Privacy Policy

1. Who we are

Agência Easy is a management system for marketing agencies (content calendar, production, client approval, finances and social media publishing), operated by 59.585.750 JOSIAS SAGRILO GOULART, Brazilian taxpayer ID (CNPJ) 59.585.750/0001-15, headquartered at Rua Cooperativa, nº 2612, Bairro Bela Vista, Venâncio Aires/RS, CEP 95800-000, Brazil (“we”, “us”, “our”).

This policy applies to everyone who uses the platform: administrators and collaborators of client agencies (user accounts), and the end clients of those agencies who access the Client Portal to approve content.

2. About this policy

This Privacy Policy describes what personal data we collect, why we collect it, how we use it, who we share it with, and what rights you have over it, in accordance with Brazil's General Data Protection Law (Law No. 13,709/2018 — LGPD).

It should be read together with the platform's Terms of Use.

3. What data we collect

3.1 Account data

• Name, email, phone number and profile photo of every registered user.
• Password — never stored in plain text: it is converted into an irreversible hash (bcrypt) before being saved.
• Access profile (administrator or collaborator) and permissions granted within the system.

3.2 Data of the contracting agency

• Legal business name, tax ID, contracted plan and data required to bill the subscription.

3.3 Data of clients registered on the platform

• Name, visual identity (brand colors), reference images, briefings and notes registered by the agency about each of its clients.

3.4 Production content

• Tasks, uploaded artwork, captions, internal comments and approval history exchanged within the platform.

3.5 Third-party integration data

When an agency connects an Instagram or Google account to one of its clients, we collect additional data from those platforms — detailed in sections 4 and 5 below.

3.6 Usage and technical data

• IP address, session identifier (cookie), access date and time, and technical logs used for security (e.g., login attempt limits) and error diagnostics.

4. Instagram (Meta) integration

Permissions requested

• instagram_business_basic — read basic information from the connected business profile (username and account ID).
• instagram_business_content_publish — publish photos, videos, reels and carousels on behalf of the connected account, only when an authorized agency user configures and confirms the publication within the system.

What we do with the access token

The access token granted by Instagram is encrypted at rest (AES-256, with a key exclusive to the production environment, never exposed in the source code) and used only on our servers to publish the content the agency has scheduled. It is never displayed in plain text in the interface nor shared with third parties.

What we read from the connected account

• Username of the connected business profile.
• List of media already published on that account (caption, media type, thumbnail, permalink, publication date, likes and comments) — displayed on the publishing screen for the team's reference.
• Basic view metrics (insights), when made available by the API, to track the performance of posts published through the platform.

What we don't do

• We don't read direct messages (DMs) or account notifications.
• We don't access data from other profiles, followers, or who the account follows.
• We don't publish anything automatically without an explicit action from an authorized agency user.
• We don't sell, rent or share this data with advertisers or any third party beyond what's necessary to provide the service.

How to disconnect

Any agency administrator can disconnect the Instagram account at any time on the client screen, using the “Disconnect Instagram” option. This immediately revokes and deletes the saved token. Disconnection can also be done directly through Instagram/Facebook's own connected apps settings.

5. Google integration

When you link a Google account (optional), we use the data only to:

• View and create calendar events linked to the platform's tasks (Google Calendar).
• Display, within the system, reference videos hosted on Google Drive when a Drive link is pasted as a reference — without downloading or storing the video on our servers.

The Google access token is also encrypted at rest and can be disconnected at any time in “My Account”.

6. Who we share data with

We don't sell personal data. We only share data with service providers strictly necessary to operate the platform (subprocessors), always limited to what's needed to provide the contracted service:

• Infrastructure and database — hosting for the application and the MySQL database.
• Redis — storage of login sessions and technical cache.
• Email provider (SMTP) — sending transactional emails (password recovery, task notifications, approvals).
• Meta (Instagram) and Google — only when the agency chooses to connect these accounts, as described in sections 4 and 5.
• Google Analytics and Meta Pixel — only on the site's public pages (never inside the logged-in system), to measure traffic and ad campaigns, as described in section 10.2.
• Asaas — payment gateway used to process the agency's subscription billing.

We may also disclose data when required by law, court order or a competent authority.

7. Security

• Passwords stored with a bcrypt hash (never in plain text).
• Social media integration tokens encrypted at rest.
• Production connections over HTTPS, session cookies flagged as httpOnly with automatic expiration.
• Access control by profile and by module, restricting what each user can see and change within the system.
• Each agency only accesses its own account data — data from different agencies is kept isolated from one another.

8. Data retention and deletion

We keep data for as long as the agency's account is active, and for the period necessary to fulfill legal, tax or contractual obligations after closure.

Requesting deletion

To request deletion of your account, of a registered client's data, or of any data obtained through the Instagram/Meta or Google integration, send a request to sistema@sistemasope.com.br stating the account/agency and what you want deleted. We confirm receipt and complete the deletion within 30 days, except for data we are legally required to keep (e.g., tax records).

Disconnecting an integration (Instagram or Google) directly on the platform immediately deletes the saved access token, even before any account deletion.

9. Your rights (LGPD)

Under the LGPD, you may request at any time, by contacting sistema@sistemasope.com.br:

• Confirmation that we process your data, and access to it.
• Correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or elimination of unnecessary data, or data processed in violation of the law.
• Portability of data to another service provider.
• Deletion of data processed based on your consent.
• Withdrawal of consent and information about who we share your data with.

10. Cookies and session

10.1 Inside the system (logged-in area)

We use only one essential technical session cookie to keep you authenticated on the platform. It is necessary for the system to function and is not used for advertising tracking or shared with ad networks.

10.2 On the public pages (corporate site)

On the site's public pages — the homepage, the plans page, the account creation page, and these legal pages themselves — and only there (never inside the logged-in system), we use:

• Google Analytics (GA4) — measures how many people visit the site, where they came from (e.g., an ad campaign) and which pages they access, to help us understand what works on the site.
• Meta Pixel (Facebook/Instagram Ads) — records visits and two specific actions: clicking to start creating an account, and completing the sign-up. We use this to measure ad campaign results and to show our ads to an audience more likely to be interested (including audiences similar to those who already became clients).
• Google Ads — attributes sign-ups to campaigns and optimizes ads only when marketing is authorized.

These tools use cookies and browser identifiers owned by Google and Meta, which are also subject to those companies' privacy policies. You can block these cookies at any time through your browser settings, or use the Google Analytics opt-out add-on, without losing access to any feature of the site or the system.

Analytics and marketing are disabled by default. Your preference, notice version, and choice date are stored locally until changed, browser data is cleared, or renewed authorization is required. Consent can be withdrawn through the ‘Cookies’ button.

11. Use by minors

Agência Easy is intended for professional use by marketing agencies and their clients, and is not directed at anyone under 18 years of age. We do not intentionally collect data from children or teenagers.

12. Changes to this policy

We may update this policy periodically to reflect changes in the product or in the law. The date at the top of this page indicates the most recent version. Relevant changes will be communicated to agency administrators by email or a notice within the system.

13. Contact

Questions about this policy or about how we process your personal data: sistema@sistemasope.com.br.