Privacy Policy

This Policy explains how The Social Media App (the "Service") processes personal data. It applies to the web app, the public API and the MCP server.

Language: the Portuguese text governs for users in Brazil. The English text governs for users outside Brazil. The other interface languages display the English text as a courtesy only.

1. Controller and data protection officer

1.1. The controller of personal data is Rocha Code, registered under CNPJ 41.095.655/0001-78, with its seat at Rua Rio Grande do Norte, 100, Santa Maria, Uberaba/MG, Brazil ("Rocha Code", "we").

1.2. The data protection officer (the encarregado under Brazilian law, DPO) is Rocha Code itself, as a legal person. The officer's channel is [email protected], the same address used for contact and support of the Service.

1.3. We are the controller of your account data, the acceptance records, the financial records and the technical and security records.

1.4. For the content you publish and for the data of the accounts and audiences you manage on social networks, we act as processor (the operador under Brazilian law): we process that data on behalf of the organization that uses the Service and following its instructions.

1.5. Rocha Code is located in Brazil and has not appointed a representative in the European Union or in the United Kingdom. Requests from data subjects in those places can be sent to the officer's channel.

2. Data we collect

2.1. Account. E-mail, password (stored only as a cryptographic digest, never as text), language and time zone. We do not ask for your name at sign-up.

2.2. Organizations and members. Name of the organization and of its workspaces, members and their roles, invitations and, when the inviter provides it, the invitee's e-mail (used only as a label).

2.3. Connected network accounts. The account's identifier on the network, user name, display name, account type, granted permissions and the expiry dates of the authorization. The networks' tokens and app passwords are stored encrypted.

2.4. Content. Posts, texts, images, videos, alternative texts, schedules (with the chosen time zone), each network's options, approvals and publishing consents (who consented and when) and the result of each publication.

2.5. Usage and billing. Plan and subscription status, cost estimates, budget caps, ledger entries, monthly statements, post metrics, webhook subscriptions and deliveries, API keys (prefix, scopes and dates; never the full key) and authorized MCP clients.

2.6. Technical data. IP address, browser (user agent), approximate country and technical operating records. These records do not contain the content of your posts, tokens, e-mails, URL parameters or invitation links.

2.7. Acceptance records. When you accept the Terms of Use or this Policy, we record: who accepted, the document, the version, a cryptographic digest of the text, the language shown, the interface language, the date and time, the IP address, the browser, the approximate country, the source of the acceptance (sign-up or new acceptance) and the invitation used at sign-up, if any.

2.8. Audit log. Relevant actions (for example, publications, connections and member changes) are recorded with identifiers, statuses, amounts and dates. Whoever acted is identified by a user number, not by name or e-mail.

2.9. Cookies. We use essential cookies and, only with your consent, analytics cookies. See the Cookie Policy.

3. Purposes and legal bases

We process data on the legal bases of the Brazilian General Data Protection Law (LGPD, art. 7) and, where applicable, of the European Union General Data Protection Regulation (GDPR, art. 6) and equivalent laws.

Purpose	Legal basis (LGPD)	Legal basis (GDPR)
Create and keep the account, operate the Service, manage the plan and the subscription, connect networks, schedule and publish	Performance of a contract (art. 7, V)	Performance of a contract (art. 6(1)(b))
Record acceptances of the Terms and of this Policy	Compliance with a legal obligation and regular exercise of rights (art. 7, II and VI)	Legal obligation and legitimate interest (art. 6(1)(c) and (f))
Keep financial records and statements	Compliance with a legal obligation (art. 7, II)	Legal obligation (art. 6(1)(c))
Security, abuse prevention, usage limits, technical and audit records	Legitimate interest (art. 7, IX)	Legitimate interest (art. 6(1)(f))
Essential cookies	Legitimate interest and performance of a contract (art. 7, IX and V)	Legitimate interest and performance of a contract (art. 6(1)(f) and (b))
Analytics cookies (Google Analytics)	Consent (art. 7, I)	Consent (art. 6(1)(a))
Answer requests from data subjects and authorities	Compliance with a legal obligation (art. 7, II)	Legal obligation (art. 6(1)(c))

You may withdraw a consent at any time, without affecting the processing carried out before the withdrawal.

4.1. We access each network only through its official API and only with the authorization you grant. Tokens and app passwords never reach the browser or artificial intelligence models.

4.2. On the date of this version, the connections with YouTube, Instagram and TikTok are not yet available. This section describes how they will work once they are released.

4.3. Google and YouTube.

The Service uses YouTube API Services. Google's processing of data follows the Google Privacy Policy.
We ask for the permissions youtube.upload (upload videos) and youtube.readonly (read the channel's data).
We read: the channel's identifier, name and user name, and the processing status of the videos you upload.
We send: the videos you publish, with title, description, tags, category, privacy, the made-for-kids declaration and the synthetic media declaration.
Every upload to YouTube requires your express consent.
The tokens are stored only while the connection exists and are deleted when you disconnect it. The channel's identifier, name and user name stay in the connection record, marked as revoked, until the organization is deleted or you ask for deletion (section 13.2). Every 30 days, we verify the connected channel again.
The reference of each published video (its identifier and link) stays with the publication in the Service until you delete it or delete the organization. We do not read YouTube metrics.
You can revoke access at any time in the Service (by disconnecting the account) or in your Google Account security settings.
The Social Media App's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4.4. Meta and Instagram.

Only professional Instagram accounts can be connected.
We read: the account's identifier, user name and type, the available publishing quota, the link of the posts made by the Service and the account's list of recent posts (only to confirm a publication whose answer was lost).
We send: the images and Reels you publish, with caption, alternative text and the AI-generated content label, when you tick it.
Meta fetches the media file from a temporary link, valid for 15 minutes.
You can remove access by disconnecting the account in the Service or by removing the app in your Instagram settings. You can also ask for data deletion through Meta. In that case, we revoke that account's connections, delete the stored credentials and provide a code to follow the request. See the data deletion page.

4.5. TikTok.

We read: the creator information at the time of posting (nickname, allowed privacy options, maximum video duration and interaction settings) and the processing status of the uploaded videos.
We send: the videos you publish, with title, privacy level, comment, duet and stitch settings and the commercial content disclosure.
Every post on TikTok requires your express consent, with TikTok's Music Usage Confirmation and, where applicable, its Branded Content Policy.
You can revoke access by disconnecting the account in the Service or in "Manage app permissions" on TikTok.

4.6. Bluesky.

The connection uses your user name and an app password that you create in Bluesky. The password is stored encrypted.
We send: the text, link and image posts you make. We read: the public counters of your posts (likes, reposts, replies, quotes and bookmarks).
When you remove the connection, we delete the stored password. Revoke it in your Bluesky settings as well.

5. Artificial intelligence and automation

5.1. The Service does not send your content to artificial intelligence models on its own initiative.

5.2. If you connect an MCP client (for example, an artificial intelligence assistant), that client receives what the Service's tools return: workspaces, connected accounts, drafts, previews, publication status, descriptive data of the media, usage, budget and metrics.

5.3. An MCP client never receives tokens, credentials, passwords, media links or media files.

5.4. The MCP client and the model behind it are operated by their own providers, under those providers' terms and policies. You choose which clients to connect and you can revoke them in Settings, Connected apps.

5.5. An MCP client cannot publish on its own: every schedule or publication needs the approval of a person in the web app.

5.6. We do not use your content or your metrics to train artificial intelligence models.

6.1. We share personal data only with:

Cloudflare, Inc., which protects and delivers the Service's traffic, stores the media and, encrypted, the backups, and forwards the messages sent to our contact address;
Hostinger, which hosts the application and database server in Campinas, São Paulo, Brazil;
Resend, which sends the Service's e-mails (sign-up confirmation, password reset, invitations and account alerts): it receives the recipient's address and the text of the message;
Google, for Google Analytics, only if you consent to analytics cookies;
the social networks you connect (Google/YouTube, Meta/Instagram, TikTok and Bluesky), which receive the content you publish;
the webhook endpoints and MCP clients you configure, which receive the data described in the documentation and in section 5;
Stripe, our payment processor, when you subscribe to a paid plan: it receives your e-mail and your account's internal number (to link the subscription to your account) and, directly on Stripe's pages, your card and billing details, which we neither receive nor store. From Stripe, we keep only the customer, subscription and price identifiers, the plan, the payment status, the end of the period and a scheduled cancellation;
authorities, when the law or a valid order requires it.

6.2. The technical monitoring of the Service runs on our own server, without sending those records to third parties.

6.3. Payments are also handled by Stripe under Stripe's own privacy policy, as an independent controller for its legal payment and fraud-prevention obligations.

6.4. We do not sell personal data. We do not share personal data for cross-context behavioural advertising. We do not use advertising cookies.

7. International transfers

7.1. The application server and the database are located in Brazil, in Campinas, São Paulo (Hostinger). Some of the other providers in section 6 process data outside Brazil, including in the United States and the European Union: Cloudflare (traffic, media, backups and e-mail forwarding), Stripe (payments), Resend (e-mail delivery), Google (Google Analytics, only with your consent) and the social networks you connect.

7.2. These transfers rely on the bases of art. 33 of the LGPD, such as standard contractual clauses, adequacy decisions and the performance of the contract with you.

7.3. For data of users in the European Union and the United Kingdom, the transfers rely on the European Commission's Standard Contractual Clauses, the United Kingdom's International Data Transfer Addendum or adequacy decisions.

7.4. For users in Switzerland, we apply the same clauses with the adjustments required by the Federal Act on Data Protection (FADP). For users in Japan, the transfers follow the Act on the Protection of Personal Information (APPI), with your consent or with equivalent measures at the provider.

8. Retention

Data	How long
Account (e-mail, language, time zone)	While the account exists. After a deletion request, the account is anonymised within 15 days (section 13.4)
Plan and subscription status	While the account exists
Acceptance records	During the account and then for the applicable limitation period
Organization, posts, schedules and media	Until you delete them or until the organization is deleted
Media used in no post	Deleted after 30 days
Original uploaded file, before processing	Deleted right after processing
Tokens and app passwords of connected accounts	While the connection exists; deleted on disconnect
Identifier, user name and display name of connected accounts	Until the organization is deleted or you ask for deletion, even after you disconnect (the connection stays marked as revoked)
Data exports	7 days
Post metrics	400 days
Webhook deliveries	14 days (delivered) or 30 days (final failure)
Financial records (ledger entries, reservations and statements)	5 years after the organization is deleted
Audit log	Indefinitely, with identifiers, statuses, amounts and dates only
Technical records	For a limited period, set in our monitoring system, for security and operation
Backups	Until they roll off: 7 daily and 4 weekly copies on the server and 35 days in the off-site copy
Cookie choice	12 months

A restored backup may bring back data that was already deleted. In that case, the Service runs the deletion again.

9. Security

9.1. We use, among others, these measures:

encryption of the networks' tokens and app passwords (AES-256-GCM);
encrypted connections (TLS);
passwords, API keys and refresh tokens stored only as cryptographic digests;
role-based access control in each organization;
an audit log that cannot be altered;
private media storage, with short-lived links;
re-processing of images and removal of metadata, such as location, from images and videos;
encrypted daily backups, tested automatically;
an operations panel reachable only through a private network.

9.2. No measure is infallible. If a security incident occurs that may cause relevant risk or damage, we will notify the affected data subjects and the authorities, as the law requires.

10. Your rights

10.1. Brazil (LGPD, art. 18). You may ask for: confirmation that we process your data; access to the data; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law; portability; deletion of data processed with consent; information about whom we share it with; information about the possibility of not consenting and its consequences; and withdrawal of consent. You may also object to a processing and petition the National Data Protection Authority (ANPD).

10.2. European Union and United Kingdom (GDPR and UK GDPR). You have the right of access, rectification, erasure, restriction of processing, portability and objection, and to withdraw consent. You may lodge a complaint with the supervisory authority of your country; in the United Kingdom, with the Information Commissioner's Office (ICO).

10.3. Switzerland (FADP). You have rights of access, rectification, deletion and objection, and you may turn to the Federal Data Protection and Information Commissioner (FDPIC).

10.4. Japan (APPI). You may ask for the disclosure, correction, cessation of use and deletion of your retained personal data, and you may turn to the Personal Information Protection Commission (PPC).

10.5. United States (CCPA/CPRA and similar state laws). You have the right to know what data we process, to ask for deletion and correction, and not to be discriminated against for exercising these rights. We do not sell or share personal data for cross-context behavioural advertising, so there is no sale or sharing to opt out of. We honour the Global Privacy Control signal, which changes nothing for you, because we use no advertising technology.

10.6. How to exercise them. Send the request to [email protected] from your account's e-mail. If the request comes from another address, we may ask for a confirmation of identity. You can also, in the Service itself: export a workspace's data (owner and admins); disconnect network accounts; revoke MCP clients; and delete the organization (owner).

10.7. Response times. In Brazil, we answer confirmation and access requests in simplified form immediately, and in complete form within 15 days. In the European Union, the United Kingdom and Switzerland, we answer within one month, extendable in the cases the law allows. In the United States, we answer within 45 days, extendable as the law allows.

11. Children and adolescents

The Service is not intended for persons under 18. If we learn that an account belongs to a person under 18, we will delete or anonymise the account. To let us know, write to [email protected].

12. Cookies and analytics

We use essential cookies for the Service to work and, only if you accept, Google Analytics cookies to measure the audience, without advertising. You can change your choice at any time. See the Cookie Policy.

13. Data deletion

13.1. Organization. The owner can delete the organization in the app by typing its identifier. The deletion stays pending for 7 days and can be cancelled in that period. Afterwards, the Service revokes the connections with the networks, the API keys and the MCP access, deletes the media and the content and removes the members. Only the financial records (5 years) and the audit log are kept.

13.2. Connected network account. You can disconnect the account in the app. We revoke the authorization with the network, where the network allows it, and delete the stored access credential without delay. The identifier, user name and display name of the connected account stay in the connection record, marked as revoked, until the organization is deleted or you ask for deletion at [email protected].

13.3. Instagram. You can also ask for deletion through Meta, as described on the data deletion page.

13.4. Your account. Today, account deletion is done by request to [email protected], from the account's e-mail. Within 15 days, counted from the request or, if section 13.5 applies, from the moment its conditions are met, we anonymise the account: we delete your e-mail and your user name, end the sessions, revoke keys and access and remove your membership of the organizations. We keep only what the law requires or allows us to keep: the acceptance records (to prove the acceptances), the financial records (legal obligation) and the audit log (security and exercise of rights), which identifies you only by a number.

13.5. If you are the only owner of an organization, you will need to transfer ownership or delete the organization before we can remove your membership of it.

14. Changes to this Policy

14.1. We may change this Policy. Each version has a number and an effective date, and earlier versions remain available in the history on this page.

14.2. We announce a new version inside the Service before it takes effect. When the change is relevant, you will have to accept the new version before you continue using the web app.

15. Contact and data protection officer

To exercise your rights or ask questions about this Policy, contact the officer at [email protected]. You may also petition the Brazilian National Data Protection Authority (ANPD).

Rocha Code, CNPJ 41.095.655/0001-78
Rua Rio Grande do Norte, 100, Santa Maria, Uberaba/MG, Brazil
Contact, support and data protection officer (encarregado): [email protected] (24 hours a day; the first reply is automated)