Data subject rights

01What the LGPD guarantees you

Federal Law 13.709/2018, known as the LGPD, starts from a simple idea: personal data belongs to the person, not to whoever collects it. Anyone processing your data, PostroAI included, has to explain what they do with it and honour your requests. Article 18 lists those requests, and this page is about them.

If the request comes from an address other than the registered one, we will ask you to confirm your identity before answering. It is annoying, and it is what stops someone else from requesting your data while pretending to be you.

02Confirmation of processing

What it is: the right to ask “do you hold any data about me?” and get a yes or a no. It is the most basic of them all, and you do not have to justify anything.

How to ask: write to ola@postroai.com asking for confirmation. We answer saying whether we process your data and, if we do, which categories.

03Access to your data

What it is: receiving a copy of everything we hold about you: account details, your brand data, files you uploaded, generated posts, billing history and access logs.

How to ask: most of it is always at hand inside your account, and you can view and download it whenever you like. You can download the complete set yourself, right away, from Account and plan, using the “Download my data” button: it builds a file with your account details, brands, products, posts, support conversations and billing history. If you would rather receive it by email, just ask.

04Correction

What it is: correcting data that is incomplete, out of date or wrong. A misspelled name, the wrong tax ID, an old email address, a business description that has changed.

How to ask: you can edit most fields yourself in your account settings, on the spot. For data the screen does not let you change (a CPF or CNPJ already used on an invoice, for example), write to ola@postroai.com telling us the correct value.

05Anonymisation, blocking or deletion of unnecessary data

What it is: asking us to anonymise, block or erase data that is unnecessary, excessive, or being processed beyond what the law allows. Anonymising means breaking the link between the data and you, so that nobody can identify you from it again.

How to ask: write to ola@postroai.com pointing out which data you consider unnecessary. We review the request and answer with what was done or, if we disagree, with the reasoning and the legal basis that supports that processing.

06Portability

What it is: receiving your data in a format you can take to another service, or asking us to transfer it directly to another provider.

How to ask: the same “Download my data” button, in Account and plan, delivers everything as JSON, which is an open, machine-readable format. The artwork does not travel inside the file, because there can be hundreds of images; the address of each one does, and they stay downloadable one by one from the Library, at full resolution. If you want the images packaged together or in another format, ask by email. We do not hold you hostage — leaving costs nothing.

07Deletion of your data

What it is: erasing data processed on the basis of your consent, and closing your account with deletion of what we hold.

How to ask: you can close the account from your account page, or ask for deletion by email. Once asked, we delete or anonymise the data within 30 days.

Two important things

• Download your content first. Deleting the account erases the posts, images and calendar stored on the platform, and that cannot be undone. Whatever you have already downloaded remains yours forever, under the commercial licence described in the Terms of Use.
• Not everything can be erased right away. The LGPD itself, in Article 16, allows data to be kept in order to comply with a legal obligation. Invoices and billing records are kept for 5 years, and access logs for 6 months, as required by Brazilian tax law and by the Brazilian Internet Civil Framework. During that period they are stored for that purpose alone, with no commercial use.

08Information about sharing

What it is: knowing who your data is shared with, whether private companies or public bodies.

How to ask: the list by category is already published in the sharing section of the Privacy Policy. If you want detail on a specific case (which provider received a particular piece of your data, and what for), ask by email and we will answer in writing.

You also have the right to know what happens if you say no to sharing that depends on consent. We explain the consequences before you decide.

09Withdrawing consent

What it is: withdrawing, at any moment, permission you had given. At PostroAI, consent covers things like receiving product news by email and allowing your work to appear as an example.

How to ask: every marketing email carries an unsubscribe link that settles it instantly. For everything else, write to ola@postroai.com. Withdrawal is free and takes effect from the moment you ask; what was done before, on the basis of consent that was valid at the time, remains lawful.

Note: withdrawing consent does not cancel your subscription, and does not affect the data needed to perform the contract. If what you want is to close everything, see section 7.

10How to ask, and how long we take

• Channel: ola@postroai.com, subject “LGPD”, sent from the email registered on the account.
• What to write: which right you want to exercise and, where relevant, about which data. One sentence is enough.
• Cost: none. The law forbids charging for it.
• Confirmation and access: we answer in simplified form immediately and, if you ask for the full statement, within 15 days of the request, as set out in Article 19 of the LGPD.
• Other requests: the law speaks of a reasonable period. We commit to answering those within 15 days as well. If a case is complex and needs longer, we tell you inside that window, with the reason and the new date.
• Data Protection Officer: [PREENCHER: nome do encarregado (DPO)], responsible for receiving and handling these requests.

11When we may refuse a request

The rule is to comply. But there are situations in which the law itself stops us from doing what was asked, and in those cases we answer explaining why, with the legal basis:

• When we cannot confirm that the request really came from you.
• When keeping the data is a legal or regulatory obligation, as with tax and access records.
• When complying would breach a trade or industrial secret, or another person’s rights.
• When the data is indispensable for defending rights in ongoing judicial, administrative or arbitration proceedings.

12If you disagree with our answer

First, reply to our email saying why. We review the case: most of the time it is a misunderstanding that a conversation clears up.

If you are still not satisfied, you have the right to petition against PostroAI before the Brazilian National Data Protection Authority (ANPD), at gov.br/anpd, and also to turn to Brazilian consumer protection bodies. That is guaranteed by Article 18, paragraph 1, of the LGPD, and we will not make it difficult in any way.