PlanigPlanigBack to site

Privacy Policy

Last updated: June 27, 2026

Planig Tecnologia Ltda. (“Planig”, “we”, “us”, or “our”) respects your privacy and is committed to protecting the personal data you share with us. This Privacy Policy explains how we collect, use, store, and safeguard your information when you use our platform at planig.com.br, and describes your rights under the EU General Data Protection Regulation (“GDPR”), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA (“CCPA/CPRA”), and Brazil’s Lei Geral de Proteção de Dados (“LGPD”).

1. Who we are (Data Controller)

Planig is the controller responsible for your personal data. You can reach us at privacy@planig.com.br. Our Data Protection Officer (DPO) can be contacted at dpo@planig.com.br.

2. Data we collect

We collect the following categories of personal data:

  • Account data: name, email address, and password (stored as a hash).
  • Usage data: posts created, schedules, interactions with the platform, and access logs.
  • Payment data: processed directly by our payment partner (Stripe). We never store full card numbers.
  • Instagram data: OAuth access tokens required to publish content on your behalf, only as authorized by you.
  • Technical data: IP address, browser type, operating system, device identifiers, and session cookies.

3. How we use your data & legal bases (GDPR)

We process your data for the purposes below, relying on these legal bases:

  • To provide the service (performance of a contract): operating your account, scheduling and publishing content to Instagram on your behalf.
  • To generate AI captions and hashtags (performance of a contract / legitimate interest).
  • To send transactional emails such as sign-up confirmations and publishing alerts (performance of a contract).
  • To send marketing communications (consent — you may withdraw it at any time).
  • To improve and secure the platform (legitimate interest).
  • To comply with legal obligations (legal obligation).

4. Sharing your data

We do not sell or share your personal information for cross-context behavioral advertising as defined by the CCPA/CPRA. We share data only with the following processors and service providers:

  • Meta (Instagram): to publish content via the authorized Graph API.
  • Anthropic: for AI caption generation (no directly identifiable personal data is sent).
  • Supabase: database and authentication, with encryption at rest.
  • Stripe: payment processing.
  • Vercel: application hosting and content delivery.
  • Public authorities: when required by law or valid legal process.

5. International data transfers

Planig operates from Brazil, and some of our providers process data in the United States and the European Union. When we transfer personal data outside your jurisdiction, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) and equivalent mechanisms to ensure your data remains protected.

6. Data retention

We retain your data while your account is active. After your account is closed, we delete your personal data within 30 days, except where a longer retention period is required by law.

6.1 Revoking Instagram access & deleting your data

You can disconnect your Instagram account from Planig at any time in Companies → Disconnect. This immediately deletes the stored access token and all Instagram identifiers, and Planig can no longer read or publish anything on your behalf. You may also revoke Planig’s access directly from Instagram, in Settings and privacy → Apps and websites. To delete your account and everything we store about you, follow our Data Deletion Instructions.

7. Security

We apply technical and organizational measures to protect your data, including TLS encryption in transit, AES-256 encryption at rest, access controls, and periodic security reviews.

8. Your GDPR rights

If you are in the EU, UK, or EEA, you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate or outdated data.
  • Erase your data (“right to be forgotten”).
  • Restrict or object to processing.
  • Data portability in a structured, machine-readable format.
  • Withdraw consent at any time.
  • Lodge a complaint with your local supervisory authority.

9. Your California rights (CCPA/CPRA)

If you are a California resident, you have the right to:

  • Know what personal information we collect and how it is used and disclosed.
  • Request deletion of your personal information.
  • Correct inaccurate personal information.
  • Opt out of the “sale” or “sharing” of personal information — note that we do not sell or share your data.
  • Limit the use of sensitive personal information.
  • Not be discriminated against for exercising your privacy rights.

You may submit a request yourself or through an authorized agent. We will verify your identity before acting on any request.

10. Children’s privacy

Planig is not directed to individuals under 18, and we do not knowingly collect personal data from children. If you believe a minor has provided us with personal data, please contact us so we can delete it.

11. Cookies

We use essential cookies to keep you signed in and to operate the platform, plus optional analytics cookies. You can control non-essential cookies through your browser settings.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced on this page with an updated “Last updated” date.

13. Contact & how to exercise your rights

To exercise any of the rights above, email privacy@planig.com.br or our DPO at dpo@planig.com.br. We respond to verified requests within the timeframes required by applicable law (generally 30 days under GDPR and 45 days under CCPA/CPRA).
Planig Tecnologia Ltda. – Brazil