Start your brand

Studio → Privacy Policy

Privacy Policy

Leanboat Studio holds what it needs to run your content and nothing more: who you are, your brand file, the posts it produced, and how those posts performed. No social passwords and no card numbers ever reach us. You can ask for a copy of it, or ask us to delete it, by writing to hello@leanboat.io.

Who is responsible

Valor Digital Internet LTDA (CNPJ 27.242.193/0001-43), Rua Honório de Barros 12, Flamengo, Rio de Janeiro, RJ 22250-120, Brazil is the controller of the personal data described here — the controlador under Brazil’s LGPD (Lei 13.709/2018) and the controller under the GDPR where that applies. Write to hello@leanboat.io about anything in this policy, including to reach the person who handles data protection requests.

What we hold

Read from the product’s own schema, not from a template. This is the whole list for a customer.

IdentityName, email address, and whether that email has been verified. Sessions and the sign-in records behind them.
CompanyCompany name and the people linked to it, with their role.
Brand fileWhat you answered at signup, plus what was read from your own website and your own recent posts.
Connected channelsWhich social accounts are authorised and the provider-side identifiers for them. No social passwords, because authorisation happens on the platform.
ContentDrafted and published posts, their media, and per-post performance figures collected from the accounts they ran on.
BillingSubscription status and the payment processor's own reference. No card numbers reach us.
AuditAn events log: who approved what, when, and what changed.

Where it comes from

  • From you, at signup and in the product.
  • From your public website, read once to build the brand file.
  • From the social accounts you connect: your recent public posts and their performance figures.
  • From our payment processor: whether a subscription is active.

We do not buy personal data, and we do not enrich your record from third-party data brokers.

Why we hold it, and on what basis

Each use below names the legal basis it runs on — the hipótese legal under article 7 of the LGPD, and the equivalent ground under article 6 of the GDPR.

To run the serviceProducing, scheduling and publishing your content, and reading back how it performed. Basis: performance of our contract with you.
To bill youSubscription and payment records. Basis: contract, and legal obligation for accounting records.
To keep the service working and secureSign-in records, the events log, and error diagnostics. Basis: our legitimate interest in a service that works and is not abused.
To contact youApproval emails and service notices. Basis: contract. Marketing email, if we ever send it, needs your consent and carries an unsubscribe link.

AI processing

Your brand material and the drafting prompts built from it are sent to our AI model provider to produce the posts. Under the commercial terms we are on, that provider does not use your material to train its models. We do not use one customer’s material to produce another customer’s content.

Who processes it on our behalf

This list is what the application actually loads, not an aspirational one.

AnthropicThe AI model provider. Brand material and drafting prompts pass through it.
NeonThe Postgres database and the authentication layer. Identity and all product data live here.
VercelHosting, and storage for media.
StripePayments and subscriptions.
ResendTransactional email, including the approval links.
The publishing layerThe service that holds the revocable tokens for your connected social accounts and performs the actual publishing.
The platformsMeta, LinkedIn and X, as the destinations you authorise directly. What they do with the posts is governed by their own policies.

Each of these is bound to use the data only to provide their service to us. If we change this list, the changed version appears here with a new effective date.

Where it is held

We are a Brazilian company, but the providers above host in the United States and the European Union, so your data leaves Brazil. Those transfers rely on the contractual safeguards the LGPD allows for international transfer, in the data processing terms each provider publishes. Where European data is involved, the same providers’ standard contractual clauses apply.

How long we keep it

  • Account, brand file, content and performance data: for as long as your subscription is active.
  • After you cancel: up to 90 days, so a returning customer does not start from nothing — then deleted, or sooner if you ask.
  • Billing and tax records: for as long as accounting rules require them, which is longer than the rest.
  • The events log: kept as the audit trail of who approved what, stripped of personal identifiers when the account is deleted.

Posts already published stay on your own accounts, under your control, whatever we delete on our side.

Your rights

Under the LGPD — and under the GDPR where it applies to you — you can ask us to confirm what we hold and give you a copy, correct anything wrong or incomplete, delete it, hand it over in a portable form, tell you who we shared it with, or stop a use you object to. Where a use rests on your consent, you can withdraw that consent and we will tell you what stops working if you do. You will not be charged or treated differently for asking.

How to ask: email hello@leanboat.io from the address on the account. Deletion is currently handled by hand rather than by a button in the product, and we will confirm it within 30 days. We would rather say that plainly than publish a self-serve promise the product does not yet keep.

If you think we have handled your data badly, tell us first. You can also complain to Brazil’s ANPD, or to the data protection authority where you live.

Cookies

Leanboat Studio sets the cookies it needs to keep you signed in, and nothing else. There is no advertising network, no third-party analytics and no cross-site tracking on this site, which is why there is no consent banner in your way.

Children

The service is for businesses and is not directed at anyone under 18. If we learn we hold a child’s personal data, we delete it.

Security

What we hold and what we deliberately do not is set out on /security, along with how approval links and revocation work. Security problems go to hello@leanboat.io.

Changes to this policy

When this policy changes we update the effective date at the top, and for anything material we tell you by email before it takes effect.