postSOMA
This Policy explains, in plain language, what personal data postSOMA processes, why, who we share it with, how long we keep it, and how you exercise your rights. It follows the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018), the Marco Civil da Internet (Brazilian Internet Civil Rights Framework, Law No. 12,965/2014), and the rules of the platforms postSOMA connects to.
1. Who takes care of your data
Controller: DIGITAI SOMA LTDA, CNPJ (Brazilian company taxpayer number) 66.157.922/0001-15, Estrada Otelo Zeloni, 145, Granja Santa Maria, Carapicuíba/SP, CEP (Brazilian postal code) 06351-170. E-mail: contato@digitaisoma.com.
Data Protection Officer (DPO), LGPD art. 41: Caíque Patti da Gama. Contact: contato@digitaisoma.com, subject "Privacidade postSOMA" (postSOMA Privacy).
The DPO receives your requests and complaints, provides clarifications, and receives communications from the ANPD (Brazilian Data Protection Authority).
2. Who this Policy applies to
- People who use postSOMA on the website, the web app, and the apps for iPhone, iPad, Mac, and Android.
- People who are part of a team in postSOMA.
- People who comment on or send messages to accounts connected to postSOMA, when the account owner uses automations (section 11).
- People who visit these pages or write to DIGITAI SOMA about postSOMA.
This Policy does not cover what the social networks, Apple, and Google do with your data in their own services. Each one has its own policy (links in section 17).
3. What data we process
3.1 Sign-up
| Data | Required? | Where it comes from |
|---|---|---|
| Full name | Yes | You provide it (it may be prefilled by Google or Apple, and you confirm it) |
| Yes | You provide it, or Google or Apple send it at login. With Apple's "Hide My Email", we receive a forwarding address | |
| Country | Yes | You provide it |
| CPF (Brazilian individual taxpayer number) or CNPJ | Yes, for people in Brazil. Optional in other countries | You provide it. It is hidden from the team and shown masked to you (***.456.789-**) |
| Date of birth | Yes | You provide it. It is used to confirm you are 18 or older |
| CEP | No | You provide it, if you want |
| Google or Apple account identifier | When you sign in with them | Google or Apple, at login |
3.2 Login and security
- postSOMA password (only for people who sign in with e-mail): stored by the authentication service in protected form (hash). No one at DIGITAI SOMA can read it.
- Verification codes by e-mail (account opening: 2 minutes; password change: 1 minute; account deletion: 2 minutes): the code is stored only as a cryptographic summary (hash), never in plain text. We also record the purpose, the date and time, the number of attempts, the IP address, the type of device or browser, and the sending identifier in the e-mail service.
- Login sessions: technical data to keep you signed in securely.
- Biometrics (Face ID, Touch ID, and similar): checked only on your device. postSOMA never receives or stores your fingerprint, your face image, or any biometric data. We receive only the device's answer: confirmed or not.
3.3 Acceptance of the documents
When you accept these documents, we record: which document, the version (for example, 2026-11-04), the date and time, the IP address, the platform (web, iPhone, iPad, Mac, or Android) and, for the network authorization, which network. This record is proof of what you accepted and cannot be edited.
3.4 Teams
The team's name and time zone, who is part of it, and each person's role (owner, editor, or reader). Teammates see your name and e-mail, but do not see your CPF or CNPJ, date of birth, country, or CEP.
3.5 Connected networks
When you connect a network, we store: the identifier, name, @username, and profile photo of the account (or of the Page or channel), the permissions you authorized, the connection and disconnection dates, the status (active, paused, or disconnected), and the access authorizations (tokens), always encrypted. The details for each network are in the Authorization to Connect Social Networks.
3.6 Posts and media
Internal title, captions, photos, videos, and technical data of the files (type, size, dimensions, duration), destination networks, date, time, and time zone, the status of each destination, error messages, the identifier and link of the post on the network, and the action history (what changed, when, and who did it).
3.7 Automations
The rules you create (up to 30 per team), the texts, links, buttons, and media of the replies, the linked posts, and the run history. When an automation runs, we also process data of people who interacted with your account: identifier on the network, username, text of the comment or message, date and time, and what was replied (section 11).
3.8 Notifications
If you allow notifications on your device, we store the device code for notifications (token), the platform (iPhone, iPad, Mac, or Android), the environment, and the app identifier. Notifications tell you about posts made, failures, required actions, and time reminders.
3.9 Technical and access records
- Access records: IP address, date, and time of use of postSOMA, as required by the Marco Civil da Internet (art. 15).
- Security records: counts of attempts to prevent abuse, sensitive events (such as data export and deletion), and errors. Tokens and passwords never go into these records.
3.10 Support
When you write to DIGITAI SOMA, we process your name, e-mail, and the content of the message.
3.11 What we do not collect
The password of your networks, biometric data, precise location, address book contacts, the device's advertising identifier, and your browsing history in other apps or sites. We do not ask for sensitive data (such as health, religion, or sexual orientation). Avoid putting it in posts and automations without need and authorization.
4. What we use the data for and the legal basis
The LGPD requires a legal basis for each use (art. 7). This table shows each purpose:
| Purpose | Data | Legal basis (LGPD) |
|---|---|---|
| Create and maintain your account and log you in | Sign-up data, e-mail, Google or Apple identifiers, protected password | Performance of a contract (art. 7, V) |
| Confirm you are 18 or older and identify who is responsible for the account | Full name, date of birth, CPF or CNPJ, country | Performance of a contract (art. 7, V) and legitimate interest in preventing fraud, fake accounts, and use by minors (art. 7, IX) |
| Send verification codes and service e-mails | Name, e-mail, IP, device type | Performance of a contract (art. 7, V) and legitimate interest in account security (art. 7, IX) |
| Keep proof of your acceptances | Document, version, date, time, IP, platform | Compliance with a legal obligation (art. 7, II, and art. 8, § 2) and regular exercise of rights (art. 7, VI) |
| Connect networks, schedule, and publish | Connected accounts, tokens, posts, and media | Performance of a contract (art. 7, V) |
| Run the automations you set up | Rules, replies, and data of people who interacted | Performance of a contract with you (art. 7, V). For third-party data, we act as a processor, following your instructions (section 11) |
| Send notifications to your device | Device token and platform | Consent (art. 7, I), given when you allow notifications. You can turn it off at any time |
| Protect the service, prevent abuse, and fix errors | Technical and security records | Legitimate interest (art. 7, IX), limited to what is necessary |
| Keep access records for the legal period | IP, date, and time | Compliance with a legal obligation (art. 7, II; Marco Civil, art. 15) |
| Assist you and respond to requests about your data | Contact and message | Compliance with a legal obligation (art. 7, II) and performance of a contract (art. 7, V) |
| Billing and invoices, when there is a paid plan | Name, CPF or CNPJ, CEP, and purchase data (never the full card number) | Performance of a contract (art. 7, V) and compliance with a legal obligation (art. 7, II) |
| Defend rights in legal proceedings | Records tied to the case | Regular exercise of rights (art. 7, VI) |
| Send postSOMA news by e-mail | Name and e-mail | Consent (art. 7, I), optional and separate. You can unsubscribe in any e-mail |
We do not use your data for advertising, for consumer profiling, for credit assessment, or to train artificial intelligence models.
5. Who we share it with
We do not sell, rent, or hand over your data. We share only what is necessary.
5.1 Providers that process data on our behalf (processors)
| Provider | What it does | Data involved | Where |
|---|---|---|---|
| Supabase, Inc. | Database, login, media storage, and server functions | All service data | Data stored in the São Paulo region (sa-east-1). US company; support and subprocessors may access it from abroad |
| Vercel Inc. | Hosting of the website, the web app, and these pages | IP address and technical access data | Global network; US company |
| Resend | Sending automatic e-mails (codes and notices) from the sender postsoma.app@digitaisoma.com | Name, e-mail, and e-mail content | USA |
| Google (Google Workspace) | DIGITAI SOMA's support e-mail | Messages exchanged with you | Brazil and abroad |
| Apple (Apple Push Notification service) | Delivery of notifications on iPhone, iPad, and Mac | Device token and notification text | USA and other countries |
| Google (Firebase Cloud Messaging) | Delivery of notifications on Android | Device token and notification text | USA and other countries |
| Stripe and Mercado Pago (when there is a paid plan on the website or web app) | Process card and Pix payments | Name, e-mail, CPF or CNPJ, and purchase data. Card data stays only with them | Stripe: USA and other countries. Mercado Pago: Brazil and other countries |
We require these providers to use the data only to provide the service to us and to protect it with adequate security. If we start using a new provider that processes your data, we will update this list. Payment companies may also process data on their own, for example to prevent fraud, under their own policies.
For purchases through the App Store or Google Play, Apple or Google process the payment as independent controllers and tell us only the status of the subscription.
5.2 Companies that receive data by your choice (independent controllers)
- Apple and Google, when you sign in with them: they confirm your identity and send us an identifier, name, and e-mail.
- Social networks you connect (Meta: Instagram, Facebook, and Threads; TikTok; Google: YouTube and Business Profile; X; LinkedIn; Pinterest; Bluesky): they receive the content you tell us to publish and the commands from your automations. Each one processes this data under its own policy.
- On Bluesky, posts are public and copied across the open network (AT protocol). Deleting later may not remove copies kept by third parties.
5.3 Other situations
- Your team: members see the team's posts, media, connected networks, automations, and history, according to each person's role.
- Authorities: when the law requires it, by court order or a valid legal request. Access records are only handed over with a court order (Marco Civil, art. 15, § 3).
- Corporate change: if DIGITAI SOMA goes through a merger, sale, or reorganization, the data may pass to the successor company, which must respect this Policy. We will notify you beforehand.
6. Where the data is kept
The postSOMA database, login, and media are kept on Supabase, in the São Paulo region (Brazil). Data always travels encrypted (HTTPS).
7. International data transfers
Some data is processed outside Brazil:
| Situation | Where to | Basis for the transfer |
|---|---|---|
| Website hosting (Vercel), sending e-mails (Resend), notifications (Apple and Firebase), card payments (Stripe), technical support and subprocessors of Supabase | Mainly the United States | Necessary to perform the contract with you (LGPD, art. 33, IX, combined with art. 7, V), with these providers' data protection agreements |
| Data processed by providers in the European Union | European Union countries | Adequacy decision of the ANPD (ANPD Resolution CD/ANPD No. 32/2026; LGPD, art. 33, I) |
| Connection to social networks and login with Apple or Google | Servers of those companies, in Brazil or abroad | Your request, to perform the service (LGPD, art. 33, IX, combined with art. 7, V) |
You can ask for more details about a transfer, including a copy of the applicable contractual clauses, at contato@digitaisoma.com. We reply within 15 days.
8. How long we keep it
| Data | How long |
|---|---|
| Sign-up data (name, e-mail, CPF or CNPJ, birth date, country, CEP) | As long as the account exists. Deleted when you delete the account |
| Network tokens | Until you disconnect the network or delete the account. Deleted immediately |
| Connected account data (name, @, photo, identifiers) | As long as the account is connected. Deleted within 7 days after disconnection. YouTube data is refreshed or deleted every 30 days at most |
| Posts, captions, and history | As long as they exist in the team. A deleted post leaves the app immediately and is permanently deleted within 30 days |
| Media (photos and videos) | As long as they are linked to a post or automation. Unused files are deleted within 30 days |
| Automations and data of people who interacted | As long as the automation and the connected account exist. Events received from the networks: 30 days (90 days when there was an error). Deleted within 30 days after you disconnect the account or delete your account |
| Notification token | Until you sign out, turn off notifications, uninstall the app, or delete the account |
| Verification codes | The code is valid for 1 to 2 minutes and cannot be reused. The send record (hash, date, IP, and device) is kept for up to 6 months |
| Access records (IP, date, and time) | 6 months (Marco Civil, art. 15). They may be kept longer only if an authority formally requests it |
| Acceptance records | While the account exists and for 6 more months after deletion, tied to an identifier that does not directly reveal who you are |
| Record of deletion requests (code, origin, dates, and status, without name or e-mail) | 5 years, to prove that we complied with the request and for defense in any legal proceeding (LGPD, arts. 7, VI, and 16, I; CDC, art. 27) |
| Support messages | During the support and for up to 5 years afterward, for defense in any legal proceeding |
| Tax and billing data (when there is a paid plan) | For the period required by tax law, generally 5 years |
| Provider backups | Deleted data leaves the backups when they are replaced, within 30 days. Until then, it stays protected and is used only for disaster recovery |
After these periods, we delete the data or make it anonymous, unless the law allows or requires us to keep it (LGPD, art. 16).
9. How we protect the data
- All communication between the app and the server is encrypted (HTTPS).
- Network tokens are encrypted (AES-256-GCM) before being saved. Only the server can decrypt them; the app never receives them.
- Passwords and verification codes are stored only as a hash.
- Access rules in the database ensure that each person sees only the data of their own teams, and that sign-up data stays separate and invisible to the team.
- Media is kept in private storage and shown through temporary links.
- There are attempt limits for login, codes, export, and deletion, to prevent abuse.
- The session stays in the device's protected storage (Keychain on iPhone, iPad, and Mac; secure storage on Android) or, in the browser, only until you close the tab.
- Administrative access is restricted and protected by credentials kept in a password manager.
No system is 100% secure. We maintain an incident response plan (section 16).
10. Cookies and storage on your device
postSOMA does not use advertising cookies or third-party analytics or tracking tools. These document pages do not use cookies or scripts.
| Where | What is stored | What for | How long |
|---|---|---|---|
| Browser: session storage (sessionStorage) | Login session and a temporary login security code (PKCE) | Keep you signed in and protect the login | Until you close the tab or sign out |
| Browser: local storage (localStorage) | Theme (light or dark) and chosen icon color | Remember your preferences | Until you clear the site's data |
| iPhone, iPad, and Mac: Keychain | Login session | Keep you signed in securely | Until you sign out or delete the app |
| Android: system secure storage | Login session | Keep you signed in securely | Until you sign out or delete the app |
| Device | App preferences | Remember your choices | Until you delete the app |
The app only accesses your photos and videos when you choose to attach media, with the system's permission. The hosting (Vercel) receives technical access data, such as the IP, to deliver the pages and protect against attacks.
11. Data of people who interact with connected accounts (automations)
When an account owner uses automations, postSOMA receives from the networks data of people who commented on or messaged that account: identifier, username, comment or message, and date and time.
- The one who decides to use automations, what to reply, and why is the account owner, who acts as the controller of this data.
- DIGITAI SOMA processes this data on the owner's behalf, only to run the configured automations, as a processor (LGPD, art. 39).
- We do not use this data for any other purpose, we do not sell it, and we do not build profiles.
If you commented on or messaged an account that uses postSOMA and want to exercise your rights, talk to the account owner. You can also write to contato@digitaisoma.com, and we will help locate and forward the request.
12. Your rights
Under the LGPD (art. 18), you can ask, at no cost, for:
- confirmation that we process your data and access to it;
- correction of incomplete, wrong, or outdated data;
- anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in violation of the law;
- portability of the data to another provider;
- deletion of data processed based on your consent;
- information about who we share your data with;
- information about the possibility of not giving consent and the consequences of that;
- withdrawal of consent;
- objection to processing carried out in violation of the law;
- review of decisions made solely by automated means (art. 20).
How to ask
- In the app, under Account and privacy ("Conta e privacidade"; in the web app, under "Contas"): download your data ("Baixar meus dados"), disconnect or pause networks, edit and delete posts and automations, turn off notifications, and delete the account.
- By e-mail: write to contato@digitaisoma.com, preferably from the account's e-mail, with the subject "Privacidade postSOMA" (postSOMA Privacy). We may ask for confirmation that the request is yours, always with the minimum of data. We never ask for your password.
Deadlines
- Confirmation that data exists and access in simplified format: immediately.
- Complete declaration (origin of the data, criteria, and purpose): within 15 days (LGPD, art. 19).
- Other requests: as soon as possible. If we cannot comply, we will explain why.
If you are not satisfied, you can complain to the ANPD (gov.br/anpd) and to consumer protection bodies.
13. Account deletion
You can delete your account in the app or by e-mail. The step-by-step, what is deleted, the deadlines, and what the law requires us to keep are in Account and Data Deletion.
14. Children and teenagers
postSOMA is a work tool and is not meant for people under 18. We ask for the date of birth at sign-up and do not allow use by minors. If we learn that a person under 18 created an account, it will be deleted. If you know of a case, write to contato@digitaisoma.com.
15. Automated decisions
postSOMA does not make solely automated decisions that affect your interests, such as assessing your profile or your credit. Comment and message automations are rules created by you, which the system runs according to your instructions.
16. Security incidents
If a security incident happens that may bring relevant risk or harm to you, we will notify you and the ANPD within 3 business days, as the ANPD rule requires (LGPD, art. 48; Resolution CD/ANPD No. 15/2024), telling you what happened, what data was affected, and what we did.
17. Platform rules
17.1 YouTube and Google
- postSOMA uses YouTube API Services.
- By using YouTube through postSOMA, you agree to the YouTube Terms of Service.
- Google's handling of data follows the Google Privacy Policy.
- Data we access and store: the channel's identifier, name, @, and thumbnail, the authorized permissions, and the tokens (encrypted). Permissions requested: upload videos (youtube.upload) and read channel data (youtube.readonly).
- How we use it: only to show the channel in the app and upload the videos you tell us to publish.
- Who we share it with: no one other than the processors in section 5.1, who process the data on our behalf. We do not allow third parties to show ads or content in postSOMA.
- On your device: see section 10.
- Deadlines: channel data is refreshed or deleted every 30 days at most. If you disconnect YouTube or delete your account in postSOMA, we delete the YouTube data within 7 days. If you revoke access in Google's settings, we delete it within 30 days.
- How to revoke through Google: security.google.com/settings/security/permissions.
- Contact: contato@digitaisoma.com.
Limited Use. postSOMA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This is the original wording required by Google. See the Google API Services User Data Policy.
In practice, data received from Google: is used only for visible postSOMA features; is not transferred to third parties, except to provide those features, for security, because of a legal obligation, or in a corporate transaction with notice to you; is not used or sold for advertising or credit assessment; and is not read by people, except with your authorization, for security, or because of a legal obligation.
The same rules apply to Google Business Profile, once the connection is released.
17.2 Meta (Instagram, Facebook, and Threads)
- We use Meta data only to show connected accounts, publish, and run the automations you set up.
- We do not sell, license, or buy Meta data, and we do not use it for advertising, for surveillance, or to build profiles without permission.
- Deletion: if you remove postSOMA in the Facebook, Instagram, or Threads settings, Meta notifies us and we delete the data from that account. You receive a confirmation code to follow the request. The instructions are in Account and Data Deletion.
- Meta Privacy Policy · Instagram Privacy Policy
17.3 TikTok, X, LinkedIn, Pinterest, and Bluesky
- We use data from these networks only to connect the account, show it in the app, publish and, when the network allows, run the automations you set up.
- We do not sell this data, we do not use it for advertising, and we do not build profiles.
- Privacy policies: TikTok · X · LinkedIn · Pinterest · Bluesky · Apple
18. Changes to this Policy
We may update this Policy when postSOMA changes or the law requires. Each version has a date code. Important changes will be announced in the app or by e-mail at least 15 days in advance, except when required by law or by a security emergency. When the change requires it, we will ask for new acceptance.
19. Contact
- Data Protection Officer (DPO): Caíque Patti da Gama · contato@digitaisoma.com
- Support: contato@digitaisoma.com
- postSOMA's automatic e-mails (codes and notices) are sent from postsoma.app@digitaisoma.com. For requests and questions, use contato@digitaisoma.com.
- We never ask for your password or your codes by e-mail, phone, or message.