Harrizona Dream LLC is an Arizona limited liability company, established August 28, 2020, and held by two Owners. Both Owners are authorized to access company systems. The Company has no employees, contractors, or subcontractors. The Owners of record are identified in the Company's filing with the Arizona Corporation Commission, which is a matter of public record.

We operate no offices open to the public and no on-premises servers. Company data lives on encrypted owner devices and in the accounts of the service providers named below.

The Managing Owner is accountable for information security and privacy, serves as the Company's appointed Data Protection Contact, and is the escalation point for any concern.

Our TikTok Shop agency practice began September 22, 2026. The company itself has traded since 2020, and the policies on this page were adopted when the agency began.

On TikTok Shop we work as a Partner Agency and as an app developer. We work with creators on affiliate performance, and we build Harrizona Drive, an application on the TikTok Shop Partner APIs that shows a creator their own earnings and content performance. Harry is the AI chat bot inside it, which helps members with product knowledge and hooks.

What this covers

This notice covers data we access through the TikTok Shop Partner APIs in our agency and developer capacity, and data handled by Harrizona Drive, our membership application. Our retail shop has its own store policies, published separately.

What data we access

• Performance data. Commission earned, gross merchandise value, items sold, product titles and images, order identifiers, content identifiers, and shop names.
• Creator identity data. Creator username, open identifier, region, the permissions granted to us, profile picture, and publicly visible profile figures such as follower count and bio.

What we do not access

Harrizona Drive is granted creator-scope permissions only. Those return a creator's own commission and content performance and contain no buyer information. It does not request, store, or display customer personal data.

Separately from our agency work we also operate our own shops on TikTok Shop. Order fulfilment data belonging to those shops is handled solely inside TikTok Shop Seller Center and the systems of the carriers who deliver the order. It is never exported into Harry, never combined with agency or creator data, and never used for any purpose beyond fulfilling and servicing that order.

Membership, Harry and the community

Harrizona Drive is a paid membership, and membership is what gates everything else. The agency, the Discord and Harry are reached through the Drive and nowhere else, which is how the agency stays private. Three things follow from that, and none of them were true of an agency on its own.

• Payment. Membership is billed through Stripe. Your card details go to Stripe, never to us. We see that you are a member and the email you joined with. We never see or store a card number.
• Harry. Harry is the AI chat bot inside Harrizona Drive. It helps with product knowledge, hook ideas and suggestions. What you type or upload to Harry, along with the product and performance data needed to answer you, is sent to our AI provider to generate a reply. It is not used to train anyone's model. Do not put anything into Harry you would not want leaving your own machine.
• The Discord. The members' community is a private server, open to paying members only. It runs on Discord, a separate company with its own terms and privacy policy, so what you post there is held by Discord and not by us.

Why we access it

To show a creator their own earnings and content performance. To carry out the agency work a creator has engaged us for. To meet our legal, accounting, and tax obligations. Nothing else.

Where it is stored

In the United States, on encrypted owner devices and with our service providers.

Who can access it

A creator's figures are visible to that creator. Our two owners can access them only as needed for the agency work that creator engaged us for. Nobody else.

We never sell your data. We never share it for advertising. We never combine it with data from other sources to build a profile of an individual.

Service providers

We use a small number of established providers, each with its own credentials and multi-factor authentication: an email provider, a password manager, a domain registrar, a website host, an application host and database provider, a transactional email provider, a payment platform for memberships, an AI provider that powers Harry, and a community platform for members. We choose them for their published security practices. We do not engage subcontractors who process personal data on our behalf, and would not do so without a written agreement imposing obligations equivalent to those on this page.

How long we keep it

Performance data is kept while the authorizing relationship continues, so a creator's history stays available to them. When a creator withdraws authorization, or a relationship ends, we delete what we hold for that account, including stored access tokens and order history, and we confirm the deletion on request.

Access control

Access is granted on the principle of least privilege: only to our two Owners, and only to the systems they need. Each Owner uses individual credentials, never shared. Multi-factor authentication is enabled on every account that supports it, including company email, TikTok Shop Partner Center, the domain registrar, the hosting provider, and each linked TikTok account. Access is reviewed at least annually and revoked promptly when someone stops working with us. Sign-in and access logs are retained by our providers, reviewed at the annual review, and consulted whenever anything looks wrong.

Credentials and secrets

Passwords are unique per service, generated and stored in a password manager that enforces complexity. Short or reused passwords are not permitted. API keys and application secrets live in access-restricted files readable only by the owning operating system account, are never committed to public repositories, never placed in any publicly served directory, and never sent over unencrypted channels. Any secret we believe may have been exposed is rotated immediately rather than investigated first.

Creator access tokens

Tokens obtained from TikTok Shop on a creator's authorization are encrypted before storage using authenticated symmetric encryption. The encryption key is held separately from the data it protects and is never stored alongside it.

Devices

Company work happens only on company-controlled devices. Full-disk encryption is enabled on all of them. They lock automatically after a short period of inactivity and need a passcode or biometric to unlock. We keep a clear-desk and clear-screen practice. Commercial anti-malware software is installed and kept current. Operating systems, browsers, and applications are kept up to date with automatic updates enabled. Remote lock and remote wipe are enabled so a lost device can be disabled.

Network

We run no public-facing network of our own, expose no inbound ports, and operate no on-premises servers. Because we run no internal network services, there is no internal network for an attacker to move within. The systems holding our data are separate, individually authenticated cloud services, each reachable only with its own credentials and multi-factor authentication. Company systems are not accessed over open public wireless networks without an encrypted tunnel. Router administrative credentials are changed from defaults and firmware is kept current. Our hosted application sits behind the provider's managed firewall, with no direct database access from the public internet and no administrative ports exposed.

Data classification

We classify data as Restricted (API secrets, creator access tokens, any order fulfilment data), Confidential (commission and sales figures, order identifiers), or Public (these policies, public profile figures, product listings). Restricted data is encrypted at rest and in transit, access-limited, and kept for the shortest viable period.

Encryption

All data moves over TLS. Requests to TikTok Shop APIs are additionally signed with HMAC-SHA256 using our application secret, so a request cannot be altered in flight without detection. At rest we rely on full-disk encryption on devices, encryption at rest from our hosting and storage providers, and application-level encryption of creator access tokens.

Data minimization

We request only the data needed for a stated purpose, and the narrowest set of API permissions that will serve the application's function.

Vulnerability and threat management

Automatic security updates are enabled across operating systems, browsers, applications, and hosting platforms, and applied promptly where manual action is needed. We monitor and act on security advisories from our providers, including TikTok Shop. Application dependencies are kept to a deliberate minimum, which reduces what must be tracked, and are updated when an advisory affects them. Provider security notifications and sign-in alerts are enabled so unexpected activity surfaces quickly.

Certifications

We have not obtained ISO 27001, ISO 27701, SOC 2 Type 2, ePrivacy, or other industry-acknowledged certifications. We are a two-owner company operating no servers of our own. The controls described here are the controls we actually apply, stated plainly rather than claimed against a standard we have not been audited against.

Purpose

This policy governs how we handle personal data in every capacity, and applies to both owners and to any future employee or contractor.

Collection

We collect personal data only with a lawful basis and only for a stated purpose. Creator data reaches us only after that creator has explicitly authorized our application through TikTok's own authorization flow, and that authorization can be withdrawn at any time.

Storage and transfer

Personal data is stored in the United States, encrypted at rest, and transferred only over encrypted connections. We do not transfer personal data to third parties for their own purposes.

Retention and deletion

We keep personal data only as long as the purpose requires, plus any period the law obliges. At the end of any contractual relationship we delete all collected customer and creator data in our possession, and confirm that deletion in writing on request.

Assisting sellers and TikTok Shop

We will assist sellers and TikTok Shop with requests to delete, update, or provide data in response to a user's request, and will act on such a request without undue delay upon receiving it. We confirm in writing once a deletion has been carried out.

Training and review

Both owners review this policy on adoption and at each annual review. We maintain ongoing awareness of phishing, credential handling, and device security, and treat any incident as a training occasion. We review this policy and our access list annually, and exercise the incident response procedure below.

Roles

The Managing Owner serves as incident lead, responsible for assessment, containment, notification, and the written record. The second Owner serves as incident lead should the Managing Owner be unavailable.

How to report one

Anyone at all, whether a creator, a seller, a customer, or a member of the public, may report a suspected incident to hello@harrizonadream.com. We acknowledge reports within one business day.

What we do

• Detect and record. The report or alert is logged with the time, what was observed, and who observed it.
• Contain. Affected credentials and application secrets are rotated, affected sessions and tokens revoked, affected accounts suspended.
• Assess. The incident lead determines what data was involved, whether personal data was exposed, and who is affected.
• Notify. Where personal data is or may be involved, we notify TikTok Shop and any affected seller without undue delay and within 24 hours of becoming aware, through Partner Center and by direct email to known contacts. Affected individuals and the relevant supervisory authorities are notified where legally required, within the deadlines the applicable law sets.
• Remediate and review. We correct the cause and review the incident in writing, so the cause is addressed rather than only its effect. This policy is reviewed after every incident.

We keep a written record of every incident, including those that do not meet a notification threshold.

History

In the past three years we have not experienced any breach of security leading to the accidental or unlawful exposure of personal data that we notified, or were legally required to notify, to a governmental or regulatory authority or to any former or existing customer. In the past three years we have not received any complaint, objection, or similar notice from any data protection or other regulatory authority, or from any former or existing customer or individual, relating to our processing of personal data.

You may ask us to give you a copy of the personal data we hold about you, correct it, delete it, restrict how we use it, object to our use of it, or provide it in a portable form. You may withdraw your authorization of our application at any time, through TikTok or by writing to us.

Send any request to hello@harrizonadream.com. We acknowledge within one business day and answer within 30 days. There is no charge, and you never need a reason.

If you are unhappy with how we handled your request, you may complain to your local data protection authority.

Changes to this page

We review these policies at least annually and after any security incident. The effective date above changes whenever the substance does. Material changes affecting creators who have authorized our application are communicated by email to the address on their account.