Privacy policy

Who looks after your data

This policy explains how Publishum (publishum.com) handles personal data, under the Brazilian General Data Protection Law (Law 13,709/2018, LGPD). We are the controller of your account data.

For any privacy matter, contact our data protection officer at privacidade@publishum.com.

What we collect

We store only what the service needs to work:

• Account: name, email and profile photo from Google, when you sign in with it.
• Connected networks: identifier and username of each account and the access tokens the network gives us.
• Content: text, images, videos and times of the posts you create.
• WhatsApp: your number and the messages you send to our bot to create posts, if you turn this option on.
• Payment: amount, date and Pix identifier. We do not receive full banking details.
• Technical usage: IP address, browser and access logs, for security and troubleshooting.

What we never store

We do not ask for or store the main password of your networks. The connection uses each network's official login (OAuth). On Bluesky, we use an app password, which grants limited access and which you can revoke whenever you want.

We do not sell personal data and we do not use your content to train artificial intelligence models.

Why we use it and on what legal basis

Each use has a legal basis under the LGPD:

• Performance of a contract: creating your account, publishing your posts, warning you about failures and reconnections, providing support.
• Legal obligation: issuing invoices and keeping tax and access records for the period the law requires.
• Legitimate interest: preventing fraud, spam and abuse and keeping the service secure.
• Consent: WhatsApp alerts, which you can turn off at any time.

Token security

Network access tokens are encrypted at rest with AES-256 and only decrypted at the moment of publishing. All traffic uses HTTPS.

Internal access to data is restricted and logged. If a security incident could put you at risk, we will notify you and the ANPD (the Brazilian data protection authority) within the legal deadline.

Media deleted after 48 hours

Images and videos you upload are kept in Cloudflare storage (R2) only until publication. We delete each file 48 hours after it is published on all the chosen networks.

Media for scheduled posts is kept until the publication date. If you delete the post earlier, the media is deleted with it. Once published, the copy that counts is the one on each network.

Who we share it with

We use suppliers that process data on our behalf, only to provide the service:

• Cloudflare: website hosting, network and media storage.
• Supabase: database and authentication.
• Google: sign-in with your Google account.
• Woovi: creating and confirming Pix payments.
• WhatsApp provider: sending and receiving bot messages and alerts.
• The networks themselves (X, Threads, Bluesky and LinkedIn) receive the content you ask us to publish, and handle it under their own policies.

Cookies and analytics

We only use essential session cookies, to keep you signed in. We do not use advertising cookies or cross-site tracking.

Visit metrics come from Cloudflare Web Analytics, which uses no cookies and does not identify you individually.

Some suppliers may process data outside Brazil. In those cases, we use companies with adequate protection safeguards, as the LGPD requires.

Your rights

Under article 18 of the LGPD, you can ask at any time for: confirmation that we process your data, access, correction, anonymization or deletion of unnecessary data, portability, information about who we share it with and withdrawal of consent.

Ask at privacidade@publishum.com. We reply within 15 days. If you are not satisfied, you can file a complaint with the Brazilian National Data Protection Authority (ANPD).

Account deletion and retention

You can delete your account from the dashboard or ask by email. We delete your account, tokens, posts and media within 24 hours. Backups expire on their own within 30 days.

We keep only what the law requires, such as invoices and payment records, for the legal period.

Changes to this policy

If we change this policy in a meaningful way, we will notify you by email 15 days in advance. The date of the last update is shown at the top of this page.

General questions: suporte@publishum.com. Privacy: privacidade@publishum.com.