Privacy policy

Who is responsible

Posta Gabi is provided by HEYDATA SERVICOS DE INTERNET LTDA, CNPJ 43.594.813/0001-60, the controller of the personal data described here.

For any privacy matter, including exercising your rights, write to faleaqui@postagabi.com.br. That address is also the channel of the data protection officer required by article 41 of the LGPD, through which we answer data subjects and Brazil's National Data Protection Authority (ANPD).

What data we process

From your Posta Gabi account:

• email address and, if you provide them, name, time zone and language;
• access records: date and time, IP address, browser or device, and actions taken in the account, such as sign-ins, profile connections and API key creation;
• API keys you create, stored only as a cryptographic digest (hash).

From the Instagram profiles you connect through the official Instagram login:

• the profile's identifier and username, account type and profile picture address;
• the access token issued by Instagram, stored encrypted;
• publishing quota and data about posts made through Posta Gabi, such as identifier, link and date.

From the content you upload:

• images and videos, with technical information such as dimensions and duration. Before publishing, we remove file metadata such as location (GPS) and device data;
• captions, alternative text, schedules and the history of each publishing attempt.

From ads, when you connect a business portfolio through Facebook Login for Business:

• the public name and id of the Facebook account used to connect, which Meta returns at login;
• the portfolio, the system user created for Posta Gabi, the permissions granted and the access token, stored encrypted;
• the ad accounts, Pages and Instagram profiles you chose to share, with the name, currency, time zone and status of each ad account;
• the boosts you create: objective, audience (countries and age range), budget, schedule, identifiers and status of the ads at Meta, and the spend reported by Meta;
• if you grant full control of an ad account, billing information for that account, such as whether a payment method exists and the balance, only to show it to you.

We never ask for or store your Instagram or Facebook password. We do not receive card data: ads are paid directly to Meta.

Why we use it and on what legal basis

• To provide the service: creating the account, connecting profiles and portfolios, processing media, publishing, scheduling and boosting content, and showing results. Legal basis: performance of a contract (LGPD, art. 7, V).
• To keep the account and the platform secure, prevent fraud and abuse, and respect Meta's usage limits. Legal basis: legitimate interest (art. 7, IX).
• To keep access records for the period required by Brazil's Internet Civil Framework (Law No. 12,965/2014, art. 15) and meet other legal obligations. Legal basis: compliance with a legal obligation (art. 7, II).
• To send the emails the service needs, such as sign-in codes and account notices. Legal basis: performance of a contract.

When the basis is legitimate interest, you may ask at faleaqui@postagabi.com.br for information about that interest and the data involved.

We do not sell personal data and do not use it for our own advertising.

Who we share it with

Only with those we need to provide the service, and only what is necessary:

• Meta Platforms (Instagram and Facebook): the content you publish and the ads you create go to Meta's platforms through the official APIs and are also subject to Meta's policies;
• Resend: delivery of the service's emails;
• Cloudflare: domain, network protection and email forwarding;
• cloud hosting and storage providers, where the platform and the files are kept;
• public authorities, when there is a court order or a legal obligation.

Some of these providers process data outside Brazil. In those cases, the international transfer follows the grounds in art. 33 of the LGPD, such as contractual clauses and adequate safeguards.

How long we keep it

• Account data: while the account is active.
• Access tokens: deleted as soon as you disconnect the profile or when Meta tells us the access was removed.
• Media: until you delete it or delete the account.
• Access records: 6 months, as required by the Internet Civil Framework.
• After a deletion request, we delete the data within 30 days, except what the law requires us to keep, for the period it sets.

How we protect it

Access tokens are encrypted with AES-256-GCM. Sign-in uses a one-time code sent by email, with no password, and codes and API keys are stored only as hashes. Connections use TLS, access to systems is restricted and sensitive actions are logged.

No system is completely immune to incidents. If one happens that may cause relevant risk or harm, we will notify you and the ANPD, as the LGPD requires.

Your rights

Under the LGPD (art. 18), you may request at any time:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
• portability of the data to another provider;
• information about who we share your data with;
• objection to processing carried out in breach of the law.

To exercise them, write to faleaqui@postagabi.com.br from your account's email address. We reply within 15 days. You may also file a complaint with the ANPD.

We make no automated decisions that affect your interests. Quota and limit checks exist only to respect Meta's rules and do not profile you.

To delete your data, see also the Data deletion instructions.

Cookies

Posta Gabi is an API and does not use cookies or tracking tools on these pages.

Children and teenagers

Posta Gabi is intended for people over 18 and for businesses. We do not knowingly process data from children or teenagers.

Changes to this policy

When this policy changes, the date at the top is updated. If the change is relevant, we will notify you by email before it takes effect.