Maddox Campaign Authenticator← Back

Privacy Policy

Last updated: 2026-06-22

This Privacy Notice explains how Maddox Gaming AB, org. no. 559547-5418, Skomakartorp 5, 178 38 Ekerö, Sweden ("Maddox", "we", "us") processes personal data in connection with the Maddox Campaign Authenticator (the "Service") — a shared sign-in and submission layer used across branded TikTok game campaigns ("Campaigns").

1. Our role: controller vs processor

The Service operates on two layers:

  • Platform layer (Maddox as controller). A small set of platform-level data is processed by Maddox as data controller to operate the Service across all Campaigns. This includes your authenticated account identifier, anti-fraud signals (such as perceptual hashes of submitted images), and operational logs needed for security and abuse prevention.
  • Campaign layer (Maddox as processor). For each individual Campaign, the brand client that organises the Campaign (the "Organiser") is the data controller for Campaign-specific data (your submission, score, contact details collected for prize fulfilment, etc.). Maddox processes that data as a data processor on the Organiser's documented instructions. Each Organiser publishes its own privacy policy, linked from the relevant Campaign page; that policy is the authoritative description of Campaign-layer processing.

This Notice describes the platform layer. For Campaign-specific details, see the Organiser's own privacy policy.

2. Data we receive from TikTok

When you sign in with TikTok Login Kit we receive the following from TikTok, based on the OAuth scopes you authorise:

Scope: `user.info.basic`

  • Data received: Open ID, union ID, display name, and avatar URL.
  • Why we use it: To create and identify your account, to display your avatar next to your entry on the Campaign leaderboard, and to prevent the same TikTok account from participating twice.

Scope: `user.info.profile`

  • Data received: your TikTok username (handle).
  • Why we use it: The Campaign Rules require the screenshot you upload to show your TikTok username on screen. We compare the username visible in that screenshot against the username on your signed-in account, so that a score can only be submitted by the account that achieved it (see §5). Your username is also shown on the Campaign leaderboard so that entries are attributable.

We request only these two scopes, and we use only the fields listed above. We do not read or store your bio, profile links, follower or following counts, your videos, or your verification status.

We never receive or store your TikTok password.

3. Other data we process

  • Submission data: the screenshot you upload, the score it evidences, the timestamp, and the result of the automated validation.
  • Contact data (if collected for a specific Campaign): email address and/or mobile number, processed by Maddox as processor on the Organiser's instructions for the purpose of contacting prize winners.
  • Consent records: that you accepted the applicable terms and this Notice, and when.
  • Technical data: IP address, user-agent, and similar information needed to operate the Service securely and prevent abuse.

4. Purposes and legal bases (platform layer)

  • Operating the sign-in and account system — performance of a contract (Art. 6(1)(b)), namely these Terms.
  • Cross-Campaign anti-fraud and abuse prevention — legitimate interests (Art. 6(1)(f)) in ensuring fair competitions and platform integrity.
  • Security, logging, and incident response — legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)).
  • Responding to your data-subject requests — legal obligation (Art. 6(1)(c)).

Campaign-layer processing is described in the Organiser's privacy policy and is normally based on the Organiser's contract with you (the Campaign Rules) and/or your consent.

5. Automated decision-making

Submissions are reviewed in part automatically to check that the image shows a genuine qualifying result. The automated review decides only whether a submission meets the Campaign's technical requirements; it has no other legal effect on you. You may request a human re-review by contacting campaign@maddox.gg.

6. Sub-processors and recipients

We do not sell your personal data. We use a small number of trusted providers to operate the Service:

  • TikTok — OAuth sign-in. TikTok is an independent controller for its own processing. Located outside the EU/EEA.
  • Clerk — authentication and session management. Located outside the EU/EEA.
  • Supabase — database and file storage (screenshots). Located in the EU (eu-central-1).
  • Vercel — hosting and serverless functions. Located in the EU.
  • Anthropic — automated screenshot validation (Claude Vision). Located outside the EU/EEA.
  • ClearOn (where used by a Campaign) — SMS delivery of prize coupons. Located in the EU.

These providers act on our instructions and under written agreements. Personal data may additionally be disclosed to public authorities where we are legally required to do so.

7. International transfers

Some providers process personal data outside the EU/EEA (Clerk, Anthropic, and TikTok for its own processing). We rely on the European Commission's Standard Contractual Clauses (SCCs) and apply additional safeguards where appropriate.

8. Retention

  • Campaign-related data (your submission, score, leaderboard entry) is retained for the Campaign period and for up to 90 days after the Campaign ends, then permanently deleted, in line with the Organiser's instructions.
  • Platform-level account data (your sign-in identifier and minimal profile) is retained while you maintain an active account across Campaigns and deleted on request via the Delete my data function or by contacting us.
  • Security logs are retained for the period needed to investigate incidents and meet legal requirements, typically not more than 12 months.

9. Your rights

Under the GDPR you have the right to:

  • Access your personal data (Art. 15).
  • Rectify inaccurate data (Art. 16).
  • Erase your data (Art. 17). You can self-serve via the Delete my data button on any Campaign page.
  • Restrict processing (Art. 18).
  • Object to processing based on legitimate interests (Art. 21).
  • Data portability (Art. 20).
  • Withdraw consent at any time where processing is based on consent (Art. 7(3)).

To exercise your rights, contact legal@maddox.gg. For Campaign-specific data, you may also contact the Organiser directly using the contact in the Campaign's privacy policy.

10. Complaints

You may lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) — see www.imy.se — or with your local data-protection authority.

11. Cookies

The Service uses only essential cookies required to sign you in and keep you signed in. We do not use cookies for marketing or for cross-site tracking.

12. Security

We apply appropriate technical and organisational safeguards to protect personal data, including encryption in transit, private storage buckets for screenshots, row-level security on our database, and access controls. Your contact details are not visible to other participants and are never returned to clients in leaderboard responses.

13. Relationship to TikTok

The Service uses TikTok Login Kit but is not sponsored, endorsed, administered by, or associated with TikTok. Your use of TikTok itself is governed by TikTok's own privacy policy.

14. Changes

We may update this Notice from time to time. The current version is always published at this URL with a "Last updated" date.

15. Contact

Maddox Gaming AB Org. no. 559547-5418 Skomakartorp 5, 178 38 Ekerö, Sweden

  • Legal and privacy enquiries: legal@maddox.gg
  • Service and campaign enquiries: campaign@maddox.gg