This Privacy Policy explains what personal information SFN AI collects, why we collect it, who we give it to, how long we keep it, and what you can do about it.
The company responsible for the information described here is Short Form Nation, Inc., doing business as SFN AI, 2261 Market Street, STE 22574, San Francisco, CA 94114, United States. Privacy contact: tad@shortformnation.com.
This version supersedes the Privacy Policy dated 7 August 2025, last updated 13 December 2025. Capitalized terms have the meanings given in Section 20.
Three related pages sit alongside this one: the Cookie Policy, which covers cookies, pixels and tags; the Security page, which describes our security program; and the Sub-processor list, which names every third party that processes personal information on our behalf.
We handle personal information about several different groups of people. Some of them have an account with us. Some of them have never heard of us. This section tells you which group you are in, because your rights and the way you exercise them depend on it.
| Group | Who | Where to look |
|---|---|---|
| A. Account holders | Sellers, Agencies and Creators with an SFN AI account, and the people authorized to use those accounts | Sections 3 to 10 |
| B. Roster creators | Creators whose content and performance data a Seller or Agency connects or submits so that we can run that customer's program | Sections 3 to 10, plus Section 3 on our role |
| C. People who appear in Content | Individuals who appear in, or are the subject of, Content we host or analyze | Sections 3 to 10 |
| D. Non-user creators | Creators and other individuals who are not users of the Services, whose publicly available TikTok Shop content and metadata we ingest, analyze and display | Section 11, written specifically for you |
| E. Website visitors | Anyone who visits shortformnation.com | Sections 5.2, 8 and the Cookie Policy |
If you are in group D, Section 11 is the section you want. You still have rights, you do not need an account to use them, and we explain there exactly how.
Everything in this short version is expanded below. If the short version and the detailed sections differ, the detailed sections govern.
We act in two different roles, and which one applies changes who is responsible for what.
3.1 We are a business and a controller when we collect, analyze and model data to build, operate and improve the SFN AI Platform, Content DNA, Coherence scoring, Angles and our other intelligence, including from publicly available third-party content. In that role we decide the purposes and the means of the processing, and this Privacy Policy is the disclosure for it.
3.2 We are a service provider and a processor when a Seller or Agency submits or connects its roster, its Creators' content and performance data, and its strategy and configuration data so that we can generate and route Outputs for that customer. In that role we process that personal information on the customer's behalf, and to that extent we act as a "service provider" and a "processor" and the customer acts as a "business" and a "controller".
3.3 What this means for you in practice. If you are a roster creator and you want your data deleted from a particular brand's workspace, that request is usually the brand's to decide, and we will pass it to them and assist. If you want us to stop profiling you, or to delete what we hold about you as a business, that is our decision and you can bring it straight to us. If you are unsure which one you want, email tad@shortformnation.com and we will route it.
We get personal information in four ways:
| Category | Examples |
|---|---|
| Account information | Name, email address, password, company name, job title |
| Profile information | Profile picture, bio, preferences, communication settings |
| Creator Inputs | Your own Content, connected TikTok posts and profile, historical results and GMV data, style and format signals, and anything you submit or generate through Creator Studios |
| Seller Inputs | Roster and creator lists, hero SKU and product-focus information, briefs, brand guidelines, funnel-stage strategy, Angles you favorite or reject, and campaign configuration |
| Payment information | Billing details for subscription and Campaign purchases, processed by Stripe as our payment processor |
| Identity and tax information | See Section 5.5 |
| Communications | Support tickets, feedback, survey responses, email correspondence |
We observe and analyze publicly available TikTok Shop videos, posts, product listings, captions and the associated metadata and performance signals, across the TikTok Shop ecosystem. That includes content posted by creators, sellers and brands who are not users of the Services.
From that material we collect and derive: the public handle and profile, the video and its caption, publicly reported engagement and performance signals, product and category associations, and the analysis we generate from all of it.
If you are in this group, read Section 11.
A Creator can enroll in a Campaign and submit Content without verifying anything. Before a Creator's first payout, the Creator must complete identity verification and provide required tax documentation, including a valid IRS Form W-9, through Trolley, using an embedded onboarding flow inside the Services. That flow is Trolley's own separate secure frame. We do not see what you type into it.
| What is collected | Why | Who receives it |
|---|---|---|
| Legal name, address, date of birth | Identity verification, and age verification that you are 18 or over | Trolley |
| Government-issued identification | Identity and age verification. Age is verified at verification and is not established by attestation alone | Trolley. SFN AI does not receive or store identity document images. We receive a verification result and a Trolley reference |
| Taxpayer identification number, being an SSN or an EIN, on IRS Form W-9 | United States information reporting. SFN AI is the payor of record for Form 1099-NEC purposes, and a Financial Partner such as Trolley may prepare and file as SFN AI's agent | Trolley, and the IRS on the applicable form. SFN AI does not store the full taxpayer identification number |
| Payout method details, being ACH bank details, PayPal or Venmo | To pay you | Trolley and the selected payment rail. SFN AI does not store full bank account numbers |
| Sanctions, anti-money-laundering and fraud screening results | Compliance | Trolley and SFN AI |
We pay Creators ourselves. A Reward is our own obligation to the Creator and we pay it from our own funds. A Seller is not a party to that arrangement. Trolley executes our payments. It does not pay anyone on any Seller's account.
SFN AI is a technology platform, marketing-services provider and content-production company. It is not a bank, a money transmitter or a financial institution.
If verification or tax documentation is missing, incomplete or fails, payments are paused. Rewards that would otherwise be payable during the pause remain owed to the Creator and are paid once the pause clears.
Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, some of what we collect is sensitive personal information:
We do not collect racial or ethnic origin, religious beliefs, union membership, genetic data, health data, or sex life or sexual orientation.
How we use it. We collect and use sensitive personal information to verify your identity and age, to perform the payout and tax service you asked for, to prevent and investigate fraud and security incidents, and to comply with law.
What we are not claiming. Cal. Civ. Code 1798.121(d) allows a business to decline a request to limit where sensitive personal information is used only for certain purposes. We do not claim that exemption and we do not treat your right to limit as unavailable. If you ask us to limit, we act on the request rather than tell you in advance that it will change nothing. Section 10.3 tells you how.
A notice at collection is a separate obligation from a privacy policy. It has to be given at or before the point of collection. A notice at collection is live on every form on this website.
The short-form notice we give states:
One population has no collection point. We ingest the publicly available content of creators who are not users of the Services (Section 11). There is no form, no signup and no moment at which we are in front of that person. Section 11 is written as the standing notice to that population, and Section 11.4 is the request route.
We use the categories of data in Section 5, including Creator Inputs, Seller Inputs, Creator Content, performance signals and publicly available TikTok Shop content, in identifiable form as well as in de-identified and aggregated form, to train, tune, evaluate, test, benchmark and improve the Services and our models and intelligence. That includes our pattern-mining models, the Content DNA methodology, Coherence scoring, Focus Feed, Angle generation, and per-creator learning and context-retrieval capabilities. This right includes the creation and ongoing use of Aggregated Data as defined in Section 20.
Training, tuning, evaluation, testing, benchmarking and improvement can involve routing data through third-party large language models and related services, including models provided by ByteDance. Section 8.3 describes that routing and what it means in practice.
The default posture is that all users take part. That includes Creators on the free tier of Creator Studios, whose inputs and Content contribute to Content DNA density and to training and improving our models.
There is no general, self-service opt-out from model training. One thing qualifies that sentence. A Seller or Agency may negotiate a carve-out excluding its identifiable Customer Inputs from use in training models that inform Outputs delivered to other users. It is contractual, not self-service. It applies only if expressly agreed in a signed Order Form, and it does not restrict our use of Aggregated Data derived from that customer's data.
If model training is not acceptable to you. For a Seller or Agency, the route is the Order Form carve-out. Beyond that, the remedy is to stop using the Services.
If you do not have an account, that remedy does not reach you and we are not going to pretend it does. Section 11 describes a population of creators who never signed up with us, whose publicly available content we ingest, analyze and train on. You cannot decline by not using a service you do not use. Your route is Section 11.4, and Section 11.4 also states plainly what such a request can and cannot reach.
The Services work by mining patterns across large volumes of data from many sources. De-identified and aggregated learnings derived in whole or in part from one user's data may inform the Outputs, models and intelligence we deliver to other users. This is the core function of the product.
Cross-customer learning is limited to de-identified and aggregated learnings. We will not disclose to any other user a Seller's, Agency's or Creator's identifiable confidential information, including a Seller's identifiable funnel strategy, its favorited or rejected Angles, its hero SKUs, its roster or its campaign configuration. Showing one Seller's identifiable strategy to another Seller is prohibited.
Our ownership of, and right to retain and use, the models, intelligence and Aggregated Data developed this way survives the end of your use of the Services and the closure of your account, however that comes about. Deleting your raw inputs does not require us to delete, unwind or re-derive analysis already created from them. Section 9 sets this out in the retention table.
Two features profile individuals through automated processing.
Content DNA builds a structured profile of a Creator's style and performance from that Creator's own Content, connected TikTok posts and profile, historical results and GMV data, and style and format signals. We use it to personalize Content Ideas and to decide what to put in a Creator's Focus Feed.
The Coherence Score is an automated score we assign to posted Content, indicating how closely it aligns with the applicable Angle or creative strategy. It is a proprietary estimate of how well a video's hook, structure, script and call to action match the patterns we have identified as correlating with higher GMV. It expresses a correlation, not a promise, and the methodology changes as models are retrained.
Content DNA and Coherence scoring affect what Content Ideas a Creator receives.
Eligibility for a Reward is determined under a Campaign's published rules, applied by our grading and eligibility engine.
A Seller also acts in the decision, and its criteria are its own. The automation is not the only thing between a Creator and a payment, and neither are we. The Seller that purchased the Campaign has sole responsibility for reviewing and approving Creator submissions, and a Seller is not required to exercise that review against the Campaign's published rules or against any other stated standard. The Seller has forty-eight hours from submission to complete that review. If it does not act in that window, the submission proceeds to our determination under the Campaign's published rules and we decide without the Seller's review. Our own determination is bound to the published standard. The Seller's is not.
We say this in the Privacy Policy because a third party exercising an unconstrained review over a determination that affects a person's income is a disclosure a privacy policy is required to make, and because it means the Seller receives that Creator's personal information. Section 8.2 sets out what the Seller receives.
Eligibility is not left to the score alone. A Creator may seek review of an eligibility determination, may submit information in support of eligibility, and may appeal. We decide an eligibility review within ten days of the date the Content was submitted and any appeal within five days, and we communicate the decision and its basis to the Creator. A hold or suspension can also be appealed through the same route.
That is a right to a human decision on the outcome that affects what you are paid, and it applies whether or not any privacy statute requires one.
Where a state privacy law gives you a right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, you can exercise it by emailing tad@shortformnation.com with the subject line "Profiling opt-out". There is no self-service toggle for this today. The request is handled by a person.
There is a characterization available to us: that Content DNA and the Coherence Score are estimates and correlations that do not constitute a decision producing a legal or similarly significant effect. We do not rely on it to refuse a request. If you ask us to stop profiling you, we handle the request on its merits, and we tell you what we stopped and what we could not stop.
Two limits are real and we state them rather than imply otherwise. Opting out does not unwind training already performed, and it does not remove your data from models already trained. Aggregated Data already derived, which does not identify you, continues in use.
This Section 7 is the notice that automated decision-making technology may be used in a way that affects you, and it is given here so that it precedes the use.
The Coherence Score and Content DNA are estimates. They do not guarantee any GMV, views, sales, earnings or other result for any video, Creator, Campaign or shop.
We engage third-party sub-processors to provide the Services, and we require them by contract to maintain security measures appropriate to the data they process.
The current list is published at shortformnation.com/subprocessors. It names every provider, what each one does, what each one receives, and where each one processes. We keep it there rather than in this policy so that it can be kept current without amending this page. We do not repeat it here.
If you are a Seller or Agency customer and you want to be notified when that list changes, email tad@shortformnation.com and we will add you to the notification list.
We route analysis through third-party large language models and related services, including models provided by ByteDance. Where training, tuning, evaluation or improvement involves routing data through third-party model providers, that routing is subject to those providers' terms in addition to this Privacy Policy.
What that means in practice: Content, captions, performance signals and, depending on the pipeline, associated identifiers are transmitted to a third-party model provider for analysis. Those providers' availability, behavior and terms are outside our control.
Where that inference runs. Model inference runs in Frankfurt, Germany. Identity and tax information under Section 5.5 is not routed to any model provider.
We do not sell personal information for monetary consideration. No vendor pays us for access to your data. California law defines "sell" as disclosure for monetary or other valuable consideration. The advertising flows in Section 8.5 are disclosed and opted out of as "sharing" regardless of which limb of that definition catches them.
California law defines "sharing" as a separate activity from selling. Sharing means disclosing personal information to a third party for cross-context behavioral advertising, whether or not any money changes hands. Several other states reach the same conduct under the label "targeted advertising", including Virginia, Colorado, Connecticut, Utah, Texas and Oregon.
We use advertising tags. They are Google Ads, TikTok Pixel, LinkedIn Insight and Rewardful, deployed through Google Tag Manager. They run on this website and in the SFN AI application. When one of them fires on your browser, it makes an identifier available to that advertising partner, and that partner can use it to recognize you across other sites and apps and to show you SFN AI advertising there. Under the definitions above, that is sharing for California purposes and targeted advertising for the other states listed. We disclose it here rather than describing it only as "marketing" or "attribution".
How to opt out. Any one of these works:
Where these controls work, stated plainly. The "Your Privacy Choices" control and Global Privacy Control detection are live on shortformnation.com. They are not live in the SFN AI application at app.shortformnation.com. To opt out in the application, email tad@shortformnation.com and we will apply the opt-out to your account.
We do not knowingly sell or share the personal information of anyone under 18. Section 15 sets out the three ages that appear in this policy and what each one is for.
This section covers the twelve months preceding the effective date at the top of this page. The Cookie Policy points here for it and does not restate it.
Sold for monetary consideration in the preceding twelve months: none.
| Statutory category | Collected | Sources | Purposes | Categories of recipients |
|---|---|---|---|---|
| A. Identifiers (name, email address, account ID, public handle, IP address, device and online identifiers) | Yes | You, automatically from your device, our customers, platforms, public platform content | Operating and securing the Services, authentication, support, analytics, model training and improvement, delivery of Content Ideas, marketing, advertising measurement | Model and analysis providers, hosting and cloud infrastructure, delivery channels, analytics providers, transactional email, advertising partners, pay-in and payout partners, Sellers |
| B. Customer records (legal name, mailing address, financial account and payout details) | Yes, collected by Trolley | You, through Trolley | Payout, tax reporting, fraud prevention, legal compliance | Payout partner, pay-in partner, the IRS on the applicable form, state treasurers under unclaimed-property law |
| C. Protected classification characteristics | No | Not applicable | Not applicable | Not applicable |
| D. Commercial information (subscription and Campaign purchases, transaction records, product and category associations) | Yes | You, Stripe, platforms | Billing, fulfilment of Campaign services, analytics, model training and improvement | Pay-in partner, hosting and cloud infrastructure, analytics providers, advertising partners for conversion events |
| F. Internet or other electronic network activity (pages visited, features used, click patterns, session duration, session recordings, log data) | Yes | Automatically from your device, cookies and tags | Operating and improving the Services, security and fraud prevention, analytics, advertising measurement | Analytics providers, hosting and cloud infrastructure, advertising partners |
| G. Geolocation data (approximate, derived from IP address) | Yes, approximate only | Automatically from your device | Security, fraud prevention, coarse analytics | Analytics providers, hosting and cloud infrastructure, advertising partners |
| H. Audio, electronic, visual and similar information (Content, videos, captions, images) | Yes | You, our customers, publicly available platform content | Analysis, scoring, generating Angles and Content Ideas, displaying example and reference content, model training and improvement, Campaign review and approval | Model and analysis providers, hosting and cloud infrastructure, Sellers |
| I. Professional or employment-related information (company name, job title, roster role) | Yes | You, our customers | Account operation, support, marketing | Hosting and cloud infrastructure, transactional email, analytics providers |
| J. Education information | No | Not applicable | Not applicable | Not applicable |
| K. Inferences (Content DNA profiles, Coherence Scores, Angles, benchmarks, pattern intelligence) | Yes | Derived by us from the categories above | Personalization, eligibility determination, Outputs delivered to customers, model training and improvement | Hosting and cloud infrastructure, model and analysis providers, our customers as Outputs, Sellers |
| Sensitive personal information (taxpayer identification number, government-issued identification, account login credentials) | Yes, collected by Trolley | You, through Trolley | Identity and age verification, payout and tax, fraud and security, legal compliance | Payout partner, the IRS on the applicable form |
Every row above was disclosed for a business purpose to the categories of recipients named in the last column. The full provider list is at shortformnation.com/subprocessors, the Seller disclosure is in Section 8.2 and the model-routing disclosure is in Section 8.3.
What we shared for cross-context behavioral advertising. When the advertising tags named in Section 8.5 fire, they receive online and device identifiers, the page and event they fired on, approximate location derived from IP address, and conversion events. That is the whole of what we share for cross-context behavioral advertising. We share no identity, tax, payout or bank information with any advertising partner, and we share no Content with one.
We keep personal information for as long as we need it for the purposes in this Privacy Policy, unless a longer period is required or permitted by law.
The headline rule. When your relationship with us ends, raw personal data that is tied to an identifiable person is deleted within 30 days. Two things sit outside that rule and we state both plainly: records the law requires us to keep for longer, and de-identified aggregated data, which we keep indefinitely.
| Data category | How long we keep it |
|---|---|
| Raw personal data tied to an identifiable person, including Creator Inputs and Seller Inputs and account information | Deleted within 30 days of the end of the relationship. On account closure we delete your raw inputs, or return them if you ask in writing within 30 days of closure |
| De-identified, aggregated data and the analysis derived from it (Content DNA profiles, Angles, Content Ideas, Coherence Scores, Focus Feed alerts, benchmarks, pattern intelligence) | Indefinitely, including after your account closes. Deleting or returning your raw inputs does not require us to delete, unwind or re-derive analysis already created. This data does not identify you |
| Backup copies | Automated database backups are retained for 14 days and then roll off. Personal data captured in a backup is purged as that backup ages out |
| Session recordings | 30 days |
| Publicly available TikTok Shop content and metadata | Retained and refreshed on our ordinary operational cycle. Not tied to any account, and not affected by any account closure. Section 11.4 is the removal route |
| Content Rewards contract records (Campaign published rules, the Reward terms shown at assignment, itemization and rate, and the enrollment record) | At least six years |
| Identity verification, tax and payment records (W-9, taxpayer identification number, verification results, transaction records) | For the minimum period required by tax and information-reporting law. Most of these items are held by Trolley rather than by us |
| Unclaimed-property reporting records | For the period applicable unclaimed-property law requires |
| Everything else, including usage analytics, marketing data and support communications | 12 months |
| Cookie and tag data | As stated in the Cookie Policy |
Whatever state you are in, and whether or not you have an account, you can ask us to:
Limits that apply: we keep what the law requires us to keep, and we do not delete de-identified aggregated data, which we own and which does not identify you (Section 9).
Under the CCPA as amended by the CPRA you also have the right to:
We do not sell personal information for monetary consideration. Section 8.6 is the twelve-month look-back.
You may ask us to limit our use and disclosure of your sensitive personal information, which for us means your taxpayer identification number, your government-issued identification and your account login credentials (Section 5.6).
We are not going to tell you the right is empty. We will act on the request. We will tell you specifically what we stopped, what we kept, and the legal basis for keeping it. Your taxpayer identification number, your identity documents and your full bank details are held by Trolley and not by us, so for those items we will tell you that and route the request.
What a limit request cannot do is remove the legal requirement that a W-9 is collected before your first payout. If you would rather that information were not held at all, the option is to not take a payout.
To make the request: email tad@shortformnation.com with the subject line "Limit sensitive personal information".
We provide the disclosures and honor the consumer rights required by applicable state privacy laws, including those of Virginia, Colorado, Connecticut, Utah, Texas and Oregon, and the other states whose acts take effect through the 2024 to 2026 legislative wave. Depending on your state, that includes access, deletion, correction, portability, opting out of targeted advertising, opting out of sale, opting out of profiling, and a right to appeal a decision we make on your request.
Universal opt-out mechanisms. Colorado and Connecticut require us to honor a universal opt-out mechanism. We detect and honour Global Privacy Control on this website. It is not detected in the SFN AI application at app.shortformnation.com. Section 8.5 sets out the email route that covers the application.
Automated decision-making. The notice is in Section 7.6, the opt-out route is in Section 7.5 and the human review route is in Section 7.4.
Email tad@shortformnation.com. Put the right you are exercising in the subject line. Tell us what you are asking for, and enough information for us to find you: for an account holder, the email address on the account; for a non-user creator, see Section 11.4.
Verification. We will verify your request before we act on it, in proportion to the sensitivity of what you are asking for. We will not ask you for more information than we need, and we will not use verification information for anything else.
Timing. We respond within the time your state's law requires, which is generally 45 days, extendable once where the law allows, and we will tell you if we extend.
Authorized agents. You may use an authorized agent. We will ask for proof of authorization and, where the law allows, may ask you to verify your own identity directly.
Appeals. If we refuse your request, we will tell you why, and you can appeal by replying to our response with the word "Appeal". We will respond to the appeal in the time your state's law requires, and we will tell you how to contact your state's attorney general if you are still not satisfied.
Where we hold your personal information as a service provider or processor for a Seller or Agency (Section 3.2), we will pass your request to that customer and assist them in responding. We will tell you that we have done so.
We do not deny you Services, charge you a different price, give you a different quality of service, or penalize you for exercising a privacy right.
This section is written for people who have never signed up with us.
We are an intelligence platform for TikTok Shop. We observe and analyze publicly available TikTok Shop content at scale, including content posted by creators, sellers and brands who are not users of the Services, for example mapped competitor creators and example videos drawn from the broader dataset. We process personal data about Creators including Creators who have never registered with us or accepted any terms from us.
You did not agree to anything, and we are not claiming you did. Nothing our users have agreed with us operates as your consent.
| What | Detail |
|---|---|
| Source | Publicly available TikTok Shop content and metadata, accessed in accordance with the applicable platform's terms, developer terms and API terms |
| What we collect | Your public handle and profile, your videos, captions and product listings, publicly reported engagement and performance signals, and associated metadata |
| What we derive | Analysis of that content: Angles, patterns, benchmarks and aggregated pattern intelligence |
| What we do with it | We use it to generate Angles and Content Ideas for our users, to display example and reference content inside the Services, and to train and improve our models |
| What we do not do with it | We do not sell publicly available platform data as a standalone dataset and we do not license it to users for redistribution. It is displayed inside the Services only as example and reference content |
| How long we keep it | Retained and refreshed on our ordinary operational cycle, not tied to any account |
Our basis is that the content is publicly available on the platform and is accessed and used in accordance with that platform's terms. We do not rely on a license from any user, and no user warrants any rights in it.
Some US state privacy laws treat information lawfully made available to the general public differently from other personal information. We are not going to use that as a reason to ignore you. We handle requests from people in this group the same way we handle requests from account holders.
You can ask us to know and access, correct, delete, or stop profiling you, and to opt out of any sharing. Section 10 sets out the rights. This section sets out the mechanics.
Email tad@shortformnation.com with the subject line "Non-user creator request". Include:
How we verify you. We do not have an account to check you against, so we verify that you control the public account you are asking about. We will pick the least intrusive method that works, and we will not ask you for a government ID to verify a request about publicly available content.
What a request does, and what it cannot reach. We act on the request, and we tell you what we did and what we could not do. Two limits are real. We cannot unwind aggregated statistical learning already derived from your content, which does not identify you, and we cannot retrain models that have already been trained. We say that plainly rather than imply otherwise.
If content we display features you and you want it removed, or you believe it infringes your rights, email tad@shortformnation.com with the subject line "Takedown". Copyright complaints follow the notice-and-takedown process in our Website Terms of Use. Rights of publicity and name, image and likeness in publicly available content we display are handled through this route, and this is the notice-and-takedown route for publicly ingested content.
The creator population on TikTok skews young, and we may ingest publicly available content posted by creators who are minors. If you are under 18, or you are the parent or guardian of someone under 18, email tad@shortformnation.com with the subject line "Minor" and we will remove the information. We do not require you to prove anything more than control of the account.
We are a United States company. Our systems are not all in the United States, and we say where they are rather than leave it vague.
| What | Where |
|---|---|
| The SFN AI application and its data stores | Amazon Web Services, Frankfurt, Germany |
| AI model inference | Frankfurt, Germany |
| Product analytics and session recordings | PostHog, European Union |
| This marketing website | Netlify, distributed edge network |
| Payments, payouts, identity and tax | Stripe and Trolley, United States |
| Google Analytics, advertising partners, Discord, TikTok and transactional email | United States |
Our own team accesses these systems from the United States and from other countries. All administrative access is over encrypted connections. The Sub-processor list states the processing location for every provider we use.
SFN AI is directed at the United States. The Services, including the Operated Program, the Agency model and Content Rewards, are offered in the United States only, and Sellers, Agencies and Creators receiving Content Rewards payouts must be United States persons or entities. We do not have EEA or UK users.
Our marketing website is reachable from anywhere. That does not make it an offer of the Services into the European Economic Area or the United Kingdom. Nothing on this page is an assertion that SFN AI is established in, or targets, the EEA or the United Kingdom, and nothing on it is a representation of GDPR compliance. We have not appointed a representative under Article 27 of the EU GDPR or under the UK GDPR, because we do not offer the Services in those territories.
If you are in the EEA or the UK and you want to know what we hold about you, or you want it deleted, email tad@shortformnation.com. We handle the request.
We maintain a written information security program, adopted 6 August 2026, with administrative and technical safeguards designed to protect the confidentiality, integrity and availability of personal information. It is supported by written access control, data classification, incident response and vulnerability management policies. Those safeguards apply to the personal and identity-verification information processed for Content Rewards.
Encryption. Personal data at rest in our production database is encrypted using AES-256, and our operational queues use managed key encryption. Data in transit is protected with TLS 1.2 or higher.
Access. Access to production systems and personal data is granted per named individual, scoped to the minimum needed for the role, logged, and reviewed at least annually.
History. We have not experienced a personal-data breach in the past three years, and we have not received a complaint or regulatory correspondence about our processing of personal data in that period.
Breach notification. If there is a breach of security leading to unlawful or unauthorized access to, acquisition, disclosure, loss or destruction of personal information we process, we will notify affected parties, and where we act as a service provider or processor the applicable Seller or Agency customer, without undue delay and consistent with applicable state breach-notification laws. Notifications will describe the incident, the categories of data involved and the measures taken, so far as then known.
Your part. Notify us at security@shortformnation.com of any suspected or actual unauthorized access to your account.
More detail is on our Security page. No method of transmission or storage is completely secure, and we do not warrant that the Services or any data will be free from unauthorized access.
You must be at least 18 years old to create an SFN AI account and to use our logged-in platform features, including the Brand Workspace and Creator Studios. You must be at least 18 to participate in Content Rewards, to earn or receive a Reward, or to complete verification and payout, and age is verified at identity verification rather than by attestation.
We do not knowingly collect personal information through an account from anyone under 18. If we learn that we hold information from a child in a manner inconsistent with applicable law, or that an account holder is under the required age, we take reasonable steps to address it, including removing the information or terminating the account.
Children under 13. Our website is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. If we learn that we have, we will take reasonable steps to address it, including deleting the information.
Consumers under 16. We do not have actual knowledge that we sell or share the personal information of consumers under 16.
| Age | What it governs | Source |
|---|---|---|
| 13 | Knowing collection of personal information from a child. We do not knowingly collect it, through the website or through cookies | COPPA, 16 C.F.R. Part 312 |
| 16 | The CCPA opt-in threshold for selling or sharing a minor's personal information. We have no actual knowledge of doing so | Cal. Civ. Code 1798.120(c) |
| 18 | Creating an account, using our logged-in platform features, and participating in Content Rewards, earning or receiving a Reward, or completing verification and payout | Our account eligibility rules, and identity verification at payout |
These are three different thresholds for three different purposes and they are not in conflict with each other. The Cookie Policy and the Website Terms of Use state 13 and 18 in the same terms.
The 18 threshold and the public website. The 18 thresholds above apply to creating an account, to using our logged-in platform features, and to participating in Content Rewards. Our public marketing website is generally accessible, is not directed to children, and is not age-gated.
Separately, we may ingest publicly available content posted by creators who are minors, because the creator population on TikTok skews young. Section 11.6 tells those creators, and their parents or guardians, how to have that information removed.
The Services integrate with and depend on third-party platforms, including TikTok, TikTok Shop and Discord, and our website links to third-party sites. We are not responsible for the privacy practices of those third parties. Their handling of your information is governed by their own policies and terms.
We may update this Privacy Policy. We maintain a version number and an effective date, both at the top of this page. For material changes we will post the updated policy here and update the effective date, and where the change is significant we will also give notice by email or in the Services.
Our Website Terms of Use state the governing law for your use of our public website.
Nothing in this Privacy Policy varies any right you have under applicable law, and no part of it applies to the extent it cannot lawfully be applied to you.
If you are not satisfied with how we handle a privacy request, Section 10.5 tells you how to appeal and how to contact your state's attorney general.
Privacy questions and privacy requests: tad@shortformnation.com.
Data Protection Officer. Our appointed Data Protection Officer and privacy point of contact is Tad Slaff, Chief Technology Officer, reachable at tad@shortformnation.com.
Security reports: security@shortformnation.com. Legal notices and disputes: legal@shortformnation.com.
These are the terms this Privacy Policy uses with a specific meaning. The Cookie Policy and the Security page use them the same way.
We collect the information in this form to respond to you and to follow up about SFN AI, and we keep it for up to 12 months. We share limited advertising identifiers with advertising partners, which you can opt out of using in the footer. Full detail is in our Privacy Policy.