How we use the TikTok API

1. Who we are and what AIADS is

AIADS is a platform for running and optimising advertising campaigns, developed by the agency ICBM Polska Sp. z o.o. in Gdańsk. We run company (B2B) campaigns across Google Ads, Microsoft Ads, Meta Ads and TikTok Ads, while the client tracks their results in the AIADS platform (app.aiads.pl).

We use the TikTok API solely to manage the TikTok advertising and business accounts of our clients, with whom we have a signed agreement and who have granted us access themselves. We do not collect TikTok data for any other purpose and we do not resell it.

2. How we connect a TikTok account

• The owner of the advertising account or business account logs in to TikTok and approves access for the AIADS application themselves (TikTok for Business OAuth authorisation).
• The AIADS platform receives an access token for the specified accounts. The token is stored in the database in encrypted form and is used only for the functions described below.
• The account is managed by the ICBM Polska campaign management team. The client can see the results, recommendations and change history in the AIADS platform.

3. TikTok Marketing API — advertising campaigns

Below is each API area we use, together with its function in the AIADS platform and the endpoints called (TikTok API for Business v1.3).

We do not use Business Center endpoints (/bc/*) or TikTok Shop.

4. TikTok Accounts — posts on your business account

In the AIADS platform's "Social posts" module, clients can ask us to publish content on their business TikTok account. This part uses a separate authorisation (TikTok Accounts).

5. Change safety rules

• Write operations run in "dry run" mode by default (nothing is sent to TikTok). After saving, the platform reads the state from the API and confirms the change has taken effect.
• New ads are created as disabled, and we only enable campaigns and ads on the explicit instruction of your account manager.
• AIADS automation never raises budgets — any increase is made by a person following the client's decision. Every budget and bid change has a maximum step size and an overall cap for the whole account.
• We never delete campaigns, ad groups or ads — instead, we pause them.
• Every write attempt (completed, blocked or failed) is recorded in the change log, and a single toggle can block all writes (read-only mode).

6. Data and privacy

• We process TikTok data on the client's behalf as a data processor (under a data processing agreement), solely to run their campaigns and provide reporting.
• We only send email addresses and phone numbers to TikTok as a SHA-256 hash. In conversion events we also pass the click identifier (ttclid), the user's IP address and browser, where consent for measurement allows.
• We never combine one client's data with another client's data, and we do not use it to train AI models.
• Leads from TikTok forms go only to the lead inbox of the client who owns the ad account.
• Details of data processing are described in our privacy policy.

7. Disconnecting your account and contact

The account owner can revoke the AIADS app's access at any time in the TikTok for Business settings, or ask us to disconnect the account. Once access is revoked, the platform stops retrieving data and making changes to that account.