Studio → Privacy Policy

Privacy Policy

To make and publish a brand’s content, Leanboat Studio processes data about the brand’s team, the people who appear in its posts, the audience that reacts to them, and — to find new customers — other businesses. This page says what each of those is, where it comes from, which companies help us process it, how long it is kept, and how to have it deleted. No social passwords and no card numbers ever reach us. Questions and requests go to hello@leanboat.io.

Effective 14 October 2026

Who is responsible

Valor Digital Internet LTDA (CNPJ 27.242.193/0001-43), Rua Honório de Barros 12, Flamengo, Rio de Janeiro, RJ 22250-120, Brazil is the controller of the personal data described here — the controlador under Brazil’s LGPD (Lei 13.709/2018) and the controller under the GDPR where that applies. One exception: when we run a customer’s social account — publishing its posts, answering its DM automations, reading its comments for reports — we process its audience’s data on the customer’s behalf, as its operador (processor), and the customer decides what happens to it.

Our encarregado — the data protection officer under LGPD article 41 — is our Customer Service team, at hello@leanboat.io. Write there, in Portuguese or English, about anything in this policy; the ANPD can reach us at the same address.

What we hold, and about whom

Customers and their teams

AccountName, email address, and whether it is verified. A password, stored only as a hash by our sign-in provider — or, if you sign in with Google, the name, email address and profile picture Google shares, used only to create and sign in to your account. Sign-in records, including the IP address and browser used.

Company and brand fileCompany name, website, Instagram handle, region and time zone, and the people linked to the company with their role. The brand file: what you answered at signup, plus what was read from your website (up to 50 pages) and your recent posts. For tour operators, the tour catalogue synced from the booking system. Reviews of your business — public ones we collect and ones you share — with the text, the reviewer’s first name and initial, and the rating; used in content only once you approve them.

Connected channelsWhich social accounts are connected and the platform’s identifiers for them. The authorisation token is held by our publishing layer, not by us; no social passwords.

ContentPlans, drafts and published posts, their images and videos, your approvals, comments and revision notes, and the files and links you add as sources.

PerformancePer-post, per-story and per-account figures from the accounts you connected; your audience in aggregate (age bands, gender, cities, countries); the text of comments on your posts, without the commenters’ names; and counts of DM automation replies.

BillingYour plan, subscription status, any promotion code, and the payment processor’s customer reference. No card numbers: Stripe collects payment details on its own pages, and for fraud prevention it acts under its own privacy policy.

Email and auditThe emails we send you, whether they were delivered, opened or clicked, and your replies. An events log of who approved, changed or sent what, and when.

People who appear in a brand’s content

Owners, employees, ambassadors and creators whose face or voice a brand asks us to use. See Faces and voices below for what happens to it and on what basis.

IdentityName, Instagram handle and email, and for ambassadors the promotion code they share — supplied by the brand or its network.

Images and recordingsPhotos, the guided capture session (six poses and a video of the session), footage they upload for posts, voice recordings and their transcripts, and notes on how they like to be shown.

People who react to a brand’s posts

When we run a customer’s Instagram account: the text of comments on its posts (for reports, without the commenters’ names); the people who comment or reply with an automation keyword, so the automation can send them the DM; and Instagram accounts mentioned in comments, with their public name, bio and follower count, to tell brands from people in the report.

Other public accounts

Reports compare a brand with similar or competing Instagram business accounts it names or we suggest. For those we read public figures only — followers, posts and their public engagement — through Instagram’s business discovery.

Businesses we contact

To find new customers we contact businesses — mostly tour operators — by email. For each we hold the business name, a contact name and business email, its website, Instagram handle, country and public tour catalogue, the emails we exchange, and a preview page we build from its own public tours and photos.

Site visitors

On the public site, the sign-up pages, onboarding and the payment confirmation page — never inside the product — the measurement described under Cookies: pages viewed, device and browser details, cookie identifiers from Google Analytics, Meta and TikTok, and the sign-up, checkout and purchase steps with the plan, price and any promotion code. At sign-up and checkout this includes your email address and an internal company identifier, each turned into a one-way SHA-256 hash before it reaches those companies. Your privacy choices are kept in your own browser.

Where it comes from

From you, at signup and in the product, and from the links and files you give us.
From your website, read when the brand file is built and whenever you add a page as a source.
From public reviews of your business, and reviews you share with us.
From the social accounts you connect: your recent posts, their performance, your audience in aggregate, and comments.
From your network, if you joined through one: your contact details, and rosters of ambassadors or members.
From Bokun, the booking system, for tour operators’ catalogues.
From our payment processor: whether a subscription is paid.
From public sources, to find and research businesses to contact: listings on the Bokun marketplace that our partners can see, and public Instagram business profiles.
From your browser on the public site, as far as your privacy choices allow.

We do not buy personal data, and we do not enrich records from data brokers.

Why we use it, and on what basis

Each use names its legal basis — the hipótese legal under articles 7 and 11 of the LGPD, and the equivalent ground under articles 6 and 9 of the GDPR.

To run the serviceBuilding the brand file, planning, producing, scheduling and publishing content, running DM automations, and reporting results. Basis: our contract with the customer; for the customer’s audience, the customer’s own basis, on whose behalf we act.

To work with networksShowing a network its members’ content, approvals and reports, and sending emails in its name. Basis: the contract with the network and with its members.

To use a person’s face or voiceMaking a brand’s content with that person in it. Basis: that person’s specific consent — given when they start an identity capture, and confirmed by the brand under our Terms — which they can withdraw at any time.

To show our workCase studies, the home page and previews for prospective customers, with a customer’s brand name, logo, handle, the posts we made and their public results. Basis: the customer’s permission under our Terms, withdrawable at any time.

To billSubscriptions, payments and invoices. Basis: contract, and legal obligation for accounting and tax records.

To keep the service working and secureSign-in records, the events log and error diagnostics. Basis: legal obligation for access records, and our legitimate interest in a service that works and is not abused.

To contact you about the serviceApproval requests and reminders, reports, notices about your plan and your accounts. Basis: contract. These are part of the service, so they have no unsubscribe link.

To compare and improveComparing a brand with public accounts, and learning across the service, in aggregate, which formats and topics perform — never reusing one customer’s content for another. Basis: our legitimate interest and the customer’s.

To find new customersEmailing businesses whose public listing suggests the service fits them. Basis: our legitimate interest in offering a business service to businesses. Any business can ask us to stop, and we do.

To measure the site and our adsCounting visits (Google Analytics), and telling Meta and TikTok which ad visits led to a sign-up or a purchase. Basis: consent for Meta and TikTok in Brazil, and for everything in the EU, the UK, Switzerland and Québec — nothing of that loads until you accept. Our legitimate interest for Google Analytics in Brazil, and for all three elsewhere, with an opt-out.

Faces and voices

Some brands are built around a person — a founder, a guide, an ambassador. For those, a brand can ask us to use that person’s face and voice:

Capture. The guided capture page checks each pose with a face-detection model that runs in the person’s browser. What is uploaded is the photos, a video of the session and the pose readings, stored with the brand’s files.
Images. Photos are sent to AI image models to generate post images and covers in that person’s likeness, and to pick the best photos from their existing posts.
Voice. Recordings are transcribed by an AI model. Where a brand’s plan includes footage editing, a voice model is built from them inside our production environment to voice that brand’s videos.

The person agrees to this on the capture page, before it starts, and the brand confirms their agreement under our Terms whenever it gives us their photos, footage or recordings in another way. Images of a person’s face can identify them, so we treat this as sensitive data. We use it only for the brand it was given for, never for another brand or customer. The person can ask us — directly or through the brand — to stop using it and to delete it, the photos, recordings and voice model included.

AI processing

Content is produced with AI models from Google (Gemini), Anthropic (Claude) and OpenAI, which we reach through OpenRouter. Our production agents run on Anthropic’s cloud. Brand files, the material in them, drafts and the prompts built from them pass through these providers to produce each post; each handles what it receives under its own terms. For some videos we also use Higgsfield, whose standard terms let it use what it receives to improve its models. We do not use one customer’s material to produce another customer’s content. Some checks are automated — for example, an AI review of uploaded footage that asks for a reshoot. If an automated decision affects you, you can ask a person on our side to review it.

Who processes it on our behalf

This list is what the product actually uses, not an aspirational one.

NeonThe database and the sign-in layer. Account and product data live here.

VercelHosting, and storage for uploaded logos.

GoogleGoogle Drive stores media, files, photos, footage and recordings. Also Google sign-in, Google Sheets for network rosters, Gmail for emails we write by hand, and the Gemini models.

OpenRouterThe gateway through which requests reach the AI models.

AnthropicClaude models, and the cloud environment our production agents run in.

OpenAIImage models.

The publishing layerHolds the revocable tokens for your connected social accounts, publishes, runs DM automations, and collects performance figures and comments.

StripePayments, subscriptions and promotion codes.

ResendSends and receives our email, and reports delivery, opens and clicks.

FirecrawlReads websites for the brand file and for sources.

BokunTour catalogues, and the marketplace listings we research.

HiggsfieldAI video generation, for some videos and sales demos — see AI processing above.

The platformsMeta, LinkedIn and X, as the destinations you authorise directly, and Meta’s API for public Instagram business data. What they do with the posts is governed by their own policies.

Each processes the data to provide its service to us, under its own data processing terms. We do not sell, license or buy data received from Instagram or Facebook. If we change this list, the changed version appears here with a new effective date.

Analytics and advertising partners

Three more companies receive the site measurement described above. Unlike the processors listed before, they also use some of it for their own purposes, such as improving their advertising systems, under their own business terms — which is why they wait for your consent wherever the law asks for it.

Google AnalyticsGoogle. Visit counts and the sign-up, checkout and purchase steps, against an internal company identifier (hashed), never your email. How Google uses this data: policies.google.com/technologies/partner-sites.

Meta PixelMeta, for our Facebook and Instagram ads. Page views and the same steps, with the hashed email and company identifier so a sign-up can be matched to the ad that brought it. For visitors in the EU, Meta and we jointly control this collection.

TikTok PixelTikTok, for our TikTok ads. The same as Meta. For visitors in Brazil, TikTok and we are joint controllers of this data; TikTok keeps it for up to 18 months.

Besides Privacy choices on this site, you can limit ad targeting in Meta’s and TikTok’s own ad settings.

Who else sees it

Your network, if you joined through one: your brand file, content, approvals and reports.
The public, for what you publish — and, for posts we produced, as examples of our work: in case studies on this site, on our home page and in previews for prospective customers, with your brand name, logo, handle and the posts’ public results, as our Terms allow, until you ask us to stop.
Authorities, when the law or a court order requires it.

We do not sell personal data.

Where it is held

We are a Brazilian company, but our providers host and process data in the United States and other countries — our database is in the United States — so it leaves Brazil. Those transfers are needed to provide the service you contracted (LGPD article 33, IX) and rely on the data processing terms each provider publishes; where European data is involved, the same providers’ standard contractual clauses apply. Google, Meta and TikTok process measurement data in the United States and in other countries where they operate, under their own transfer safeguards.

How long we keep it

Account, brand file, content and performance data: for as long as the account exists. When a paid plan ends the account moves to Studio Free and the data stays, until you ask us to delete it.
Faces, voices and recordings: until the person or the brand asks us to delete them, or the account is deleted.
Businesses we contacted: while we may still contact them. After a request to stop, we keep only what we need to make sure we do not write again.
Access records — the IP address, date and time of sign-ins: six months, which Brazil’s Marco Civil da Internet (article 15) requires of us.
Billing and tax records: for as long as accounting and tax rules require them.
The events log: kept as the audit trail of who approved what, including after an account is deleted.
Site measurement: held by Google, Meta and TikTok under their own retention terms. Their cookies expire on their own — Google Analytics after up to two years, Meta after 90 days, TikTok after 13 months — or when you clear them.

Deletion is done by hand, on request, rather than by a button in the product. When we delete an account we remove its records from our database, its profile at the publishing layer, and its stored files, which stay in the storage provider’s trash for 30 days before they are gone. Posts already published stay on your own accounts, under your control, whatever we delete on our side.

Your rights

Under the LGPD — and under the GDPR where it applies to you — you can ask us to confirm what we hold and give you a copy, correct anything wrong or incomplete, delete it, hand it over in a portable form, tell you who we shared it with, or stop a use you object to. Where a use rests on your consent, you can withdraw it, and we will tell you what stops working if you do. You will not be charged or treated differently for asking.

How to ask: email hello@leanboat.io, from the address on the account if you are a customer. We confirm what we hold within 15 days, as article 19 of the LGPD requires, and carry out a deletion within 30 days. If your data reached us through a customer — you appear in its content, or commented on its posts — you can write to the customer or to us, and we will work with the customer to answer.

In US states with a consumer privacy law (California and others), sending site measurement to Meta and TikTok for ad targeting counts as “sharing”. We offer the opt-out those laws describe even where they may not apply to a company our size: the Do Not Sell or Share My Personal Information link in the footer, or Global Privacy Control turned on in your browser, which we treat as the same opt-out. We do not respond to the older Do Not Track signal.

If you think we have handled your data badly, tell us first. You can also complain to Brazil’s data protection authority, the ANPD, or to the authority where you live.

Data from Instagram and Facebook

To remove what we hold from a connected Instagram or Facebook account, disconnect it — inside the product, or in the platform’s own settings for business integrations — and email hello@leanboat.io asking us to delete the data that came from it. We delete it within 30 days and confirm by email.

Emails we send to businesses

Every email we send to a business we are introducing ourselves to carries a one-click unsubscribe link. You can also reply asking us to stop, or write to hello@leanboat.io; either way we stop. Those emails, and some replies to them, are written by AI; a person on our team steps in when a conversation needs one. Promotional emails to customers are never sent to an address that has unsubscribed, and you can opt out of them by replying.

Cookies

Inside the product, Leanboat Studio sets only the cookies it needs to keep you signed in. The public site, the sign-up pages, onboarding and the payment confirmation page also use measurement cookies from Google Analytics (_ga), Meta (_fbp, _fbc) and TikTok (_ttp), and remember your privacy choices in your browser for up to a year. What loads depends on where you are:

The EU, the UK, Switzerland and Québec — and anywhere we cannot tell where you are: nothing loads until you accept in the banner, and you can accept or reject analytics and marketing separately.
Brazil: Google Analytics loads; Meta and TikTok wait until you accept them in the banner. You can switch either off at any time.
US states with a privacy law: they load, and the Do Not Sell or Share link or Global Privacy Control turns them off.
Elsewhere: they load without a prompt. You can block them in your browser, or write to hello@leanboat.io.

Where you have a choice, you can change it at any time with Privacy choices (or Do Not Sell or Share) in the footer.

Children

The service is for businesses and is not directed at anyone under 18. If we learn we hold a child’s personal data, we delete it.

Security

What we hold and what we deliberately do not is set out on /security, along with how approval links and revocation work. If we have a security incident that could cause you significant harm, we tell you and the ANPD within three business days of learning that personal data was affected, as the ANPD’s rules require. Security problems go to hello@leanboat.io.

Changes to this policy

When this policy changes we update the effective date at the top, and for anything material we tell customers by email before it takes effect.