Privacy policy

Last updated: November 5, 2026

This policy explains what personal data Criapost processes, why, who it is shared with, how long it is kept and what your rights are. It follows Brazil's General Data Protection Law (LGPD, Law 13,709/2018) and the European Union's General Data Protection Regulation (GDPR).

1. Controller and contact

BRACOD LTDA (Bracod Technologies), CNPJ 69.701.364/0001-03, Guarulhos, SP, Brazil. Data protection officer (DPO): Gustavo Henrique de Sousa Sobral, [email protected].

2. Data we process

• Account: email, password (stored only as a strong hash, never in plain text), interface and content language, theme preference.
• Sign in with Google or GitHub: your account identifier at the provider and the email it reports. We never receive your password at the provider.
• Profile of each brand: name, Instagram handle typed by you, photo, logo, palette, niches, tone of voice, voice notes and the brand reference images you upload.
• Content: the text you write to generate pieces and scripts, the generated images and captions, the reference images you attach to a piece, the images in your library, schedules and reminders.
• Videos: the videos you upload, video editor projects and rendered videos. The file is kept as you uploaded it, with any metadata it carries (for example, a location recorded by the phone). When you ask the editor to play a clip backwards, the server keeps a reversed working copy of that clip, in the same storage as your videos; it does not show up in your library and is never published on its own. Likewise, when you turn on Stabilize or a Voice treatment on a video, the server keeps a treated version (the stabilized copy of the clip, or the video's sound with the treated voice), made on the server itself and used in the preview and the final video; it does not show up in your library, is never published on its own and does not count toward your plan's storage.
• Color LUTs: the .cube files you upload to the editor's "My LUTs", with their name and size; they count toward your plan's storage and apply across all your brands.
• Music and audio analysis: the audio files you upload to the editor's music library, with name and duration, and the map of the silent stretches of each video, computed on the server from the sound level. The map is used to remove pauses and to lower the music under speech.
• Auto captions: only when you ask, in the video editor, the audio of the chosen clip is transcribed by OpenAI (section 4), and the spoken text, with the timing of each word, is stored with the video, so the same clip isn't transcribed (or charged) again. The "Names and terms" you write go as a spelling hint and aren't stored.
• Background removal: only when you turn on the cutout on a video or image in the editor, its frames are analyzed on Criapost's servers, without sending anything to third parties, and the result (the masks of what stays, and the region of the smart brush strokes) is stored with the source file, so the same part isn't analyzed (or charged) again. The analysis separates the person or object from the background: it doesn't identify who appears, doesn't extract biometric data and doesn't train any model. The masks don't count toward your plan's storage.
• Follow the person: only when you turn on "Follow the person" on a video in the editor, Criapost's server computes the position of the faces in the part used (where each face is in the frame and its size, five times per second), so the framing tracks whoever appears. The computation runs on Criapost's servers, without sending anything to third parties. It doesn't recognize who the person is, doesn't store any face descriptor or feature and doesn't train any model: only the position is stored, with the video, so the same part isn't analyzed again.
• Narrations and cloned voices: the narrations you record with the microphone in the editor and the ones you generate with AI, with the text, the chosen voice, the speed and the map of silent stretches; while a take is uploading, it stays stored in your browser until the server confirms. When you clone your voice: the voice sample (10 to 30 seconds), the consent sentence recording and the consent record (the name you declared, the date, the language and the version of the accepted terms). The cloned voice is treated as sensitive personal data, even though Criapost doesn't use it to identify anyone.
• Instagram, TikTok, YouTube, Threads, Facebook and LinkedIn: described in sections 5, 6, 7, 8, 9 and 10.
• AI Assistant: your conversations with the AI Assistant and the actions it proposes, described in section 12.
• Inspiration: the screenshots and captions of posts you save as inspiration, with the @, link and network you provide; the posts you save from the @ search, with their public metrics; the profiles you follow; and the record of your searches, for the hourly limit. The public data of third-party profiles is described in section 5.
• Billing: plan, subscription status and customer identifier at the payment processor. Name, CPF or CNPJ and card details are entered on the processor's page and stay with it, not with Criapost. The processor also receives your account email, which the card subscription is created with.
• Sessions: each active session stores the IP address and user agent in clear text while the session exists, for security and so you can see and end your devices.
• Days of use: the days, in Brasília time, on which your account used Criapost — the date only, with no time, IP, page or browser. The Criapost team sees them in the admin panel, next to the account status, to provide support and measure product use.
• Bug reports: the description you write, the page you were on (without URL parameters), browser, screen size, language, theme, app version and the screenshots you attach.
• Referral program: who referred whom, with the referred person's email masked. If the referred person deletes their account, the masked email is removed from the referral. The invite page shows the referrer's brand name and photo to anyone with the link. For withdrawals, the Pix key (CPF or CNPJ) and the holder's full name you save, and, for each Pix sent, the name and masked document the bank returns as the recipient.
• Anti-fraud: hashes of the email, the Instagram identifier and the IP, described in section 14.
• Abuse protection: the IP address of whoever makes too many requests in a short time, in clear text, when it is temporarily blocked, with the time and length of the block. Only the Criapost team sees it, in the admin panel, to release anyone blocked by mistake. The basis is the legitimate interest in keeping the service up and secure.
• Technical errors: when something fails, an error report with your internal identifier (never your email), the page and the technical steps before the error.

3. Purposes and legal bases

We do not use your data for advertising, we do not sell it and we do not use it to train artificial intelligence models.

4. Who we share it with (processors)

• OpenAI — draws the images. It receives the piece's scene and style description, the palette colors and, in the Full art style, the piece's texts exactly as they will appear in the image and the edit instructions you write. It never receives the inspirations you save. It also receives images: the references you attach to the piece, the library images you choose for it, the brand references (on the plan that uses them), the first frame of the series as a reference for the next ones and, in a local edit, the art and the marked area. For the editor's auto captions, and only when you ask, it receives the audio of the video clip you chose (without the picture) and the "Names and terms" you wrote, which come prefilled with the brand name and you can change, and returns the spoken text with the timing of each word. Other than that, it does not receive the brand name, your handle or any Instagram or TikTok data.
• Google (Gemini API) — plans the content, suggests topics, writes scripts and captions and checks the images. It receives the text you write, the brand's voice notes, niches, tone and palette, a summary of up to three of your earlier pieces, the reference images you attach and the generated images, to check the result and read the texts of Full art. When you create from Inspiration, it also receives the caption, metrics and image of the chosen inspirations (scripts receive only the text). Requests are flagged not to be kept in Google's interaction history; Google may keep data for a limited time for abuse monitoring, under its own terms. When you turn on AI replies in the Direct, it also receives the brand's knowledge base and the text of the latest messages of the conversation it is replying to; when you turn on suggestions for comments, it receives the knowledge base, the post's caption and the thread of the comment it is replying to (section 5). In the AI Assistant, it receives what you write in the chat, the latest messages of the conversation, the screen and the item you have open, what the AI Assistant read from your account, the thumbnail of the images you attach and the public text of Inspiration profiles it looked up, to answer; in the video editor, also the project summary and the video frames it asks for (section 12). On YouTube, when you ask for "Suggest with AI", it receives the title and description you wrote, the video's name and the brand profile, and, for a suggested reply to a comment on a Short, the knowledge base, the Short's title and the thread (section 7). For the Threads text post, it receives the topic and the brand profile and, when you ask, the caption to shorten and the text of a post to describe its image; for a suggested reply to a Threads comment, the knowledge base, the post's text and the thread (section 8); for a Facebook comment, the knowledge base, the post's text and the comment's conversation (section 9). On LinkedIn, when you ask for "Adapt for LinkedIn", it receives the text of the post you are preparing and the brand profile (section 10). Other than that, it does not receive video, audio or data from your Instagram, TikTok, YouTube, Threads, Facebook or LinkedIn account.
• Google (Gemini TTS) — generates AI narrations and the copy of the cloned voice. For narration and preview, it receives the text you have narrated and the chosen voice; for cloning, the voice sample and the consent sentence recording. Criapost requests the voice copy without Google storing it: it returns a short-lived key (7 days), kept encrypted at Criapost and remade from the stored sample when it expires. Requests follow Google's Gemini API terms, which may retain data for a limited time to monitor abuse.
• Meta — publishing to Instagram, reading the connected account's data sending and receiving Direct messages and reading, replying to, hiding and deleting comments on your posts (section 5).
• TikTok — publishing to TikTok and reading the connected account's data (section 6).
• Google (YouTube) — publishing to YouTube and reading the connected channel's data, through the YouTube API Services (section 7).
• Meta (Threads) — publishing to Threads and reading the connected profile's data, the replies to the posts Criapost published and the metrics (section 8).
• Meta (Facebook) — publishing to the Facebook Page and reading the connected Page's data, the comments on the posts Criapost published and the metrics, and replying to, hiding and deleting those comments (section 9).
• LinkedIn — publishing on your profile and on the connected company Page, reading the profile and Page data and metrics and, on the Page, reading, replying to and deleting comments on posts (section 10).
• Google and GitHub — social sign-in, when you choose to sign in with them.
• Mercado Pago — payment and subscription processing (card, Pix and Mercado Pago balance), in Brazil. It receives the plan, the amount, our internal identifier of each charge and your account email, which the card subscription is created with, and it sends you its own receipt for each payment. For referral program withdrawals, it receives the Pix key and the amount of each transfer. Until October 2026, payments were processed by Asaas, which keeps the data of the payments made through it (the plan, the amount and our internal identifier of your account).
• Resend — email delivery: email confirmation, password reset, email change, billing and price change notices, account block or unblock, and referral program notices (Pix key change and withdrawal sent).
• Sentry — technical error reports, from the browser and the server, with your internal identifier and without your email.
• Hostinger — hosting of the server where the application, the database, the files and the backups live, in Brazil.

Videos are processed on Criapost's own server: no third-party service converts or analyzes your videos. The exception is auto captions, which you ask for: only the audio of the chosen clip goes to OpenAI to be transcribed (section 4). Fonts are also served by Criapost; no browsing data is sent to font services.

5. Instagram

The connection uses the official Instagram API (Instagram API with Instagram Login) and requires a Business or Creator account. Each brand on your account can connect one Instagram account, which may belong to someone else when they authorize you to publish on their behalf; what follows applies to each connected account. You grant the permissions instagram_business_basic (profile and media), instagram_business_content_publish (publishing) and instagram_business_manage_insights (metrics) and, when the brand uses Messages and Comments, instagram_business_manage_messages (reading and replying to Direct messages) and instagram_business_manage_comments (reading, replying to, hiding and deleting comments on your posts).

• What we read: account identifiers, username, name, account type, profile photo, number of followers, followed accounts and posts; the 12 most recent posts (image, caption, date, link, likes and comments); and the account metrics (reach, views, interactions, followers gained and lost, link taps).
• What we store: the account identifiers, the username, the access token — encrypted (AES-256-GCM), never sent to the browser — with its expiry, and, for each post made by Criapost, the media identifiers on Instagram, the status and the date.
• What we do not store: photo, followers, recent posts and metrics are read on the spot for the screen and stay at most one minute in the server's memory. Your browser loads the photo and thumbnails straight from Meta's servers.
• To publish, Meta fetches the images and videos from public Criapost addresses with a random, unguessable identifier, together with the caption.
• Data from your Instagram account never goes to any artificial intelligence provider, with one single exception that only you turn on: AI replies in the Direct and in comments, described below. It is used for nothing beyond showing your account, publishing what you asked for and showing and replying to your messages and comments.
• When you disconnect in Instagram → Disconnect, the token, the connection data, the Direct conversations and the stored comments are deleted right away and pending Instagram schedules are cancelled. The history of posts made stays in your Criapost account until you delete it.
• When you remove Criapost in Instagram itself (Settings → Security → Apps and websites), Meta notifies us and the connection is deleted the same way.
• When you ask Meta to delete your data, besides deleting the connection, we delete Meta's identifiers from the post history and the attachments you sent through the Direct, and return a confirmation code, which you can look up in Data deletion.
• The hash of the Instagram identifier used against serial accounts remains (section 14).

Messages (Direct). With the messaging permission, Meta sends Criapost, as they happen, the messages people send to your account through the Direct and the ones your account sends, including from the Instagram app itself. When you connect, we import the 20 latest conversations, with the 20 latest messages of each.

• People who write to you: the data of the people who message your account is theirs. In that relationship, you, or the brand you work for, are the controller, and Criapost processes it as a processor, only to show, store and reply to the conversations at your request.
• What we store: for each conversation, the contact's Instagram identifier, name, @, photo address and whether they follow your account; for each message, the text, the date, who sent it (the contact, you, the Instagram app or the assistant), the reactions, the delivery status and Meta's address for the media and story replies. A message the contact deletes has its content removed.
• Received media (photo, video and audio) is not copied: your browser loads it straight from Meta's servers while the address is valid.
• Attachments you send: the file you send from your device, or the audio you record with the microphone, is stored on Criapost, converted on our own server when needed, and Meta fetches it from an unguessable address.
• AI replies: they only work when you turn them on, per brand, as suggestions or autopilot. Each reply sends Google (Gemini) the knowledge base you wrote, the brand's name, niche, tone and voice notes and the text of the 20 latest messages of the conversation, never the media. The first automatic reply of each conversation tells the contact it was written by the brand's assistant.
• When you disconnect the account, or when Meta tells us the app was removed or a deletion was requested, all conversations and messages of that account are deleted.

Comments. With the comments permission, Meta sends Criapost, as they happen, the comments made on your account's posts. When you connect, we import the comments on the 12 most recent posts, and opening a post in Criapost reads its comments again.

• People who comment: the data of people who comment on your posts belongs to them. As in the Direct, you, or the brand you work for, are the controller, and Criapost processes it as a processor, only to show, store and reply to comments at your request.
• What we store: for each commented post, the identifier, type, caption, the thumbnail address at Meta, the link and the like and comment counts; for each comment, the commenter's identifier and @, the text, the date, whether it is hidden, whether it awaits your reply and the replies you sent. A comment deleted on Instagram disappears from Criapost the next time the post is read.
• Actions: replying publicly, replying privately (a Direct message to the commenter, up to 7 days after the comment), hiding, unhiding and deleting happen on your Instagram account, only when you ask.
• AI suggestions: only work when you turn them on for each brand. Each suggestion sends Google (Gemini) the knowledge base, the brand's name, niche, tone and voice notes, the post's caption and the text of the comment and its thread. The suggestion is a draft: you review and send it.
• When you disconnect the account, or when Meta tells us the app was removed or a deletion was requested, all stored posts and comments of that account are deleted.

Inspiration (@ search). Inspiration's profile search does not use your connection: it runs from a professional account of Criapost's own, through Meta's official API (Business Discovery), and only reaches public data of professional accounts — never personal or age-restricted accounts.

• What we read from a searched profile: identifier, username, name, bio, photo, number of followers and posts, and the 25 most recent posts (image, caption, date, link, likes, comments and views when Meta provides them).
• Where it is kept: in a shared cache, not linked to who searched, refreshed when someone opens the profile after 12 hours and deleted 30 days after nobody follows or opens the profile anymore. Who follows each profile is kept only in the follower's account. Images are shown straight from Meta's servers; a post's image is only downloaded to Criapost when you save it as inspiration.
• What we use it for: showing the posts of the profiles you follow and, when you choose, bringing the caption, metrics and image into the planning of your piece or script (section 4).

6. TikTok

The connection uses the official TikTok API. Each brand on your account can connect one TikTok account, which may belong to someone else when they authorize you to publish on their behalf; what follows applies to each connected account. You grant the permissions user.info.basic, user.info.profile, user.info.stats (profile and numbers), video.list (your public videos) and video.publish (publishing).

• What we read: identifier, username, display name, photo, bio, verified badge, followers, followed accounts, likes and number of videos; your public videos with title, cover, link, date and metrics; and the posting options available to your account.
• What we store: the account identifier, the username, the display name, the photo address, the access and refresh tokens — encrypted — with their expiry, and, for each post, the options you chose (privacy, interactions, commercial content), your consent and the post identifiers on TikTok.
• Numbers and videos are read on the spot and stay at most one minute in the server's memory.
• To publish, Criapost's server sends the video file to TikTok with the title and the chosen options.
• When you disconnect, or delete your Criapost account, we ask TikTok to revoke access and delete the tokens and connection data.

7. YouTube

Criapost uses the YouTube API Services, YouTube's official APIs, to connect your channel and publish your videos as Shorts. By connecting a channel, you also agree to the YouTube Terms of Service, and Google handles your Google account data under the Google Privacy Policy. Each brand on your account can connect one YouTube channel, which may belong to someone else when they authorize you to publish on their behalf; what follows applies to each connected channel. You grant the permission https://www.googleapis.com/auth/youtube (manage your YouTube account), through "Connect with Google" or from your phone, by typing a code at Google.

• What we read: the channel's identifier, name, @, photo and public numbers (subscribers, views and videos); the channel's latest 50 uploads, with title, thumbnail, duration, dimensions, privacy, whether it is made for kids, date and view, like and comment counts, to show your Shorts; the processing status of the videos Criapost uploaded; and, for the Comments screen, the comments and replies on your Shorts from the last 30 days (text, name, photo and channel of the person who wrote them, likes and date), when you open the screen and every 15 minutes, to count those waiting for a reply.
• What we store: the channel's identifier, name, @ and photo address; the access and refresh tokens — encrypted (AES-256-GCM), never sent to the browser — with their expiry and the permissions granted; and, for each post, the options you chose (title, description, tags, category, privacy, made for kids, altered or synthetic content) and the video's identifier on YouTube; for comments, only the comment's and the video's identifiers and their state in Criapost (replied, removed or marked as resolved), deleted after 30 days without showing up in a read, and the channel's number of pending comments.
• What we do not store: the channel's numbers, recent uploads, thumbnails and the text and author of comments are read on the spot for the screen and stay at most one minute in the server's memory (a video's title and format, up to six hours). Your browser loads the photo and thumbnails straight from Google's servers.
• Refresh: the stored name, @ and photo are read again from YouTube at least every 30 days, or deleted.
• To publish, Criapost's server sends the video file to YouTube with the title, the description and the chosen options. Until YouTube completes its audit of Criapost, every uploaded video stays private on the channel.
• On comments, only when you ask, Criapost replies publicly as your channel, removes a comment, or removes it and bans its author from the channel.
• Suggest with AI: only when you ask, the title and description you wrote, the video's name and the brand profile go to Google (Gemini API) to suggest a title and a description (section 4).
• Suggest reply: only when you ask, on a brand with suggestions turned on, the comment's thread (the text and the name of who wrote it), the Short's title, the knowledge base and the brand profile go to Google (Gemini API) to suggest a reply (section 4).
• YouTube data, apart from the thread sent in a reply suggestion you ask for, does not go to any artificial intelligence provider; it is not shared with third parties and is not used for advertising. It is used only to show your channel and publish what you asked for.
• When you disconnect in YouTube → Disconnect, we revoke access at Google and immediately delete the tokens and connection data; pending YouTube schedules are cancelled. The history of the posts made stays in your Criapost account until you delete it.
• You can also revoke Criapost's access at any time on your Google account permissions page. In that case, the connection stops working right away, and the tokens and stored channel data are deleted within 30 days.
• When you delete the brand or your Criapost account, we revoke access at Google and delete the connection.

8. Threads

The connection uses the official Threads API, from Meta. Each brand in your account can connect one Threads profile, which may belong to someone else when they authorize you to post on their behalf; what is described below applies to each connected profile. You grant the permissions threads_basic (profile), threads_content_publish (publishing), threads_manage_replies (publishing the thread, where each post replies to the previous one, and replying to comments), threads_read_replies (reading the replies to your posts) and threads_manage_insights (metrics).

• What we read: the profile's identifier, username, name, photo and bio; your recent posts, with text, media, link and date; the replies to the posts Criapost published, with text, author and date; and the metrics of the profile (followers, views, likes, replies, reposts, quotes and clicks) and of each post.
• What we store: the profile's identifier, username, name, photo address and bio; the access token — encrypted (AES-256-GCM), never sent to the browser — with its expiry, the authorization's expiry and the permissions granted; for each publication, the options you chose (text only for Threads, topic, who can reply, alt text) and the identifiers of the posts on Threads; for the replies you resolve in Criapost, only the identifier and the state, never the text or the author; and the count of pending replies.
• What we don't store: recent posts, replies and metrics are read on the spot for the screen and stay at most 10 minutes in the server's memory.
• To publish, Threads fetches the images and videos of each post from Criapost, through an address that can't be guessed; an image Threads does not accept as it is goes as a JPEG copy.
• Text post and AI: when you ask, the topic you write and the brand profile go to Google (Gemini API) to write the post or the thread; the caption, to shorten it; and the text of a post, to describe its image, which OpenAI draws from that description (section 4). For a suggested reply to a Threads comment, the brand's knowledge base, the post's text and the reply's thread go. Other than that, no data read from Threads goes to AI.
• Threads data is not shared with third parties or used for advertising. It serves only to show your profile, publish what you asked for and handle the comments.
• The authorization you give on Threads lasts 90 days. When it is about to expire, Criapost warns you; once expired, you need to authorize again.
• When you disconnect in Threads → Disconnect, we immediately delete the token and the connection data, and pending Threads schedules are cancelled. The history of past publications stays in your Criapost account until you delete it. You can also remove Criapost on threads.com → Settings → Account → Website permissions: Meta notifies us, and we delete the connection the same way.
• Deletion request through Meta: as with Instagram (section 5), we delete the connection and the identifiers of the Threads posts from the publication history, and return a confirmation code.

9. Facebook

The connection uses Meta's official Facebook Pages API, through Facebook Login for Business. Only Pages can be connected, never a personal profile. Each brand in your account can connect one Page where you are an admin or have content access; what is described below applies to each connected Page. You grant the permissions pages_show_list (list your Pages, so you can pick one), pages_read_engagement (read the Page, its posts and followers), pages_manage_posts (publish), pages_read_user_content (read the comments on posts), pages_manage_engagement (reply to, hide and delete comments) and read_insights (metrics).

• What we read: your identifier in Meta's app and the list of Pages you manage, with the name, picture and the tasks you have on each, only so you can pick the Page; from the chosen Page, its identifier, name, link, picture and follower count; the Page's recent posts, with text, image, link and date; the comments on the posts Criapost published, with text, author and date; and the Page metrics (views, engagement, visits and new followers) and each post's metrics.
• What we store: the Page's identifier, name, link and picture address; your identifier in Meta's app, to handle Meta's requests and to remove the permissions when you disconnect; the Page access token — encrypted (AES-256-GCM), never sent to the browser — and the granted permissions; for each publication, the caption you wrote just for Facebook and the identifiers of the post, photos and video on the Page; for the comments you resolve in Criapost, only the identifier and the state, never the text or the author; and the count of pending comments. Your Facebook account token is not stored. When you manage more than one Page, the list with their tokens stays encrypted for at most 10 minutes, until you choose.
• What we don't store: recent posts, comments and metrics are read on the spot for the screen and stay at most 10 minutes in the server's memory.
• To publish, Meta fetches each post's images and videos from Criapost, through an unguessable address; an image the Page doesn't accept as it is goes as a JPEG copy.
• AI: for a suggested reply to a Facebook comment, the brand's knowledge base, the post's text and the comment's conversation go to Google (Gemini API) (section 4). Other than that, no data read from Facebook goes to AI.
• Facebook data is not shared with third parties or used for advertising. It is used only to show your Page, publish what you asked for and handle comments.
• When you disconnect in Facebook → Disconnect, we immediately delete the token and the connection data, remove Criapost's permissions at Meta (unless another brand of yours uses the same Facebook account) and cancel the pending Facebook schedules. The history of past publications stays in your Criapost account until you delete it. You can also remove Criapost on Facebook, in Settings → Apps and websites: Meta notifies us, and we delete the connections the same way. A connection that loses access is deleted within 7 days.
• Deletion request through Meta: as with Instagram (section 5), we delete the connections and the identifiers of the Facebook posts from the publication history, and return a confirmation code.

10. LinkedIn

The connection uses LinkedIn's official APIs. Each brand in your account can connect your personal profile and, once the Pages connection is available, one company Page where you are an admin or content editor; what is described below applies to each connected brand. Through the profile connection, you grant openid and profile (your identifier, name and photo), email (requested by LinkedIn's sign-in; we don't store the email) and w_member_social (publish on your profile). Through the Pages connection, the permissions of LinkedIn's Community Management API: publish on the profile and the Page, read your basic profile, list the Pages where you have a role, read the Page and its followers, read the metrics of your posts (r_member_postAnalytics) and the Page's, and read, reply to and delete comments on the Page's posts.

• What we read: your LinkedIn identifier, name and photo; the list of Pages where you are an admin or content editor, with name and role, only so you can pick the Page; for the chosen Page, the identifier, name, address and follower count (the latter only if you are an admin); on the Page, the posts from the last 30 days and their comments, with the text, the commenter's name and the date; and the metrics: of your posts (impressions, reach, reactions, comments, reposts and followers gained) and, if you are an admin, of the Page and its posts (impressions, clicks, reactions, comments, shares, visits and followers gained), always as totals, without saying who saw or reacted.
• What we store: your identifier, name and photo address; the identifier, name, address and your role on the chosen Page; the access and refresh tokens — encrypted (AES-256-GCM), never sent to the browser — with their expiry and the permissions granted; for each post, the text and document title you wrote just for LinkedIn and the post's and media's identifiers on LinkedIn; for comments, only the identifier and the state (resolved or not), never the text or the author; and the count of pending comments. When you have a role on Pages, their list (without tokens) is kept for at most 10 minutes, until you choose.
• What we don't store: the Page's posts, the comments and the followers are read on the spot for the screen and stay at most 1 minute in the server's memory; the metrics, at most 10 minutes. When LinkedIn tells us about a new comment on the Page, we use that notice only to update the pending count.
• To publish, Criapost sends LinkedIn the images, the video and, for a carousel, a PDF document built on the server from the piece's images. Nothing is published unless you ask: every post and every schedule starts with you, with the text you reviewed.
• AI: "Adapt for LinkedIn" sends Google (Gemini API) the text you are preparing and the brand profile (section 4), and the adapted text comes back for you to review before publishing. LinkedIn comments never go to the AI, and neither does any other data read from LinkedIn.
• LinkedIn data is not shared with third parties or used for advertising. It serves only to show the connection and its performance, publish what you asked for and handle the Page's comments.
• Validity: through the profile connection, LinkedIn grants access for 60 days, with no renewal; we let you know by email and in the app 7 days before it expires. Through the Pages connection, access renews itself until the date LinkedIn allows.
• When you disconnect under LinkedIn → Disconnect, we immediately delete the tokens and the connection data, ask LinkedIn to revoke access (unless another of your brands uses the same profile), delete the comments' state and cancel the pending LinkedIn schedules. The history of posts already made stays in your Criapost account until you delete it. You can also remove Criapost on LinkedIn, under Settings → Data privacy → Other applications; LinkedIn doesn't tell us about that removal, and the connection is deleted up to 7 days after LinkedIn refuses access or it expires.

11. Connected AI apps

You can connect Criapost to an AI platform you use, such as Claude, ChatGPT or Cursor, to ask from the chat for what you would do in the app: see and create pieces, schedule and publish. You make the connection yourself, on a Criapost screen where you choose what the app will be able to do (see your content, create and schedule, publish now).

• What goes out, and at whose request: when the AI calls Criapost at your request, Criapost sends it what that action needs: the brands and their profile (name, niches, tone, palette), the Pixel balance, the pieces with caption, text and images, the image library, the videos and the calendar. The AI platform is not a Criapost processor: it handles this data under its own policy, in the agreement you have with it.
• What we keep: the connection (the app, the domain it returns to, the permissions, the date and the last use), the access tokens — stored as a hash, never in clear text — and a daily count of calls, without saying who called or what. The technical record of each call has the app, the action, the duration and the result, never what you wrote.
• Photos sent from the chat: when you send a photo through the upload link or the AI app, it goes into your Images library, without its location, like a regular import.
• Video editor: when you ask the AI to create or edit a video in the editor, Criapost also sends the project summary (items, times, texts and captions) and, when it asks, video frames as small images, made on the spot and kept only in the server's memory for up to 10 minutes. Before each edit made by the AI, we keep the project's previous version, so you can undo it.
• How to revoke: in Settings, on the Connected apps tab, "Disconnect" cuts access right away. Resetting the password, signing out of all devices, blocking and deleting the account also disconnect every app.

12. AI Assistant

The AI Assistant is Criapost's AI chat, on the AI Assistant page and in the bubble in the corner of the screen. It answers from Criapost's help and from what it reads in your account and, on the plans that include the AI Assistant, it can take actions for you. On the other plans, the bubble is the Assistant, which reads and answers the same way but takes no actions and has no page. It is an artificial intelligence: it can be wrong.

• What it reads: only when the request needs it, and only from your account. It can read your brands and their profiles, the Instagram and TikTok connections and their status, the plan, your Pixel balance and your latest payments (amount, date and status, without card details), your pieces, the image library, your videos, your schedule, the posts that failed and your Inspiration, which includes the public text of the profiles you follow or look up. It does not read the Direct or comments.
• What it does: at your request, what you would do on the screens: generate pieces and scripts, change the caption, schedule, publish, create reminders, follow profiles in Inspiration and delete items. What spends Pixels, publishes, schedules or deletes only happens after you confirm on the card it shows, with the cost and the brand. It does not change the account, the password, the plan or the payment.
• Attached images: they go into your image library, with its rules, and a thumbnail goes to Google for the answer.
• Where it goes: the request, the latest 20 messages of the conversation, the screen and the item you have open, the attached thumbnails and what it read go to Google (Gemini API) to write the answer (section 4).
• What we keep: your conversations, each for 90 days after its last message, with the proposed actions and what you decided on each card. Deleting a conversation deletes it right away. We also keep daily numbers (messages, new conversations, unanswered questions, ratings, proposed and confirmed actions, calls by kind of lookup), not linked to any account.
• Who on the team sees it: nobody reads your conversations. The team only sees what you choose to send: the conversation attached to a bug report through "Talk to a person", which follows the bug report rules, and the conversation you send when you mark that an answer didn't help with sharing turned on, kept for 90 days.

13. International transfers

Some processors are outside Brazil and the European Union, including the United States. Transfers rely on the standard contractual clauses approved by the ANPD (CD/ANPD Resolution No. 19/2024) and, for data subjects in the European Union, on the European Commission's Standard Contractual Clauses.

14. Anti-fraud hashes

To stop the same person from repeating the free trial by creating serial accounts, we keep HMAC hashes of the normalized email and the connected Instagram identifier. They are pseudonymized with a server secret key, kept outside the database, so a database leak does not reveal the original data. These hashes remain after the account is deleted and after a deletion request made through Meta, on the basis of the legitimate interest in fraud prevention, for 2 years from the start of the free trial. The IP and email hashes used to limit sign-up and sign-in attempts are deleted within 24 hours.

15. Retention

• Account, profile, logo, photo, brand and piece references, piece texts and captions, scripts, video editor projects, styles and templates and the music library: while the account exists or until you delete them. Versions from before an AI edit: the 10 most recent of each project, deleted with it. A video's silence map is deleted together with the video. The editor's working copies are deleted with the video or after 7 days without being used in any project. Treated versions (stabilized and treated voice) are kept while the video exists and deleted with it or after 30 days without being used in any project; a failed one, after 7 days. LUTs: while the account exists or until you delete them. Auto caption transcriptions: up to 20 per video (the oldest goes), deleted with the video, the brand and the account; the audio sent for transcription is a temporary file, deleted as soon as the transcription ends. Background removal masks: deleted with the source video or image and after 30 days without any project using them. The face positions of "Follow the person": stored with the video and deleted with it, with the brand and with the account.
• Generated images, library images and videos: while the subscription is active and for 90 days after it ends; without a subscription, 90 days after each one is created. Small thumbnails stay in the history. Videos with a pending schedule are kept until they are published.
• Pix key and referral withdrawal history: while the account exists.
• Saved inspirations and the profiles you follow: until you delete them, unfollow or delete the account. Pieces and scripts keep the @, link and caption of the inspirations they used, as credit. Search records: 1 day. Cache of public profiles: 30 days after the last use by anyone.
• YouTube connection: while the channel is connected, with the name, @ and photo read again from YouTube at least every 30 days; a connection that loses access (for example, revoked on the Google account permissions page) is deleted within 30 days. Daily count of YouTube uploads, used for the daily limit: 7 days.
• Threads connection: while the profile is connected; a connection that loses access (expired or revoked authorization) is deleted within 7 days. State of Threads replies (identifier and state only): 30 days after the reply stops showing up. Text posts: while the account exists or until you delete them.
• Facebook Page connection: while the Page is connected; a connection that loses access is deleted within 7 days. The list of Pages to choose from: at most 10 minutes. State of Facebook comments (identifier and state only): 30 days after the comment stops showing up.
• LinkedIn connection: while the profile is connected; a connection that loses access is deleted up to 7 days after it expires or LinkedIn refuses it. The list of Pages to choose from: at most 10 minutes. State of LinkedIn Page comments (identifier and state only): 30 days after the comment stops showing up.
• Direct conversations and messages: 90 days after the conversation's last message, or until you disconnect the account. Attachments sent through the Direct: 30 days. Comments and commented posts: 90 days without a new comment or opening the post, or until you disconnect the account. AI reply knowledge base: while the brand exists or until you delete it.
• Narrations: while the account exists or until you delete them; a take you discard (Record again, Discard) is deleted 24 hours later if no project uses it, and a take whose file never reached the server, within 7 days.
• Cloned voices: the sample and the consent sentence recording stay until you delete the voice or delete the account. The consent record (declared name, date, language, terms version and the date the voice was deleted) stays while the account exists, as proof that consent was given, without the recording.
• Sessions, with IP and user agent: until they expire (30 days unused) or are ended.
• IPs blocked for too many requests: 90 days after the block ends.
• The account's days of use: 13 months.
• Notifications, sent email records and technical records of provider calls (without content): 90 days.
• Bug reports: up to 30 days after being resolved or discarded.
• Conversations with the AI Assistant: 90 days after the last message of each one, or until you delete it. Conversations you sent to the team: 90 days.
• Receipts of deletion requests from Meta, with no personal data: 90 days.
• Backups: daily, stored on Criapost's own server and kept for 30 days. A deleted account's data is removed from backups within 30 days of the deletion.
• Billing records: for the period required by tax law.

16. What happens when you delete your account

We delete the account, profile, pieces, videos, images, schedules, Direct conversations, stored comments, sessions, days of use, the Instagram, TikTok, YouTube, Threads, Facebook and LinkedIn connections (revoking access on TikTok, at Google, on Facebook and on LinkedIn), the connections with AI apps, the conversations with the AI Assistant and all files, and we cancel the active subscription. What remains, with no link to your account: the anti-fraud hashes (section 14), bug reports without your name, without the screenshots and without the AI Assistant conversation, and technical records of sent emails and provider calls until they expire. The steps are in Data deletion.

17. Your rights

You can confirm that processing exists, access, correct, port, request deletion, withdraw consent, object to processing based on legitimate interest and complain to the data protection authority (ANPD in Brazil or your country's authority in the European Union). Most of this is available in the application itself; for the rest, write to [email protected].

18. Cookies and local storage

Criapost uses only the session cookie, strictly necessary to keep you signed in, and, when the video editor opens at its own address (editor.criapost.studio), a security cookie that lives at most 2 minutes, only to carry your sign-in from Criapost to the editor without asking for your password again; the editor has its own session cookie, and signing out of either one ends both. Your browser also keeps usage preferences (theme, language, sidebar state, calendar view, chosen piece style, and at the editor's address also the brand and theme carried over to it) and, for 30 days, the referral code of whoever invited you. There are no advertising cookies and no third-party analytics tools.

19. Security

Strong password hashing, httpOnly session cookie, encrypted connections (HTTPS), encrypted social network tokens, per-user data isolation in the database itself (Row Level Security) and files at unguessable addresses.

20. Changes

Relevant changes to this policy will be announced in the application.