Privacy policy

Who the controller is

Massive Data Inc., which operates soloflow, is the controller of the personal data described in this policy, within the meaning of Article 5, item VI, of the LGPD. Identification and contact details are at the end of this page.

What data we process

Account data: name, email, and password. The password is stored only as a hash, never as plain text.

Organization and team data: the organizations you create or belong to, your role in each, and the invitations you send and receive.

Brand content: name, colors, typography, logo, tone of voice, offer and audience, the website or link-page address you provide when creating the brand, and any captions you paste.

Articles: the text of the articles you create and the settings used to design them.

Technical data: the IP address and browser of each session, and access logs.

We do not ask for sensitive personal data (Article 5, item II, of the LGPD). We do not process payments yet; when billing launches, this policy will be updated beforehand.

What we use it for and on what legal basis

To provide the service you signed up for — creating your account, setting up your brand, and generating, storing, and publishing articles — on the basis of performance of a contract (Article 7, item V).

To send account emails, such as email confirmation, password reset, and deletion notices, also on the basis of performance of a contract.

To keep the service secure and prevent fraud and abuse, on the basis of legitimate interest (Article 7, item IX).

To retain access logs for the period required by Brazil’s Internet Civil Framework (Marco Civil da Internet, Law No. 12,965/2014, Article 15), on the basis of compliance with a legal obligation (Article 7, item II).

We do not use your data for advertising, and we do not sell it.

Artificial intelligence

To write articles and suggest your brand, we send artificial intelligence model providers only what that task needs: your brand data, your request, and the public text of the website you provided. These providers act as processors and do not receive your password or data from other organizations.

Who we share it with

With processors who help us provide the service: hosting, database, file storage (such as logos), email delivery, visit counting (Cloudflare Web Analytics, by Cloudflare, Inc.), and the artificial intelligence providers described above. Each one processes the data only according to our instructions.

With public authorities, when required by a legal obligation or court order.

International transfer

Some processors are located outside Brazil. In those cases, the transfer follows Article 33 of the LGPD, with contractual protection safeguards compatible with Brazilian law.

Cookies

We use a single cookie, the session cookie, which is essential to keep you signed in. We do not use advertising cookies. The record that you saw the cookie notice is stored only in your browser. To count visits, we use Cloudflare Web Analytics, processed by Cloudflare, Inc. on our behalf: it uses no cookies or local storage, does not fingerprint your browser, and records only the page address, the referring page, the browser, operating system and device type, the country, and the load time.

How long we keep it

For as long as your account exists. When you delete your account, we erase your data and, in organizations where you were the only member, the stored brands and logos.

Access logs are kept for six months, as required by the Marco Civil da Internet. Backup copies are erased within [FILL IN: backup retention period].

Your rights

The LGPD (Article 18) gives you the right to: confirmation that we process your data; access to it; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary or excessive data; portability; deletion of data processed on the basis of consent; information about who we share it with; information about the option of not giving consent and its consequences; and withdrawal of consent.

You can download your data and delete your account at any time on the Account page of the dashboard. For any other request, contact the data protection officer using the details below. You can also file a petition with Brazil’s National Data Protection Authority (ANPD).

Security

Passwords are stored as hashes, connections use HTTPS, and each organization’s data is isolated in the database itself, so one organization cannot read another’s data.

Minors

soloflow is made for businesses and creators aged 18 or older and is not intended for children or adolescents.

Changes to this policy

When this policy changes in a material way, we will let you know by email or in the dashboard before the change takes effect.