plainly
What we hold,what we can do, and the limits.
Three questions a careful person asks, answered without a sales call. Each one has a section below.
last reviewed 4 October 2026
we don't keep
What we don't store.
- Your buyers' messagesWe process each message on the fly as it passes between TikTok and Intercom, and never store it.
- Buyer names, phone numbers or addressesTikTok masks them. We pass the masked values to the screen without writing them down.
- Your TikTok passwordYou sign in on TikTok's own page. We never see it.
- Payment card numbersNot needed for messaging, so not collected.
we do keep
What we do store.
- Which chat belongs to which conversationThe link between a TikTok buyer thread and its Intercom conversation.
- Your shop connectionThe tokens that keep each shop connected.
an honest limit: we hold no address or phone, so for identity disputes we send you to Seller Center.
In your accounts
What we can do.Only what you approve, and nothing beyond it.
In TikTok Shop: receive the messages sent to your shop, and send replies as your shop. Not listings, stock, shipping or prices.
In Intercom: open and update the conversations for your TikTok Shop buyers. No access to anything unrelated.
You approve the TikTok side on TikTok's own screen, and you can see the list before you do.
how access is limited
Limits built now, and limits coming.
three live today · one comes with refunds · two later
One shop at a time
Each shop is connected and kept separate inside your workspace.
TikTok's own screen
You approve on TikTok's page, so you can see exactly what you allow.
No password kept
We never see your TikTok password, and we don't store card numbers.
A switch per action
When refunds arrive, each action gets its own switch, and the three riskiest start off.
Ceilings and a stop button
Limits per person and per shop, and a way to halt everything at once.
A record of every action
Who did what, to whom and when, and you can export it.
see the roadmap →
found something?
Tell us. We'll listen.
Say what you saw, where, and how to see it again. We'll tell you how quickly we reply once we can promise a number we'll keep.
We don't claim certifications we don't hold. If that changes, you'll read it here first.
For your legal team: data processing agreement, subprocessors, privacy and terms.
short answers
Questions a careful person asks.
No. TikTok masks them, and we pass the masked values to the screen without writing them down.
No. We process each message on the fly as it passes between TikTok Shop and Intercom, and never store it. The conversation lives in TikTok and in your Intercom.
No. You sign in on TikTok's own page. We receive a connection token for your shop, never your password.
We will name the hosting region on our subprocessors page before we rely on it. Until then, ask us and we'll tell you. Subprocessors →
Not yet, and we won't say we do until we do. If that changes, you will read it here first.
Ask us and we'll tell you exactly who, and why. We'll publish our access rules on this page once they are written down, rather than describe a policy we haven't finished.
Email security@commercereply.com. Say what you saw, where, and how to see it again. Please give us a chance to fix it before you share it.
Careful is good.Ask us anything.
Write to security@commercereply.com, or connect a shop and see for yourself.