; we receive only what is described above.

Push notifications

If you allow notifications, the app registers with Expo’s push service and receives a push token — an address for this app on this phone. We store the token with your account, the type of phone and the install identifier, and delete it when you sign out on that phone, or your account is switched off or deleted.

Each notification travels from our server through Expo to Apple’s push notification service on an iPhone, or Google’s Firebase Cloud Messaging on an Android, which deliver it to your phone. It carries a title — usually who it is from, or what it is about — a link to the right screen in the app, and our internal identifiers. What a message or notification actually says is included only if you turn on Show message previews in the app’s notification settings. It is off to begin with, so a chat alert says only who it is from. Notifications waiting to be sent are deleted 7 days after they are sent, and delivery receipts after a day.

You choose which kinds of notification you get in the app’s notification settings, and you can turn them all off in your phone’s own settings.

What is not collected

This list is as much a part of the policy as the one above, and it is deliberately specific:

• No third-party analytics, tracking, advertising or session replay. There is no Google Analytics, no advertising pixel, no heatmap and no third-party error reporting, on the website or in the app. None of these is installed. We do keep the last time each account used Agency Battles, as described above; it never leaves our server.
• IP addresses are not kept in the database. Your IP address is used briefly, in memory, to slow down repeated attempts to sign in, sign up or use an invitation or reset link. The web server’s access log records each request to the website and the app: your IP address, the time, the address requested — including anything you type into a search — and the details your browser or the app sends with it, such as its name and version. The log is kept for about five weeks, for security, and is also used to count visits to the website in aggregate statistics. It is used for nothing else.
• No payment card details. Card numbers are entered on Stripe’s own pages and never reach this application or its database.
• Email only about your use of the service. We email you to invite you to join an agency, and about your agency’s support tickets. If you signed up an agency yourself, we also send up to three getting-started reminders, normally in its first week — on days 1, 3 and 7 — while it has no creators; each has a one-click unsubscribe link, and they stop as soon as a creator is added. The same reminders appear as notifications in Agency Battles, and unsubscribing stops those too. There is no newsletter. When you ask to delete your account, our support team is emailed so that the deletion can be completed.
• Nothing is posted to TikTok on your behalf. The connection is read-only: no permission to publish, comment or message is requested, and none is held.
• No sale or sharing of personal data with advertisers, data brokers or any other third party, for any purpose.

Cookies and browser storage

The application sets three cookies, all strictly necessary and therefore not subject to consent.

bs_session is what keeps you signed in. It is HttpOnly (unreadable by JavaScript), SameSite=Lax, and marked Secure in production. It holds a signed token containing internal account identifiers and nothing else, and it expires after 30 days, or after one hour where an administrator is acting on an agency’s behalf.

bs_tiktok_state exists only during a TikTok sign-in or connection. For ten minutes it holds a signed random value, so that the reply coming back from TikTok can be checked as genuinely belonging to the sign-in you started. When an owner or manager is connecting TikTok, it also carries their internal account identifier and when their session began, so the reply can only complete in that same session. It is deleted as soon as you return.

bs_tiktok_link exists only while an owner or manager is confirming a TikTok connection, for at most ten minutes. It holds, encrypted with AES-256-GCM, the tokens and profile details TikTok has just sent, so that the confirmation page can show exactly which account is about to be connected before anything is saved. It is deleted when you confirm or cancel.

No third-party cookies are set on this domain. The administrator console stores a colour-theme and sidebar preference in your browser’s local storage; neither is transmitted anywhere.

Who data is shared with

These services, and no others apart from the two named just below the table:

tiksign is our own lookup service. To read a public profile it may pass the handle — and only the handle — to TikTok’s public pages or to EulerStream, a TikTok data provider. Email is sent from our own mail server to your email provider.

Apart from TikTok’s own sign-in page, which you visit to sign in or connect, and Stripe’s own pages, which you visit to pay or to manage your subscription, Google Fonts is the only third party your browser contacts directly — with one exception: the page where an owner or manager confirms connecting their TikTok shows that account’s picture straight from TikTok’s servers, without telling them which page asked for it. Everything else happens server to server.

The app talks only to agencybattles.co.uk, apart from TikTok’s sign-in page, Expo, Apple and Google for notifications, and the TikTok picture on the confirmation screen described above. On iPhone, it also checks it is online by asking Google’s server clients3.google.com for an empty reply; Google receives your IP address and nothing that identifies your account. The pages of this website that open in your phone’s sign-in sheet while you sign in with or connect TikTok are part of the website, and load their fonts from Google Fonts like any other page.

TikTok profile data

When a TikTok handle is added to a roster, the server asks a separate service, tiksign, for that account’s public profile — display name, follower count, profile picture and bio. The only thing sent is the handle itself. No name, email address, IP address or session information is forwarded.

For anybody who signs in with TikTok or connects it, the same details come from TikTok directly instead, at sign-in and at each daily refresh, as described above — including a copy of their own profile picture, which the server fetches from the link TikTok gives it.

Profile pictures are fetched by the server and re-served from this domain, so your browser does not contact TikTok or its content delivery network while using Agency Battles, apart from the one confirmation page described above. Only information TikTok already publishes on a public profile page is retrieved through tiksign. Agency Battles is not affiliated with, endorsed by, or operated by TikTok or ByteDance.

Where data is held

Data is stored in a self-hosted database on servers in the United Kingdom. No managed third-party database service is used. Stripe processes payment data under its own privacy policy and may transfer it internationally. Push notifications pass through Expo in the United States and through Apple or Google, which may process them outside the United Kingdom.

How long it is kept

• Account and roster data is kept for as long as the agency uses the service.
• When an agency is deleted, its users, creators, battles, invitations, notifications and subscription records are deleted with it, and so is every chat it took part in.
• Chats are deleted 12 months after their last message. Chat reports are deleted 12 months after they are reviewed.
• Notifications waiting to be pushed are deleted 7 days after sending, and delivery receipts after 24 hours.
• A sign-in on the app ends after 60 days without use (7 days for platform administrators). Its record — the phone’s model name, the app’s version and the install identifier — stays with your account until the account is deleted.
• The web server’s access log is kept for about five weeks.
• Messages you sent stay in the chats you sent them to, under the name you had, until those chats are deleted — including after your account is deleted.
• Support tickets, with their messages and screenshots, and the announcements an owner or manager writes belong to the agency, and stay with it — under the name of whoever wrote them — until the agency is deleted. So do poster templates and frames, whoever uploaded them. When the agency is deleted, their records go with it, but the image files — screenshots, artwork and the posters made from it — can stay on our server, where nothing in Agency Battles links to them or can show them; write to us to have them removed.
• The audit log records significant changes and actions in Agency Battles — such as changes to accounts, teams, creators and settings, chat reports and blocks, and support tickets — with the name and email address of whoever made each one, and what changed. Each entry is kept for two years, for security and to settle disputes, including after the account or agency it mentions has been deleted, and is then deleted.
• Billing history — the agency’s name, its plan changes and the name of whoever made each one — is kept after the agency is deleted, for accounting. Stripe keeps its own customer record under its own privacy policy.
• Invitations and password-reset tokens expire automatically and are single use.
• TikTok tokens are kept until you disconnect, TikTok stops accepting them, or the account is deleted.

Your rights

Under the UK GDPR you have the right to access the personal data held about you, to have it corrected or erased, to restrict or object to its processing, and to receive a copy in a portable form. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

If you have an account, most of this is immediate: your own details are editable in the product, and your agency owner can remove creators and team members. For anything else, contact us.

Deleting your account

In the app, open the Menu and choose Delete my account, then confirm with your password — or, if you sign in with TikTok, by signing in with TikTok again. Without the app, write to privacy@agencybattles.co.uk from the email address on your account or, if you sign in with TikTok, tell us your TikTok username.

Your account is switched off straight away, and every sign-in and every phone registered for notifications is ended. We complete the deletion within 30 days. What stays is listed under How long it is kept; in particular, a creator’s roster entry and battles belong to their agency and stay with it.

An owner whose agency still has other members chooses there what happens to the agency. Handing it to one of its managers makes that manager the owner straight away, with everything an owner can see, the agency’s chats included, and the agency carries on. Closing it suspends the agency at once, so nobody there can sign in any more, and cancels any subscription it has straight away; the agency and everything in it, including its battles with other agencies, is then deleted with the owner’s account within 30 days.

Security

• All traffic is served over HTTPS.
• Passwords are hashed with bcrypt and are never recoverable.
• Changing a password, or deactivating an account, immediately invalidates every session already signed in.
• Administrator access to an agency’s account is time-limited and recorded in an audit log against the administrator’s own name.
• Incoming billing webhooks are rejected unless cryptographically signed.

Children

Agency Battles is a business tool and is not directed at children. Do not create an account if you are under 18. TikTok’s own minimum age requirements apply to the creators recorded on a roster.

Changes

If this policy changes in a way that affects how your data is handled, the date at the top of this page will change and the change will be described here.

10 October 2026. An agency owner whose agency has other members can now hand it to one of its managers, or close it, when they delete their account in the app, instead of contacting support.

9 October 2026. The Agency Battles app for iPhone and Android: what it keeps on your phone and sends, push notifications and the services that deliver them, and when it uses the camera, photos and microphone. Chat, support tickets, posters, frames and announcements are now described, deleting your account is explained, and the getting-started reminder emails are listed. The web server’s access log, what it records and how long it is kept are described. The retention section now says what is kept after a deletion, and that the audit log is deleted after two years.

5 October 2026. Owners and managers can connect their own TikTok and log in with it. Your TikTok bio is now received, your TikTok username is your chat username and can be found by people at other agencies, and the profile you share is refreshed about once a day using your stored tokens. A third cookie, bs_tiktok_link, is used while a connection is confirmed, and TikTok is listed among the services the server talks to.

Contact

For any question about this policy, or to exercise any of the rights above, write to privacy@agencybattles.co.uk, or by post to TEKSPERT LTD, 110 Pall Mall, Chorley, PR7 2LB.

See also our Terms of Service.