1. Data We Collect
We collect only the data necessary to operate the Service:
- Account data: name, email, profile picture, preferred language and password (hashed) or Google identifier when you use social login
- X data: user ID and username, profile picture, imported public posts, metrics of your published posts and OAuth tokens (always encrypted)
- Voice profiles: text samples, style settings, imported examples and profile versions over time
- Generated content: drafts, approved, edited or rejected posts, generated images and your interactions (ratings, feedback)
- Campaigns and feeds: automatic campaign settings, added RSS feed URLs and imported items
- Support: messages submitted through the support page, including attachments and response history
- Usage data: access logs, product events (via PostHog), AI consumption, limits reached and platform navigation
- Technical data: IP address, device type, browser and session data strictly necessary for operation
2. How We Use Your Data
We use your data to:
- Train and personalize voice profiles with AI, refining them based on your approvals and edits
- Generate drafts, images and variations in your writing style
- Publish content to X only when authorized by you
- Collect metrics from published posts to suggest better times, topics and tone
- Respond to support requests and communicate important updates
- Detect abuse, fraud and protect the integrity of the Service
- Improve Service quality in an aggregated and anonymized way
- Comply with legal, regulatory obligations or court orders
3. X Access Tokens
Access tokens for your X account are encrypted with AES-GCM before being stored. We never store tokens in plain text. You can revoke access at any time by disconnecting your X account inside the Service or in your X account settings.
4. AI and Model Training
To generate content, we send text samples and prompts to AI providers. About this:
- We do not sell or make your private content available for training third-party public models
- We operate via Lovable AI Gateway, which routes calls to models such as Google Gemini and OpenAI GPT as needed
- Providers may retain logs for short periods, per their own policies, for security and abuse purposes
- Whenever possible, we strip personal identifiers before sending data to AI providers
5. Data Sharing
We don't sell, rent or share your personal data with third parties, except with the following operators strictly necessary for the operation of the Service:
- AI providers: for text and image generation, via Lovable AI Gateway (Google, OpenAI and compatible models)
- X API: to import posts, publish content approved by you and collect metrics
- Infrastructure and backend: hosting, database, authentication and file storage via Lovable Cloud
- Email provider: for sending transactional emails (password recovery, support notifications, etc.)
- Product analytics: PostHog, to understand aggregate usage and improve the Service. Not used for advertising
- Image search: public stock image APIs when you use image search
- Legal obligations: when required by law, regulation or competent court order
6. Storage, Security and Access
Your data is stored on secure servers with encryption in transit (TLS) and at rest. We implement Row-Level Security (RLS) in the database to ensure only you can access your own data. Sensitive administrative operations are recorded in audit logs. No system is 100% secure, so we recommend using strong passwords and being cautious with phishing.
7. Cookies and Similar Technologies
We use essential cookies and local storage for authentication, session management, language and theme preferences, and for product analytics (PostHog) operating in aggregate form. We do not use advertising cookies or sell behavioral profiles.
8. Email Communications
We send emails essential to the operation of the Service (transactional), such as confirmations, password recovery and support responses. Informational or marketing emails, when they exist, will always include an unsubscribe option.
9. Data Retention
We keep your data while your account is active. After cancellation, personal data is deleted or anonymized within 30 days, except when we need to retain it to comply with legal obligations, resolve disputes or enforce our Terms. Technical and security logs may be kept for longer periods in aggregated form.
10. Your Rights (LGPD/GDPR-like)
Under Brazil's General Data Protection Law (LGPD) and similar regulations, you have the right to:
- Access and confirm the existence of your personal data
- Correct incomplete, inaccurate or outdated data
- Request deletion, anonymization or blocking of your data
- Withdraw consent for data use at any time
- Request data portability to another provider
- Get information about with whom we share your data
- Object to processing in specific cases provided by law
11. International Transfer
Part of the infrastructure, AI providers and analytics tools used by the Service may operate outside of Brazil. By using the Service, you agree to the international transfer of your data, always with appropriate contractual and technical safeguards, as required by LGPD.
12. Minors
The Service is not intended for users under 18. We don't intentionally collect data from minors. If we identify a minor's account, it will be terminated and the data deleted.
13. Changes to this Policy
We may update this Policy periodically to reflect new features, legal requirements or security improvements. We'll notify you of significant changes by email or within the Service, and continued use after changes constitutes acknowledgment of the new Policy.
14. Contact
To exercise your rights, make requests related to personal data or ask privacy questions, please reach out through the support page inside the platform. We will respond as quickly as possible, respecting legal deadlines.