Privacy Policy

AutoBlog is committed to protecting your personal data. This Policy describes which information we collect, how we use it, with whom we share it and what your rights as a data subject are, in strict compliance with the Brazilian General Data Protection Law (Law 13.709/2018 — LGPD).

1. Who we are

Data controller: AutoBlog — platform operated by a duly registered Brazilian company. For the purposes of the LGPD, we are the Controller of the personal information we process.

DPO contact: [email protected]

2. Data we collect

2.1 Data you provide

• Account: full name, email, password (encrypted), phone (optional);
• Payment: billing data processed via Stripe — we do not store card numbers on our servers;
• Content: niche, keywords, tone and voice instructions, generated posts;
• Integrations: WordPress credentials (encrypted at rest), Google Search Console OAuth tokens.

2.2 Data collected automatically

• Platform usage: pages accessed, actions performed, session time;
• Technical: IP address, browser type, operating system, device identifiers;
• Cookies: authentication, preferences, metrics (details in section 7).

3. Legal bases for processing

We process your data based on one or more of the following grounds from art. 7 of the LGPD:

• Contract performance — to deliver the contracted Service;
• Legal obligation — tax, accounting and regulatory;
• Legitimate interest — security, fraud prevention, product improvement;
• Consent — marketing communications, non-essential cookies.

4. How we use your data

• Operate and improve the Platform (generate articles, publish to WordPress, connect with Google);
• Process payments and send tax receipts;
• Send transactional communications (confirmations, account updates);
• Provide technical support via email, chat or WhatsApp;
• Detect and prevent fraud, abuse and Terms violations;
• Comply with legal and regulatory obligations.

5. Sharing with third parties

We share data only with providers essential to running the service:

• Stripe — payment processing (billing data);
• OpenAI and Anthropic — AI models used in content generation (user instructions, with no identifiable personal data when possible);
• Resend — sending transactional emails;
• Google — OAuth authentication for Google Search Console;
• Pushcut — internal push notifications for operations.

We do not sell your data to advertisers nor share it for third-party marketing purposes.

6. Storage and security

Data is stored on servers located in Brazil and on certified cloud providers (ISO 27001, SOC 2). We apply the following security measures:

• Encryption at rest and in transit (TLS 1.3, AES-256);
• Role-based access control (RBAC) with mandatory authentication;
• Passwords stored with bcrypt hashing;
• Automatic daily backups with a minimum 30-day retention;
• Continuous monitoring of unauthorized access attempts.

7. Cookies

We use essential cookies (authentication, session), preference cookies (theme, language) and analytics cookies (PostHog, Meta Ads). You may manage non-essential cookies through your browser settings. Essential cookies are required for the service to function and cannot be disabled.

8. Your rights (art. 18 of the LGPD)

As a data subject, you have the right to:

• Confirm that processing exists and access your data;
• Correct incomplete, inaccurate or outdated data;
• Request anonymization, blocking or deletion of unnecessary data;
• Port your data to another provider (portability);
• Withdraw consent and delete data processed under it;
• Be informed about sharing with third parties;
• File a complaint with the ANPD (Brazilian Data Protection Authority).

To exercise any of these rights, send an email to [email protected]. We will respond within 15 business days.

9. Retention

We keep your personal data while your account is active and for up to 5 years after closure, to comply with tax and legal obligations. Payment data follows specific tax-law retention periods.

10. Children and adolescents

AutoBlog is intended for users over 18. We do not intentionally collect data from minors. If you have identified that a minor is using the service without legal guardian authorization, contact us so we can remove the data.

11. Changes to this policy

This policy may be updated. Relevant changes will be communicated at least 30 days in advance. The date of the last update is always at the top of the document.

12. Contact

Questions, requests or complaints about privacy? Reach our DPO at [email protected] or open a ticket through the Help Center.