1. Who we are and scope
MEG@ Multistream is a service within MEG@ Video Streaming, managed under the MEG@-RADIO service brand ("MEG@", "we" or "us"). This policy covers information handled for account management, platform connections, streaming destinations, compositions and related support. Our Terms of Service explain service conditions.
2. MEG@ account and service data
We process the internal user identifier and information provided for your MEG@ account, such as name, email address, country, contact telephone number and player or channel name. Account passwords are stored as hashes, not as readable passwords.
We also process service and subscription identifiers, activation and renewal status, payment references, service requests, support messages and related operational records. Payment gateways process payment credentials under their own policies; MEG@ does not directly store complete card numbers or banking credentials handled by those gateways.
3. Connecting with TikTok Login Kit
If you choose Connect with TikTok, you are redirected to TikTok's official login and consent system and then returned to the registered MEG@ callback. MEG@ does not receive or store your TikTok password.
For the current Login Kit integration, user.info.basic is used to identify and display the account you authorize. Authorized basic information can include your TikTok user identifier (open_id), display name and avatar URL. We store connection dates, token-expiration metadata and the permissions actually granted. The permissions requested are recorded separately from those granted; requesting a permission does not mean it was granted.
The interface displays the connected account's name and avatar when available. An avatar may be loaded from TikTok's image infrastructure, which receives the browser request. A successful account connection does not itself establish LIVE eligibility or authorize a broadcast.
4. Access tokens and refresh tokens
TikTok authorization codes are exchanged for tokens on the server. Access tokens and refresh tokens are managed server-side and stored encrypted using the project's protected-secret storage. They are not returned to customer HTML or JavaScript, browser storage or public account responses.
The authorization persists server-side independently of your MEG@ browser session. When you return to the panel or use its account API, the server reuses a valid access token or attempts renewal when it is expired or within five minutes of expiry. Refresh token rotation and expiration metadata are stored securely. This is on-use renewal, not a promise of continuous background renewal while you are away. You may need to authorize again if TikTok revokes access, renewal expires or required permission is unavailable.
Tokens are not used as a substitute for separate LIVE authorization, and token values are not intended to appear in application or service logs.
5. Optional LIVE Producer configuration
When an eligible, connected account holder separately configures official LIVE Producer credentials, MEG@ processes the RTMP/RTMPS server URL and Stream Key supplied by that user. These credentials are used to validate and deliver the user's authorized stream to the selected destination, not for unrelated purposes.
The Stream Key is stored encrypted and is not subsequently displayed in full. The configuration can be replaced or invalidated. A local validity limit does not guarantee that a platform-issued key remains valid; TikTok may expire or revoke it earlier. Stored destination secrets are made available only to the authorized server-side components needed to operate that destination.
6. Compositions, images and stream content
You may save orientation, framing, zoom, position, uploaded images, text layers and effects for your output. Uploaded assets and composition settings may be stored to reload your editor and generate the output you request. These settings can be maintained separately for each orientation.
When transmission is available and you initiate it, the service processes your main signal and composition and forwards the resulting video and audio to the enabled destination. Do not upload images, text or broadcasts that you are not authorized to use. Disconnecting an external account does not automatically delete your compositions.
7. Technical data, logs and cookies
Technical records may include IP addresses, browser or user-agent information, access times, account activity, security events, audit entries, service health, job states and diagnostic results. These records support security, troubleshooting, fraud prevention and service availability. Logs are not intended to contain access tokens, refresh tokens, passwords or full Stream Keys.
The account area uses necessary session and security cookies, including authentication and request protection; a remembered sign-in may be used if you choose that option. These public legal pages do not require login, create session cookies or load analytics or advertising scripts. External platforms apply their own cookie policies when you visit them.
8. How information is used
- Provide accounts, subscriptions, streaming, compositions and support.
- Authenticate users and identify the external account they authorize.
- Operate only the supported connections and destinations the user configures and enables.
- Protect accounts, enforce access controls, investigate errors and prevent fraud or abuse.
- Manage payments and service communications, maintain availability and comply with applicable legal obligations.
We do not sell personal data to third parties.
10. Retention
Accounts without purchases or PRO history may be removed after at least 90 days of inactivity, following an email warning sent at least 7 days before removal. Inactivity is measured from the latest available registration, authenticated access or service/request activity. Signing in or reactivating a service cancels scheduled removal. Payments, active services, pending requests and resources that have not been retired prevent automatic deletion.
This cleanup does not delete former paying customers or their financial history. Existing minimal DEMO-use history may be retained to prevent repeated trial use. Internal accounts and accounts requiring administrative retention are excluded.
Information is retained according to the purpose for which it is needed, including operating an account or service, maintaining requested compositions, handling support and meeting applicable legal, accounting, security or dispute-related requirements. Different categories may need different treatment; this policy does not promise a single fixed automatic deletion period for all information.
You may request deletion through the contact below. Disconnection and token handling follow the specific process described next. Account deletion, service cancellation and removal of saved compositions are separate actions.
11. Disconnecting TikTok and revoking access
You can disconnect TikTok in the MEG@ Multistream panel. The local account connection, LIVE capability and destination are disabled, the stored local LIVE credential is invalidated and associated TikTok jobs are requested to stop. MEG@ attempts official token revocation.
Active connection tokens and identity are cleared locally before remote revocation is attempted. Retired credentials may remain in a separate encrypted revocation queue solely to retry that request, with limited retry frequency; they cannot be used by the active connection or streaming runtime. A pending remote revocation does not indefinitely block a new connection. Retired retry credentials superseded by a new grant for the same account are removed so an old retry cannot revoke that new connection.
Change account disconnects the existing account before starting a new authorization. The official consent page is requested, and MEG@ rejects a return to the same identity when a different account was explicitly requested. TikTok controls its own login and account-selection interface. Saved Portrait/Landscape compositions, images, text and effects are preserved when disconnecting, changing or reauthorizing an account. Unsaved browser-only edits are not automatically saved by these actions.
You can also revoke permissions through TikTok's own account controls where available. Revocation on TikTok may cause subsequent refresh or account operations to fail and require a new connection. It does not by itself delete your MEG@ account or cancel your subscription.
12. Your choices and privacy requests
Depending on applicable law, you may request access to, correction of, deletion of or other applicable restrictions on your personal information. You can disconnect an external account from the panel and contact us about account or composition deletion. Existing customers may also use account support.
We may need proportionate information to verify that a request concerns your account. We will consider the request under applicable requirements, including information that must be retained. Do not send passwords, tokens, identity-document copies or Stream Keys in an initial email. This policy does not describe an automated self-service deletion feature or promise an unimplemented response deadline.
13. Security
Safeguards include encrypted storage of OAuth tokens and destination secrets, restricted access, account-ownership checks, request validation and controls intended to prevent secrets being exposed in customer responses or logs. Credentials submitted through the service should be sent only over HTTPS. Technical processes handling secrets are restricted to their intended purpose.
No network, storage system or security measure can guarantee absolute protection. Keep your account secure and contact us if you suspect misuse. Never share secrets in screenshots, recordings, public messages or support tickets.
14. Children
The service is intended for users with legal capacity to contract and is not directed to children. We do not knowingly seek children's personal information without an appropriate legal basis. If you believe a child has provided information improperly, contact us so the situation can be reviewed and addressed as required.
15. Policy changes
We may update this policy as features, providers or applicable requirements change. The Last updated date identifies the current version. Material changes will be communicated where required, and additional consent will be requested where applicable.
16. Contact
For privacy questions or requests, contact MEG@-RADIO at ventas@megaradioonline.com and indicate that your message concerns privacy or personal data. Existing customers may also use the support area in their MEG@ account. Do not include passwords, access tokens, refresh tokens or Stream Keys.