Privacy Policy

1. Who we are and what this policy covers

ShopNIL TV is operated by 3P Touch Media Group, Inc. ("3P", "we", "us"). For personal data collected through the ShopNIL TV website, apps, creator studio and players (the "Service"), 3P is the controller — the party that decides why and how the data is used.

This policy describes what we collect, why, who we share it with, how long we keep it, and the choices and rights you have. It covers viewers, creators, workspace members, manufacturers who receive submissions, and people who contact us.

It does not cover what a merchant does with your data after you follow a Shop Now link, or what a payment provider does under its own account terms. Those parties are separate controllers with their own policies.

2. Information we collect

Account and profile information: name, email address, password credentials (hashed by our authentication provider), role, avatar, and workspace membership.

Creator and business information: studio profile details, brand assets, contact details, plan and billing status, and rights attestations you submit when publishing.

Content you upload or create: videos, posters and thumbnails, songs and cover art, influencer details and social links, product details, designs and manufacturer submissions.

Viewing and engagement data: which players and pages you open, video starts, pauses, progress and completion, tags shown and cards opened, saves, Shop Now clicks, and the page that referred you.

Technical and device data: IP address, browser and device type, operating system, language, and timestamps. We derive an approximate location (such as city or region) from your time zone and IP address. We do not collect precise GPS location.

Transaction data: plan purchases, credits and receipts, handled by our payment providers. We receive confirmation and limited billing details, never full card numbers.

Communications: messages you send through our Contact page, support requests, survey responses and notification preferences.

Cookies and similar technologies: as described in the cookies section below.

3. Why we use it, and our legal bases

To provide the Service (contract): creating and securing your account, hosting and streaming videos, saving your tags and designs, publishing players, processing plan purchases, and sending service messages.

To keep the Service safe and lawful (legitimate interests and legal obligation): detecting abuse, spam and fraud; enforced rate limits; content moderation; responding to legal requests; maintaining audit records; and defending legal claims.

To improve and measure the Service (legitimate interests, or consent where required): aggregate analytics about which content and features are used, error diagnosis, and product development.

For AI Features you start (contract, and consent where required): analysing video you submit, importing product facts from a link you supply, and generating suggestions.

For marketing (consent, or legitimate interests where permitted): creator and product updates. You can opt out at any time, and we always honour opt-outs for marketing email.

Where we rely on consent, you may withdraw it at any time without affecting processing that happened before withdrawal.

4. AI processing and your control

What AI Features do. When you start an analysis, the platform sends the video (or a set of frames and its poster) to an AI provider so it can propose moments and objects that may be worth tagging. When you paste a product link, we fetch that page and use AI to extract product details you can apply to a tag. Assistant and description tools send the text or frame you choose, plus minimal context about the video, to produce a draft.

It is opt-in and per item. Analysis runs only for a video where you start it. You can stop, re-run or dismiss it, discard any suggestion, and edit or delete any AI-populated field before publishing.

Suggestions are not decisions. AI output is a proposal a human reviews. No decision that produces legal or similarly significant effects about you is made solely by automated means. Publishing requires your own action, and account or content decisions are made or reviewed by our team.

Not used for training our models. We do not use your content to train our own AI models, and we require AI providers, by contract, to process it only to deliver the feature you requested.

Retention and deletion. AI outputs (detection candidates, generated drafts, imported product data) are stored with the video or design they belong to. Delete the video, tag or design and the derived AI results are deleted with it, subject to the backup and legal-retention periods below. You can also ask us to delete AI-derived data while keeping the source content.

Transparency. AI-assisted features are identified as such in the Studio, and material that is generated or materially modified by AI is labelled in the player or the Studio where required by law.

Human review and objection. You can ask for a human review of any automated moderation, labelling or eligibility decision by contacting us, and you can object to AI processing of your content by turning the feature off or contacting us.

5. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in, remember player and mute preferences, prevent fraud and balance traffic. These do not require consent because the Service cannot work without them.

Analytics and any advertising or measurement tags load only after you consent where consent is required, and are not loaded for visitors who have not consented. We honour Global Privacy Control and comparable browser opt-out signals where the law requires us to.

You can clear or block cookies in your browser. Blocking strictly necessary cookies may sign you out or break playback and saving.

6. Who we share data with

Service providers (processors) that act on our instructions under contract: cloud hosting and storage, authentication, email delivery, payment processing, error monitoring, analytics, and AI model providers for the AI Features described above.

Merchants and manufacturers: when you follow a Shop Now link, the merchant receives the request data a normal web visit carries. When a design is submitted to a manufacturer, we share the design package, reference and contact details needed to quote and produce it.

Creators and workspace members: activity in a shared workspace (for example tag edits and publish actions) is visible to that workspace's members and administrators.

Legal and safety: when we believe disclosure is required by law, valid legal process, or necessary to prevent harm, fraud or abuse, and to protect our rights.

Business transfers: in a merger, acquisition, financing or sale of assets, data may be transferred subject to this policy and applicable law.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising as those terms are defined under US state privacy laws. We do not use or disclose sensitive personal information beyond the purposes permitted without consent.

7. Your privacy rights

Depending on where you live, you may have some or all of the following rights:

• access — a copy of the personal data we hold about you, and information about how it is used;
• correction — fix inaccurate or incomplete data;
• deletion — delete your data, subject to legal retention obligations;
• portability — receive your data in a portable, machine-readable format;
• restriction and objection — limit or object to certain processing, including profiling and direct marketing;
• withdrawal of consent — at any time, for processing based on consent;
• opt out of sale, sharing or targeted advertising — we do not engage in these activities;
• non-discrimination — we will not deny service or charge a different price because you exercised a privacy right;
• appeal — if we decline a request, you may appeal, and we will explain the outcome in writing.

How to exercise them: contact us through our Contact page and select "Privacy Request". We verify requests using the email address on your account. Authorised agents may submit requests with proof of authorisation. We respond within the timeframe the applicable law requires (normally 30 days, or 45 days for US state privacy requests, with notice if an extension is needed). You can also use in-product controls at any time, which act immediately: delete a video, delete a tag, remove a saved item, or delete your account.

You will not be treated differently for exercising a right. If you are not satisfied with our response, you may lodge a complaint with your local data-protection authority or state attorney general.

8. Marketing and service messages

We send transactional and service messages (password resets, verification codes, invite and access notices, receipts, plan and submission status) that are necessary to operate the Service. These are sent even if you opt out of marketing, because they carry information you need.

Marketing email and product updates include an unsubscribe link that takes effect immediately. You can also manage notification preferences in your account settings.

9. How long we keep data

Account data is kept while your account is active, and for up to 30 days after deletion so the deletion can complete across systems, then removed or de-identified.

Content you delete is removed from live systems promptly and from rotating backups within 90 days, unless a longer period is required to resolve a dispute, investigate abuse, or comply with a legal obligation.

Analytics events are kept in identifiable form for up to 26 months, and in aggregate or de-identified form thereafter.

Billing, tax and audit records are kept for the period required by law (typically 7 years).

Aggregated or de-identified data that can no longer identify you may be kept indefinitely for analytics and product improvement.

10. Security

We use technical and organisational measures designed to protect personal data, including encryption in transit, access controls, role-based permissions, audit logging of administrative actions, rate limiting, and separation between draft workspace data and published public players. Video and artwork uploads are stored in access-controlled storage, and download links are time-limited or token-scoped.

No system is perfectly secure. If a breach affects your personal data and the law requires it, we will notify you and the relevant authorities without undue delay. Please use a strong, unique password and enable multi-factor authentication where it is offered.

11. International transfers

We are based in the United States, and our providers and AI processors may process data in the United States or other countries. Where we transfer personal data out of the EEA, the United Kingdom or Switzerland, we rely on lawful transfer mechanisms such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with safeguards such as access restrictions and encryption. You can ask us for information about the safeguards that apply to a specific transfer.

12. Children

The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13. Accounts require the age of majority for creator and business features. If you believe a child under 13 has created an account or provided data, contact us and we will delete it promptly. If we learn that content depicts or exploits a minor, we remove it and report it to the appropriate authorities.

13. Your controls at a glance

You do not need to contact us to exercise most controls:

• turn AI analysis on or off, per video, in the Studio;
• review, edit or discard every AI suggestion before publishing;
• unpublish or delete a video, tag, song or design;
• manage workspace members and their roles;
• change notification and marketing preferences;
• download or delete your account data from your account settings, or ask us to do it;
• withdraw cookie consent from the cookie preferences control.

14. Changes to this policy

We may update this policy as the Service or the law changes. Material changes get a new effective date and, where required, notice by email or in the product before they take effect. The version published here is always the current one.

15. Contact us

For privacy questions, data requests, appeals, or to reach our privacy contact, use our Contact page and select "Privacy Request". Include the email address associated with your account so we can verify and act on your request.