Privacy Policy

1. Who we are

Ciclopost is an online platform to plan, create, schedule and publish social media content. The controller of the personal data processed in Ciclopost is FG LUCAS SOFTWARE E INFORMATICA LTDA, registered under no. 10.139.564/0001-63.

For any privacy matter, including exercising your rights, contact us at [email protected]. This is the channel for data subjects provided for in the LGPD.

2. Data we collect

2.1 Your account

• Nome, e-mail e senha. A senha é guardada apenas em forma de hash criptográfico, que não permite recuperá-la.
• No cadastro, um código de confirmação é enviado ao seu e-mail. Enquanto ele não é confirmado, os dados do formulário ficam guardados por até 1 dia e depois são apagados.
• Plano, valor contratado e cupom usado.
• Preferências de uso, como tema, menu, fuso horário e as etapas do passo a passo inicial.

2.2 The brands you manage

Brand name, network addresses, time zone, guidelines and visual identity, content preferences, plans, posts, captions, images, videos and audio sent by you or generated in Ciclopost, content ideas, goals and reports.

2.3 Instagram and Facebook (official Meta APIs)

When you connect a professional Instagram account, we collect:

• identificador, nome de usuário, nome, foto e números públicos da conta (seguidores, seguindo e publicações);
• o token de acesso concedido por você, guardado criptografado;
• as publicações feitas pelo Ciclopost e as métricas delas, como curtidas, comentários, alcance, visualizações, salvamentos e compartilhamentos;
• os comentários recebidos nas publicações da conta, para mostrá-los no painel e para as respostas automáticas que você configurar;
• as mensagens diretas recebidas pela conta (conteúdo, remetente e data), somente se você ativar as automações de mensagens;
• se a conexão for feita pelo Facebook: a lista de Páginas que você administra, para localizar a conta do Instagram vinculada, e dados públicos das contas profissionais que você pesquisar no Ciclopost.

2.4 TikTok

When you connect a TikTok account, we collect:

• o identificador da conta no Ciclopost (open_id), nome de usuário, nome de exibição e foto;
• os tokens de acesso e de renovação concedidos por você, guardados criptografados;
• as opções de privacidade disponíveis para a conta;
• os vídeos e fotos que você envia para publicação e o resultado de cada publicação.

2.5 Telegram

If you connect the Ciclopost bot on Telegram: the chat identifier and username, the messages, photos, videos and audio you send to the bot (including audio transcription) and the notices Ciclopost sends you.

2.6 Artificial intelligence

• Os textos, imagens, áudios e métricas que o Ciclopost envia aos provedores de IA para gerar ou analisar conteúdo da sua marca.
• As chaves de API dos provedores que você cadastrar, guardadas criptografadas.

2.7 People who interact with your accounts

When operating the integrations, Ciclopost may process data of people who interact with the managed accounts, such as those who comment or send messages, and public data of suggested profiles. Whoever manages the brand must use this data only to manage their own accounts, in accordance with the law and each platform's rules.

2.8 Technical data

Operation logs (posts, errors and automatic actions), access data (date, time and IP address), sign-in attempts and browser and device information needed to keep the session, diagnose failures and protect the account. At sign-in and sign-up, an anti-bot check (Cloudflare Turnstile) analyzes technical browser signals to confirm access is made by a person.

2.9 Support

When you open a ticket: the subject, the messages and images you send, the related brand and screen, the browser used and the support replies.

2.10 Payments

Payments are processed by the contracted payment providers: Banco Inter, for Pix Automático, and Stripe, for credit cards. For Pix Automático, Ciclopost stores the payer's CPF or CNPJ and name, required by the Central Bank for authorization; branch and account details, when you request authorization directly in the bank's app, go only to the bank. Ciclopost doesn't receive or store card details: it stores the plan, amount, extra brands, status and the history of the subscription and charges.

2.11 Public websites

For the features outside social networks (the opportunity sites and competitors you add, platform changes and the brand site audit), Ciclopost reads public web pages, following each site's rules (robots.txt). Social networks are never read this way: there Ciclopost uses only the official API. From these pages we keep only what the feature uses: titles, links, text excerpts, public products and prices and the audit result. In the free tool “Is your site ready for AIs?”, we keep the checked address and the result for up to 1 day, linked only to a code derived from your IP that cannot be reversed, to limit use to 5 sites per day.

2.12 Google Search Console

If you connect Search Console, Ciclopost receives through Google sign-in a read-only authorization (webmasters.readonly) and the account email. We read only the property you choose: the searches that show the site (query, page, clicks, impressions and position), the status of the sitemaps and the indexing of the main pages. The authorization is stored encrypted and you can disconnect whenever you want, in Presence › Google; when you disconnect, the authorization is revoked and the site data is deleted. The brand pages on the Ciclopost domain are measured by Ciclopost's own Search Console account, with no data from your Google account.

The use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This data is used only to show the numbers to the brand, in the agency's recommendations and in the monthly report; it is not sold, not used for advertising and does not train AI models.

2.13 Free tools

The “Best time to post” tool shows aggregated, anonymous numbers on the reach of posts from brands that use Ciclopost, by day and time slot: no brand, post or individual number is shown, and a niche only appears when it has at least 3 brands. In the “Bio generator”, the text you type goes to an AI model (via OpenRouter) only to generate the suggestions and is not stored; we keep only a code derived from your IP, which cannot be reversed, for up to 2 days, to limit daily use.

3. What we use the data for

• Providing the contracted service: create and maintain your account, plan and generate content, schedule and publish on the connected networks, measure results, run the automations you configure and send service notices. Legal basis: performance of a contract (art. 7, V, of the LGPD).
• Security: authenticate access, protect tokens and keys, log operations, prevent fraud and investigate failures. Legal bases: performance of a contract and legitimate interest (art. 7, V and IX).
• Suggestions and analysis: suggest profiles in your niche, analyze your accounts' performance and recommend strategies, using public data and metrics from your networks. Legal basis: legitimate interest (art. 7, IX), respecting the public purpose of the data (art. 7, §§ 3 and 4).
• Ciclopost prospecting: to introduce Ciclopost to businesses, we collect from public directories and websites the name, website, @ and contact email that the business itself publishes, and we read the professional account's public numbers through Instagram's official API. Contact is made by a person, never in bulk. Legal basis: legitimate interest (art. 7, IX).
• Personalization: adapt suggestions to the preferences you show while using Ciclopost. Legal bases: performance of a contract and legitimate interest.
• Legal obligations: keep records required by law and meet tax obligations and orders from authorities. Legal basis: compliance with a legal obligation (art. 7, II).
• Defense of rights: use data in judicial, administrative or arbitration proceedings. Legal basis: regular exercise of rights (art. 7, VI).

We don't sell personal data. Data obtained from Instagram, Facebook and TikTok is used only for the features you asked for: it isn't used for advertising, to build profiles of people outside the contracted service or to train artificial intelligence models, and it isn't shared with data brokers.

4. Who we share it with

• Platforms you connect (Meta, for Instagram and Facebook, TikTok and Telegram): to publish, read metrics, reply and carry out the actions you request. Use of these platforms is also subject to each one's terms and privacy policies.
• Artificial intelligence providers you choose in Ciclopost's settings (for example, Google, OpenAI, OpenRouter, Cloudflare, Alibaba Cloud and Anthropic): only with the content needed for each task. Processing by these providers follows each one's terms.
• Infrastructure vendors, such as hosting, database, file storage, messaging, email delivery (Resend) and bot protection (Cloudflare), which process data on our behalf, bound by confidentiality and security obligations.
• Payment provider, to charge the subscription.
• People you authorize to manage the same brand, who then see that brand's data.
• Public authorities, when there is a court order or legal obligation.
• Successors, in the event of a reorganization, merger, acquisition or sale of Ciclopost, who will remain bound by this policy.

5. International transfer

Some platforms and vendors, such as Meta, TikTok, Telegram and AI providers, store or process data outside Brazil. These transfers happen to deliver the service you purchased and follow art. 33 of the LGPD, with the contractual safeguards offered by these vendors.

6. How long we keep it

• Enquanto a sua conta estiver ativa.
• Ao cancelar a assinatura, a conta fica disponível por 30 dias apenas para exportar os dados ou reativar. Depois desse prazo, os dados da conta e das marcas que só você gerencia são excluídos definitivamente, com todos os arquivos. Se outra pessoa também gerencia uma marca, a marca continua com ela e apenas o seu acesso é removido.
• O arquivo gerado em “Exportar meus dados” fica disponível por 7 dias.
• Ao desconectar o Instagram ou o TikTok, os tokens de acesso são apagados na hora.
• Itens que você exclui no painel, como posts, mídias e automações, são removidos do Ciclopost.
• Alguns dados podem ser mantidos pelo prazo que a lei exigir, como registros de acesso a aplicações de internet (6 meses, pelo Marco Civil da Internet) e documentos fiscais, ou para a defesa de direitos.
• As publicações já feitas nas redes continuam nas redes até você apagá-las no próprio Instagram ou TikTok.

7. How we protect data

Access tokens and API keys are stored encrypted (AES-256-GCM). Passwords are stored only as hashes. Access to each brand's data is restricted to authorized people, connections are encrypted and operations are logged. No system is fully immune to incidents: if a security incident occurs that could cause relevant risk or harm, we'll notify you and the Brazilian National Data Protection Authority (ANPD), as the law requires.

8. Your rights

Under the LGPD (art. 18), you can request:

• confirmação de que tratamos os seus dados e acesso a eles;
• correção de dados incompletos, inexatos ou desatualizados;
• anonimização, bloqueio ou eliminação de dados desnecessários, excessivos ou tratados em desacordo com a lei;
• portabilidade dos dados;
• eliminação dos dados tratados com base no seu consentimento e revogação desse consentimento;
• informação sobre com quem compartilhamos os seus dados e sobre a possibilidade de não consentir;
• oposição a um tratamento que descumpra a lei;
• revisão de decisões tomadas apenas com base em tratamento automatizado.

In My account, in the dashboard, you can export all your data and cancel your account whenever you want. For other requests, contact us at [email protected]. We reply within 15 days. You can also file a complaint with the ANPD.

If you don't use Ciclopost but your data appears because of an account managed here (for example, as a suggested profile or because you commented on or messaged a brand), you can request access, correction or deletion through the same channel, giving your username.

If your business was contacted by us through prospecting, you can ask through the same channel not to be contacted again: we delete the email and keep only the website address and the @, so the business never comes back to the list.

9. How to disconnect your accounts and delete your data

The steps to disconnect Instagram, Facebook, TikTok and Telegram and to delete your account are on the page Data deletion.

10. Cookies and visit measurement

Ciclopost uses only the cookies it needs to work:

• cp_sessao: keeps you signed in to the dashboard;
• ciclopost_tema e ciclopost_menu: remember the theme (light or dark) and whether the menu is collapsed;
• cp_cadastro: links the sign-up to the confirmation code sent by email and expires in 1 hour;
• cp_instagram e cp_tiktok: protect the connection with Instagram and TikTok during authorization and expire right after.

We don't use advertising or third-party tracking cookies.

On public pages (home page, sign-up, sign-in, account first steps and these legal pages), Ciclopost stores a random identifier in your browser (cp_vid) to count visits anonymously: pages viewed, referring site, link campaign, device type, browser and approximate country. The IP address isn't stored in this record. If you create an account, these visits become associated with it. With the Do Not Track or Global Privacy Control signal on in your browser, nothing is recorded.

11. Children and teenagers

Ciclopost is intended for people over 18 and doesn't knowingly collect data from children and teenagers. If you know of an account created by a minor, let us know so it can be removed.

12. Changes to this policy

This policy may be updated. The date of the last update is at the top of the page, and relevant changes are announced in the dashboard or by email.