Privacy Policy
Full transparency on how we collect, use, and protect your personal data.
Who we are
MARKETING OS (hereinafter the "Platform", "we" or the "Service") is an autonomous marketing platform for small and medium businesses, operated by:
- Legal name
- FREDERICO CANTEIRO DA SILVA - COMÉRCIO E PRESTAÇÃO DE SERVIÇOS, (SU), LDA
- Tax ID (NIF)
- 5003212467
- Registered address
- Benguela, Município de Lobito, Bairro Caponte, Rua Oliveira Cardonega
- Contact email
- [email protected]
- Data Protection Officer (DPO)
- [email protected]
This policy is drafted in accordance with the following laws:
By using the Service, the user declares to have read, understood and accepted the terms described in this policy.
Data we collect
We collect different categories of data depending on how the user interacts with the Platform.
2.1 — Account data
When the user creates an account:
- Full name
- Email address
- Password (stored encrypted — never in plain text)
- Preferred language (Portuguese or English)
- Google authentication data: name, email and unique identifier
2.2 — Company data (Brand Brain)
- Business name and description
- Website and social media profiles
- Logo, color palette and visual identity
- Target audience, products, services and competitors
- Business goals
- Content, images and assets uploaded by the user
2.3 — Social media data
When the user connects Instagram or Facebook via the Meta Graph API:
- Account ID and username
- OAuth access tokens (stored encrypted)
- Public profile metadata (bio, followers, category)
- Metrics for existing posts and future posts made via the Platform
2.4 — Data generated by the Platform
- Monthly strategies, editorial calendars and AI-generated posts
- Designs, images and videos produced automatically
- History of approvals, edits and publications
- Performance reports and audits
2.5 — Payment and credits data
- Available credit balance
- History of credit consumption by action
- Bank transfer receipts (manual payment)
- Card tokens via Stripe — we never store full card data
2.6 — Technical and usage data
- IP address
- Device type, operating system and browser
- Pages visited, actions taken and session time
- Technical errors and crash reports
- Traffic source (referrer)
2.7 — Communications
When the user contacts us, we retain the content of the communication and associated data (email, date, subject) for support and record-keeping purposes.
How we use the data
We use the data we collect for the following purposes:
| Purpose | Legal basis |
|---|---|
| Create and manage the user's account | Contract performance |
| Generate content, strategy and designs via AI | Contract performance |
| Publish content on connected social media accounts | Contract performance |
| Perform audits and generate recommendations | Contract performance |
| Process payments and manage credits | Contract performance and legal obligation |
| Send transactional emails | Contract performance |
| Send marketing communications about the Service | Consent — revocable at any time |
| Analyse usage to improve the product | Legitimate interest |
| Detect fraud, abuse and violations of the terms | Legitimate interest |
| Comply with legal and tax obligations | Legal obligation |
Artificial Intelligence and content processing
The Platform uses LLMs and image/video generation models to create strategy, content, designs and other marketing assets.
- 01Sending to AI providersThe content provided is sent to OpenRouter and fal.ai to generate the requested outputs.
- 02No training on your dataThese providers are contractually prohibited from using your data to train their own models, unless explicitly enabled by the user.
- 03Controlled storageGenerated content is stored only to make it available to the user, and is never shared with third parties without authorisation.
- 04User responsibilityThe user is responsible for the final content approved and published, even when generated by AI.
Sharing data with third parties
To provide the Service, we rely on third-party providers (subprocessors) who are contractually required to meet security and privacy standards equivalent to our own.
| Provider | Purpose | Location |
|---|---|---|
| OpenRouter | AI language processing | United States |
| fal.ai | AI visual and audio content generation | United States |
| Cloudflare R2 | File storage | Global |
| Meta Platforms | Social media connection and publishing | USA / Ireland |
| ElevenLabs | AI voice synthesis | United States |
| HeyGen (via fal.ai) | AI video generation | United States |
| Stripe | Card payments (outside Angola) | USA / Ireland |
| Resend | Sending email communications | USA / EU |
| PostHog | Product usage analytics | European Union |
| Sentry | Technical error monitoring | USA / EU |
| OAuth authentication | Global |
International data transfers
Some providers are located outside Angola and the European Union, namely in the United States. When these transfers occur, we ensure appropriate safeguards:
- Standard Contractual Clauses approved by the European Commission
- Providers' adherence to recognised data protection frameworks
- Prior assessment of the recipient country's level of protection
Data retention
We retain data for as long as necessary to fulfil the purposes for which it was collected, unless a longer period is required by law.
| Data category | Retention period |
|---|---|
| Active account data | For as long as the account is active |
| Inactive or deleted account data | Up to 30 days after the deletion request |
| Content generated by the Platform | For as long as the account is active |
| Social media OAuth tokens | Until disconnection or account deletion |
| Billing and transaction data | 10 years (tax and accounting obligation) |
| Aggregated and anonymised analytics data | Indefinitely |
| Technical logs and error reports | 90 days |
After these periods end, data is securely deleted or anonymised.
Your rights
Under applicable law, the user has the following rights over their personal data:
To exercise any of these rights, contact us at [email protected] or visit delete data for deletion requests. We respond within the legal deadline (up to 30 days).
Data security
We apply technical and organisational measures to protect data against unauthorised access, loss, alteration or disclosure:
In the event of a data breach that may significantly affect the user's rights, we commit to notifying the competent authority and the user within the legal deadline.
Minors
The Platform is intended exclusively for users aged 18 or older (or the legal age of majority in the user's country of residence). We do not knowingly collect data from minors. If we become aware that we have done so without parental consent, we will delete that data immediately.
Account and data deletion
The user can delete their account at any time in Account Settings or by sending a request to [email protected].
More information at delete data.
Changes to this policy
We may update this policy to reflect legal, technical or Service changes. When that happens:
- We publish the updated version on this page with a new revision date
- We notify users by email in case of material changes
- Continued use of the Service after notification implies acceptance of the new terms
We recommend checking this page periodically.
Contact
For any question, request or complaint related to this policy or the processing of your personal data:
- General email
- [email protected]
- Data Protection Officer (DPO)
- [email protected]
- Postal address
- Benguela, Município de Lobito, Bairro Caponte, Rua Oliveira Cardonega