Privacy Policy — TikTok Integration

Nexus 360 is a software-as-a-service platform operated by Vector Stack LLC ("Vector Stack", "we", "us", "our"), a company organized under the laws of the State of Florida, United States. This Privacy Policy ("Policy") explains how we collect, use, share, retain, and protect personal information processed through the Nexus 360 TikTok integration (the "TikTok Integration").

This Policy applies whenever a merchant connects a TikTok Shop or TikTok for Business account to Nexus 360. It supplements the general Nexus 360 Privacy Policy at /privacy and the TikTok Integration Terms of Use at /legal/tiktok/terms.

Nexus 360 is not affiliated with, endorsed by, or sponsored by TikTok Pte. Ltd. or its affiliates.

When a merchant authorizes the TikTok Integration we receive data from TikTok's official APIs based on the OAuth scopes granted during the authorization flow. Depending on the features the merchant enables, this may include:

• Seller account information: shop ID, shop name, country, contact email, business identifiers, warehouse and return addresses. • Catalog and inventory data: product titles, descriptions, images, variants, SKUs, pricing, stock levels, categories, attributes. • Order and fulfillment data: order IDs, line items, prices, taxes, fees, shipping methods, tracking numbers, fulfillment status, returns, refunds, and disputes. • Buyer-related data made available to the seller through TikTok's APIs: recipient name, shipping address, masked or full contact details (where TikTok provides them), and order history attributable to the merchant. • Performance and reporting data: shop metrics, listing health, account-health signals, and aggregated analytics. • Authentication and audit data: OAuth tokens, refresh tokens, scopes, timestamps, IP addresses, and event logs needed to operate the integration securely.

We do not request, scrape, or store TikTok user data outside the scope authorized by the merchant or beyond what TikTok's APIs return for that scope.

We process TikTok-sourced data only to:

• Provide the features the merchant has enabled, such as listing synchronization, inventory updates, order ingestion, fulfillment, shipment tracking, returns handling, repricing, reporting, and analytics for that merchant. • Operate, maintain, secure, and troubleshoot the platform, including monitoring API usage, debugging integration issues, preventing fraud and abuse, and responding to support requests. • Comply with legal obligations, enforce our agreements, and protect the rights, property, and safety of Vector Stack, our merchants, and their customers.

We do not use TikTok data to build advertising profiles, to train general-purpose machine-learning models for resale, or for any purpose unrelated to operating the platform for the merchant who connected the integration.

For data about the merchant's own account and authorized users (e.g., who connected the integration, login email), Vector Stack LLC acts as a data controller.

For data about the merchant's customers received from TikTok (e.g., buyer name and shipping address attached to an order), Vector Stack LLC acts as a data processor on behalf of the merchant. The merchant is the data controller and is responsible for the lawful basis, notices, and consents required for that processing.

We share TikTok-sourced data only as follows:

• With the merchant who connected the integration, through the Nexus 360 application and APIs. • With service providers acting on our behalf under written contracts that restrict their use of the data to the services they provide to us, including hosting and cloud infrastructure, database and search services, error monitoring, email delivery, customer support, and security tooling. • With other channels or services the merchant has explicitly enabled in Nexus 360 (for example, syncing a TikTok order to a 3PL, shipping carrier, or accounting system). • With governmental, regulatory, or law enforcement authorities when required by valid legal process or to protect the rights, property, or safety of Vector Stack, our merchants, or the public. • In connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case we will require the recipient to honor this Policy and TikTok's developer requirements.

We do not sell TikTok-sourced personal information, and we do not share it with advertising networks or data brokers.

We process TikTok data in accordance with the TikTok Developer Terms of Service, the TikTok Data Use Policy, the TikTok Shop Partner Center policies, and any other applicable TikTok policies in force at the time of processing.

We will not:

• Use TikTok data to discriminate against users or to make eligibility decisions about credit, employment, insurance, housing, or government benefits. • Combine TikTok data with data from other sources for the purpose of targeting individual TikTok users with advertising outside the merchant's own channels. • Sell, license, or transfer TikTok data to third parties except as described in this Policy. • Retain TikTok data after a merchant disconnects the integration except as needed to comply with legal obligations or as expressly permitted by TikTok's policies.

If TikTok or a merchant instructs us to delete data, we will do so within the time frame required by TikTok's developer policies and applicable law.

We retain TikTok-sourced data only for as long as needed to provide the services the merchant has enabled, to comply with legal obligations (such as tax, accounting, or fraud-prevention requirements), to resolve disputes, and to enforce our agreements.

When a merchant disconnects the TikTok Integration or terminates their Nexus 360 account, we delete or de-identify TikTok-sourced personal information in accordance with TikTok's developer requirements, typically within thirty (30) days, except where a longer retention period is required by law or is necessary to complete in-flight financial or operational obligations (for example, finalizing a refund).

We implement administrative, technical, and physical safeguards designed to protect TikTok-sourced data against unauthorized access, disclosure, alteration, and destruction. These include encryption of OAuth tokens at rest, transport-layer encryption for data in transit, role-based access controls, audit logging, network segmentation, regular vulnerability scanning, and least-privilege access for engineering personnel.

No security program is perfect. If we become aware of a security incident affecting TikTok-sourced data, we will notify affected merchants and TikTok in accordance with applicable law and TikTok's developer requirements.

Vector Stack LLC is based in the United States. TikTok-sourced data may be processed in the United States and in other countries where our service providers operate. Where applicable law requires it (for example, the GDPR or UK GDPR), transfers of personal data outside the originating jurisdiction are made under appropriate safeguards such as Standard Contractual Clauses.

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or port your personal information, to object to certain processing, and to withdraw consent. Where Vector Stack LLC acts as a processor on behalf of a merchant, requests should generally be directed to that merchant; we will assist the merchant in responding as required by law.

For data where Vector Stack LLC acts as a controller, you can submit a request to support@nexus360.us. We will verify your identity before responding and will respond within the time frame required by applicable law.

You may also revoke Nexus 360's authorization at any time through your TikTok seller console or by disconnecting the integration in Nexus 360.

Nexus 360 is a business-facing platform and is not directed to children. We do not knowingly collect personal information from children under the age of thirteen (13), or under the relevant age in jurisdictions with a higher threshold. If we learn that we have inadvertently collected such information we will delete it.

We may update this Policy from time to time. If we make material changes we will post the updated Policy at this URL and update the "Last updated" date. Continued use of the TikTok Integration after the effective date constitutes acceptance of the updated Policy.

If you have questions, concerns, or complaints about this Policy or our processing of TikTok-sourced data, please contact:

Vector Stack LLC Attn: Privacy support@nexus360.us State of Florida, United States