Nordic ConnectThe same three rules apply to every platform on this page.
The account owner authorises it
A connection is only ever made by someone who already controls that account, on the platform’s own OAuth consent screen. We never ask for a password, and we cannot connect an account on someone’s behalf.
Only within the permissions granted
We request the narrowest set of permissions the connected features need, and the platform enforces them. If publishing was not authorised, the app cannot publish — there is no second route to the data.
Revocable at any time
The client can disconnect inside Nordic Connect, or revoke from the platform’s own settings. Either way access stops immediately, the stored token is deleted, and we delete the associated platform data on request.
Access tokens are stored encrypted, one workspace's data is never visible from another, and platform data is used solely to provide these features to the account holder. We do not sell it, do not use it for advertising or profiling, and do not use it to train machine-learning models. The full detail is in the Privacy Policy.
TikTok
Analytics for the connected account, and video publishing where the account owner has authorised it.
- Basic profile information — the account’s open ID, display name, username, avatar image and follower/following counts. This is what labels the account in the interface, so an operator can tell which of several connected accounts they are looking at.
- The account’s own published videos and their view, like, comment and share counts. These become the account’s analytics charts and the figures in the client’s report.
- Before a publish, the account’s own posting settings — the privacy levels it permits, and whether it is eligible for a direct post — so we never offer the account holder an option TikTok would reject.
- Video the account holder has created in Nordic Connect and confirmed for posting, sent to their own TikTok account through TikTok’s Content Posting API (Direct Post).
Only content a person at the agency composed and confirmed. Never automatic.
Publishing is the one place where Nordic Connect writes to TikTok, so it is worth being exact about how it behaves:
- Nothing is ever posted automatically. A person at the agency writes the caption, attaches the video and confirms the post. A scheduled post is one a person already confirmed, held until its time.
- The privacy level has no default. The composer refuses to publish until the account holder picks one, and the choices offered are the ones TikTok says that specific account is allowed — we do not guess, and we do not fall back to public.
- Interaction settings are the account holder's. Comments, Duet and Stitch are set per post in the composer and sent with the post.
- Commercial content is declared. Where the post promotes the account's own brand or a third party, that disclosure is set on the post, as is a declaration that content is AI-generated.
- A post is not claimed as live until TikTok says it is. TikTok processes video asynchronously; while it is processing, the post stays marked pending in the app rather than shown as published.
The publishing permission is requested on the consent screen only where the account holder is authorising publishing; an account connected for analytics alone grants nothing that can write to it.
Authorised by the account's own owner on TikTok's consent screen, and revocable at any time from TikTok or from inside Nordic Connect.
Instagram and Facebook
Page and professional-account performance through the Meta Graph API.
- The list of Facebook Pages and linked Instagram professional accounts the connecting user manages, so they can choose which ones this workspace covers.
- Page insights — follows, new follows, post engagements and page views — and the equivalent Instagram account and media insights.
- Basic profile details for the connected Instagram account, and post-level engagement for its published media.
- Where the agency connects an account for ad reporting (and only then), the results of the client's own ad accounts — spend, impressions, clicks and results per campaign and day — through the Marketing API, read-only.
- Images, video and Reels the agency has composed and confirmed, to the connected accounts, where the account owner has granted the publishing permission.
- Removal of a post the account holder unpublishes from Nordic Connect shortly after it went out.
Only content a person at the agency composed and confirmed. Never automatic.
Authorised by the account's own owner on Instagram and Facebook's consent screen, and revocable at any time from Instagram and Facebook or from inside Nordic Connect.
YouTube
Channel statistics and real analytics, plus uploads the client prepared here.
- The connected channel’s public statistics — subscribers, views and video counts — to identify and chart the channel.
- The channel’s own analytics: views, subscribers gained, estimated watch time and engagement, through the YouTube Analytics API, and the channel’s daily thumbnail impressions from the reach reports YouTube generates for it through the YouTube Reporting API.
- Video the client has prepared and confirmed in Nordic Connect, uploaded to their own channel with the title, description and privacy setting they chose.
- Removal of a video the client unpublishes from Nordic Connect shortly after upload.
Only content a person at the agency composed and confirmed. Never automatic.
Authorised by the account's own owner on YouTube's consent screen, and revocable at any time from YouTube or from inside Nordic Connect.
X
Public figures read with our own app credentials; the account’s authorisation is what allows posting.
- Follower counts and per-post engagement (likes, reposts, replies and quotes) for the profile being tracked, and for any competitor profiles the client has added. These become the account’s charts.
- These reads are made with Nordic Connect’s own application credentials against X’s public API — they use publicly available data and do not use the connected user’s authorisation.
- Posts the agency has composed and confirmed, with any images or video attached, to the connected account. This is what the account owner’s authorisation is for.
Only content a person at the agency composed and confirmed. Never automatic.
Worth being precise about, because it makes the permission story smaller: connecting an X account with OAuth is what lets Nordic Connect post to it. The analytics above are read from public data using our own app credentials, so an account that is only being measured does not have to authorise anything at all.
Authorised by the account's own owner on X's consent screen, and revocable at any time from X or from inside Nordic Connect.
Google Calendar
Bookings written to the calendar the client already works from.
- Existing events in the mapped calendar, over the window being displayed, so a slot that is already busy is not offered to someone booking.
- An event on the mapped calendar when a booking is made in Nordic Connect, carrying the appointment’s title, time and — where given — the attendee.
- Deletion of that event when the booking is cancelled in Nordic Connect. We only ever delete an event Nordic Connect created.
Only content a person at the agency composed and confirmed. Never automatic.
Only calendars the connected Google account already has edit access to can be written to, and the client chooses which one each bookable calendar maps to. Nordic Connect's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is never used to train AI models, and is deleted when the connection is removed.
Authorised by the account's own owner on Google Calendar's consent screen, and revocable at any time from Google Calendar or from inside Nordic Connect.
Disconnecting and deleting
Disconnecting an account in Nordic Connect deletes its stored access token immediately and stops all further access. Revoking from the platform's own settings has the same effect. To have the data we hold for that account deleted as well, email privacy@nordic.media and we will confirm within 30 days.
Retention periods per data type are listed in the Privacy Policy, and the rules of use are in the Terms of Service.