Niumedia
中文|English

Bulllet Drama Privacy Policy

Effective Date: August 5, 2026

Data Controller & Operator: Niu Media Limited This privacy policy is compiled by referring to mainstream overseas mini-drama platforms (ReelShort, ShortMax, NetShort), fully compliant with TikTok Developer Agreement, GDPR (EU/UK), CCPA/CPRA (California), global regional data protection laws, exclusively for public display on TikTok Bulllet Drama Mini Program.

Introduction & Acceptance

1.1 Bulllet Drama is a TikTok Mini Program operated exclusively by Niu Media Limited, providing mini-drama playback, episode unlocking, rewarded advertisement viewing, personalized content recommendation and user comment interaction services. This Privacy Policy governs all personal information collection, usage, storage, transmission and disclosure behaviors when you access and use Bulllet Drama within TikTok. 1.2 By logging in, browsing, watching dramas, making payments, posting comments or using any functions of Bulllet Drama with your TikTok account, you fully acknowledge reading, understanding and agreeing to all clauses of this Privacy Policy. If you disagree, please stop using our service immediately. 1.3 This Privacy Policy is supplementary to our Terms of Service and TikTok Community Guidelines. TikTok’s global privacy rules apply synchronously to your account basic data authorized to us. 1.4 We reserve the right to revise this policy regularly. Updated versions will be posted on the Mini Program homepage with updated date marked; continuous use after revision release equals your automatic acceptance of new clauses. We will not arbitrarily reduce your legitimate privacy rights without your explicit consent.

Definition & Age Limitation

2.1 Definition

  • Personal Information: Any information that can directly or indirectly identify your specific identity, including account identifiers, device information, behavioral records, location data and comment content.
  • Anonymous Data: Desensitized, aggregated statistical data that cannot locate individual users, which is not restricted by personal information protection regulations.

Minor Protection Rule

  1. Users under 18 years old are defined as minors; users under 13 shall not use our paid unlocking and personalized recommendation functions.
  2. We will not actively collect personal information of users under 13. Once underage illegal registration is confirmed, we will clear relevant user data and limit account access immediately.
  3. Minors aged 13–17 can only use the service under legal guardians’ supervision and consent; independent recharge and paid consumption by minors are prohibited.

Information We Collect & Collection Sources

We only collect the minimum necessary information to guarantee normal service operation, consistent with the collection standard of top drama platforms. We will never actively collect sensitive privacy data such as biometrics, health information and private identity documents.

3.1 Information Authorized by TikTok Account (Passive Authorized Collection)

We obtain limited public profile data bound to your TikTok account after your authorization:

  1. Unique TikTok open ID (only used for account binding login, no independent phone number/real-name information acquisition);
  2. Public avatar, display nickname;
  3. User region, language preference (for multi-language drama adaptation).

3.2 Active Behavior Data Generated During Use

  1. Viewing records: playback history, favorite collections, episode progress, browsing duration, clicked drama tags;
  2. Interactive content: public comments, likes, collection behaviors you post on the platform;
  3. Transaction order data: order serial number, purchase time, unlocked episode list, payment channel feedback status.

3.3 Automatic Device & Technical Data

Automatically collected by system background for anti-cheating, crash repair and service optimization:

  1. Device model, system version, advertising identifier (IDFA/GAID), IP address;
  2. Service crash log, network access status, anti-crawler & anti-cracking security log;
  3. Anonymous statistical data of page stay, click trajectory.

3.4 Important Note

  • We never collect bank card, credit card, wallet password and other sensitive payment information. All recharge & payment processes are completed on official TikTok payment channel; we only receive order results, without access to specific payment credentials.
  • Precise real-time geographic location will only be collected after your explicit consent; we only use rough regional positioning by default.

Purpose & Legal Basis of Data Usage

4.1 Main Usage Scenarios

  1. Account identification & login verification, binding your TikTok identity to Bulllet Drama account;
  2. Provide core services: drama playback, episode unlocking, favorites collection, viewing record synchronization;
  3. Order management: record purchase records, handle after-sales verification, exception deduction refund review;
  4. Platform optimization: analyze user viewing preferences, optimize drama recommendation algorithm, fix system bugs;
  5. Risk control & security protection: prevent account theft, cracking, plug-in brushing, copyright infringement and illegal malicious behaviors;
  6. Legal compliance: respond to official legal inquiries, fulfill tax and audit obligations;
  7. Advertisement matching: push interest-based rewarded ads (you can turn off personalized ads at any time).

4.2 GDPR Legal Basis for EU/UK Users

We process your data relying on 4 legitimate foundations:

  1. Contract Performance: Data needed to provide drama viewing service;
  2. User Consent: Personalized recommendation, precise advertising, location acquisition; consent can be withdrawn anytime;
  3. Legitimate Interests: Platform security risk control, product optimization, fraud prevention;
  4. Legal Obligation: Comply with local judicial supervision and regulatory requirements.

Information Sharing, Disclosure & Transmission

We will not sell your personal information to any third party for profit permanently, consistent with ReelShort & NetShort public commitments. Information sharing is limited to the following legal scenarios only:

5.1 Authorized Trusted Service Partners

We share limited anonymous/encrypted data with qualified third-party service providers under signed confidential agreements, all partners are bound by data protection contracts:

  1. Payment service providers: TikTok official payment channel;
  2. Cloud server & CDN providers: responsible for video storage and stable playback;
  3. Advertising & analytics partners: ad network, data statistics tools, only obtain device identifiers for ad delivery and effect statistics;
  4. Technical maintenance providers: system debugging, crash repair services.

5.2 Legal Mandatory Disclosure

We may disclose your information when required by court subpoena, government supervision, judicial investigation and law enforcement requirements.

5.3 Corporate Merger & Asset Transfer

In case of acquisition, merger, business spin-off, we will inform users in advance; user data will still be protected by the same privacy policy after transfer.

5.4 User Voluntary Disclosure

Content you actively publish in public comment areas can be viewed by all platform users; you shall bear risks of voluntary disclosure by yourself.

Data Storage, Retention Period & Cross-Border Transmission

6.1 Storage Location

User data is stored in encrypted cloud servers in compliant global nodes corresponding to user regions.

6.2 Retention Period Principle

We retain personal data only within the shortest necessary cycle:

  1. Account binding information: retain during your account active period; after account cancellation, fully delete within 30 natural days;
  2. Viewing history, comments: reserve for 2 years; users can manually clear records at any time;
  3. Order records: retain for 5 years to meet legal audit and after-sales requirements;
  4. Anonymous statistical data: can be permanently reserved for product optimization without user identification.

6.3 Cross-Border Transmission

For EU/EEA user data cross-border transmission, we adopt EU Standard Contractual Clauses (SCC) to guarantee data security; all cross-border transmission complies with local data export laws.

Data Security Protection Measures

  1. All data is encrypted during transmission and storage with industry-standard AES encryption technology; sensitive identifiers are desensitized and encrypted;
  2. Establish strict internal data access permission system; only designated administrators can access background data, with full operation log records;
  3. Regular security inspection, anti-cracking, anti-leakage technical upgrading to defend network attack and data theft risks;
  4. Once data leakage with high risk occurs, we will notify regulatory authorities and affected users within 72 hours as required by GDPR. Notice: No network system can achieve absolute security; we will try our best to protect your information security, but cannot guarantee absolute zero risk.

User Personal Rights & Exercise Methods

8.1 Universal Global User Rights

  1. Access Right: Request to inquire what personal data we have collected about you;
  2. Correction Right: Modify wrong and incomplete public information;
  3. Deletion Right (Right to be Forgotten): Apply to clear personal data or cancel account authorization;
  4. Consent Withdrawal: Turn off personalized recommendation, ad tracking and location authorization anytime;
  5. Restrict Processing: Request to suspend non-essential data collection;
  6. Data Portability: Obtain readable personal viewing and order data.

8.2 Special Rights for EU/UK Users (GDPR)

You have the right to lodge complaints with local data protection supervisory authorities; we will reply to all legitimate user applications within 30 calendar days.

8.3 Special Rights for California Residents (CCPA/CPRA)

  1. Right to know: Query data collection types, usage purposes and shared third-party lists in the past 12 months;
  2. Right to delete: Request to erase your personal information stored by us;
  3. Anti-discrimination clause: We will not restrict service permissions because you exercise privacy rights;
  4. Opt-out right: Since we never sell user data, there is no additional sales opt-out requirement.

8.4 Operation Channel

You can submit all privacy right applications via official dedicated mailbox: [Fill in your official email address later]. We will verify your identity first before processing requests.

Cookies & Tracking Technology Description

  1. Bulllet Drama Mini Program itself does not deploy independent cookies; third-party advertising and analytics partners may use pixel tags, device identifiers for ad statistics;
  2. You can turn off ad tracking permission in TikTok system privacy settings or mobile device system settings;
  3. Closing personalized tracking will not affect normal drama playback functions, only make advertisements less targeted.

Third-Party Links & Advertisement Disclaimer

  1. Rewarded ads jump to third-party external pages, which are not under our control. Third-party platforms are governed by their own privacy policies, and we are not responsible for their information collection behaviors;
  2. We do not assume liability for information leakage caused by users accessing unknown external links from advertisement pages.

Policy Update & Contact Information

  1. We will mark the latest update date prominently on the top of this privacy policy after revision; important changes will be reminded through Mini Program homepage notice;
  2. Official Controller: Niu Media Limited
  3. Official Support Mailbox (for privacy consultation, data request, complaint): [Reserved mailbox position]
  4. If you have any questions about this Privacy Policy, please contact our customer service team via the above mailbox.