Privacy Policy

Fullturi Company LTDA (CNPJ 39.243.939/0001-12, Av. Paulista, 1471, Conj. 511, Bela Vista, São Paulo/SP, Brazil, ZIP 01311-927) operates the website fullturi.com and the system app.fullturi.com. In this text, "Fullturi", "we" and "our" refer to it.

In some cases we are the CONTROLLER of the data (we decide why and how it is used); in others we are the PROCESSOR (we handle data on behalf of one of our customers, following their instructions). Section 2 explains the difference, because it changes who answers each request you make.

Fullturi is a marketing system used by companies and agencies. That creates two groups of people in different situations:

• People who use the system or talk to us (you create an account, subscribe to a plan, request a diagnosis of your website, or write to us): we are the controller of your data and we answer your rights requests directly.
• Customers or contacts of one of our customers (for example, someone who chatted on WhatsApp with a store that uses our CRM, or a follower of a brand that publishes through the system): our customer is the controller and we are the processor. To exercise rights over that data, the main path is to contact the company you dealt with. We help that company serve you and, if you write to us, we forward your request.

We process only what the service needs to work. By group:

• Account and organization: name, e-mail, password (stored irreversibly, never as plain text), company name, each team member's role and account preferences.
• Contracting and payment: the plan and the billing history. Card data is received and stored by the payment processor (Stripe), not by us. For sales on the website, Pix is processed by PushinPay.
• Projects and content: the agency's client records, texts, images, captions, editorial calendars, schedule and tasks that you write or upload to the system.
• CRM and support (when you use it): contacts, companies, deals, notes, WhatsApp messages and received files. This data belongs to your business; we store and process it for you.
• Connections to other platforms: the credentials you authorize (Meta, Google, WhatsApp and the keys of AI providers you register). They are stored encrypted (AES-256-GCM) and are never returned by the system's routes.
• Instagram and Facebook data, detailed in section 5.
• YouTube data, detailed in section 6.
• Website diagnosis: the address of the site you ask us to analyze, your name and WhatsApp number, and the answers to the form that comes with the report.
• Use and security: IP address, date and time, browser type and the actions recorded in the audit log (who did what), to protect the account and investigate abuse.

Each use rests on a legal basis of Brazil's data protection law (LGPD, art. 7). We do not use data for another purpose without telling you.

• Providing the service you contracted (creating the account, generating content, scheduling and publishing, supporting customers in the CRM, billing): performance of a contract.
• Keeping the system secure, preventing fraud and abuse, and keeping access logs: legitimate interest and legal obligation. Brazil's Internet Civil Framework requires us to keep application access logs for six months.
• Replying to you (support, questions, the result of your website diagnosis): performance of a contract and pre-contractual steps, or legitimate interest.
• Measuring visits and ads on the website, when we turn those tools on (section 10): legitimate interest or consent, as applicable.
• Meeting tax and accounting obligations: legal obligation (we keep tax documents for the period set by law).
• Exercising rights in judicial, administrative or arbitration proceedings: regular exercise of rights.

We do not sell personal data. We do not use data coming from Meta or Google to build ad profiles or to train artificial intelligence models.

When you connect a Facebook Page and a professional Instagram account under Integrations, the system receives from Meta, with your authorization, only what it needs to publish and schedule posts. Fullturi is not affiliated with or endorsed by Meta Platforms, Inc.

The authorization is requested by Meta (Facebook Login for Business) and you choose which Pages and accounts to share. The permissions we request, and why:

• instagram_basic: read the profile of the Instagram account you connected (identifier, username and picture), to show it on screen and know where to publish.
• instagram_content_publish: publish to Instagram the images, carousels and captions that you yourself choose to publish.
• pages_show_list: list the Pages you manage, so you can choose which one to link to the project.
• pages_read_engagement: read the basic data of the chosen Page (name, picture), needed to identify it.
• pages_manage_posts: publish to the Facebook Page what you choose to publish.

What we store: the identifier, name and picture of the Page and of the Instagram account, and the access token (encrypted). What we send to Meta: the images, captions and times you approve. We store the result of the publication (the post identifier and any errors) to show it to you.

From Instagram and Facebook, we do not read private messages, comments or the follower list. If we ever offer features that need other permissions, we will ask you at that moment and update this text.

AI-generated content: when a piece is created with the help of AI, the system offers to mark it as "AI-generated" when publishing to Instagram, as Meta asks. The final decision is yours.

If you use the ads connection (Meta Ads), we read metrics from the ad accounts you authorize, for reports and analysis. We do not change campaigns.

Meta tokens are used only for the actions you requested. If you disconnect, we remove the access (see section 12).

When you connect a YouTube channel under Integrations, the system uses the YouTube API Services to upload to the channel the videos you choose to publish. By using this feature, you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms), and your data is handled by Google under the Google Privacy Policy (https://policies.google.com/privacy). Fullturi is not affiliated with or endorsed by YouTube or Google LLC.

The authorization is requested by Google, on its own screen, and covers one channel. The permissions we request, and why:

• youtube.upload: upload to your channel the videos (Shorts) that you yourself choose to publish.
• youtube.readonly: read the identifier, name, handle (@) and picture of the channel you connected, to show it on screen, and check whether the uploaded video has finished processing.

What we store: the identifier, name, handle (@) and picture of the channel, and the access and refresh tokens (encrypted). What we send to YouTube: the video file, the title, the description, the tags, the visibility, your answer on whether the video is made for kids and, when you tick it, the notice of AI-generated or altered content. We store the identifier of the published video and any errors, to show them to you.

From YouTube, we do not read comments, messages, the subscriber list, the watch history, the statistics or the videos already on the channel. We use the channel data only for the publication you requested: we do not sell it, we do not use it for ads or to train artificial intelligence models, and we do not share it with third parties other than the infrastructure providers in section 8. People on our team only access it with your authorization (in a support request), for security reasons or to comply with the law.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

You can revoke Fullturi's access at any time: click "Disconnect" on the channel, under Integrations, or remove Fullturi on your Google Account security page (https://security.google.com/settings/security/permissions). Section 12 explains what is deleted and how quickly.

The system uses third-party artificial intelligence models (such as Anthropic, OpenAI and Google, or an aggregator you choose) to write texts, propose editorial calendars, generate pieces and images and support customer service. To do so, we send the provider what you asked for and the context needed: your request, the instructions you saved and project data (such as segment, audience and brand voice).

For most features, you are the one who contracts the provider, with your own access key: use and cost stay on your account with them, and their terms apply. In the CRM, AI uses only your organization's key. We do not use customers' content to train our own models. Always review what the AI produces before publishing or sending.

Only with those who need to take part in the service, under contract and for that purpose. Today, these are the types of supplier (processors and sub-processors):

• Infrastructure: servers (VPS) and file storage (Cloudflare R2, when enabled).
• Payment: Stripe (system subscriptions) and PushinPay (Pix on website sales).
• E-mail: Resend, for the system's and the funnel's e-mails.
• Platforms you connect: Meta (Instagram, Facebook and the official WhatsApp API) and Google (calendar and YouTube), and WhatsApp by device pairing, when you choose that path.
• Artificial intelligence: the providers in section 7.
• Internal notices: Telegram, which delivers the website-diagnosis lead to our team.
• Website measurement: Google PageSpeed Insights (analyzes the site address you provide) and, when enabled, the Meta Pixel and Plausible Analytics.

We also share data when the law, a court order or an authority requires it, or to defend our rights. If the company goes through a merger or sale, the data may go with the business, keeping these guarantees.

Some of these suppliers process data in other countries. When that happens, we look for suppliers that offer safeguards compatible with the LGPD (art. 33), such as standard contractual clauses and security commitments, and we limit what we send to what is necessary.

We use few cookies, and most are needed for the website and the system to work:

• Session (necessary): keeps you signed in to the system and the panel. Without it there is no login.
• Language (necessary): remembers the language you chose on the website.
• Visit counting: a random number that does not identify you, used only so we count one visit per browser per day.
• Visit origin: remembers the campaign or link you came from (for example, an ad), so we know where conversations come from.
• Third-party measurement, when enabled: Plausible Analytics (visit statistics) and the Meta Pixel (ad measurement). You can block them in your browser settings or with privacy extensions, and you can ask us to handle or delete your data.

We keep data for as long as needed for the purpose it was collected for, and then delete or anonymize it, unless the law requires us to keep it:

• Account, projects and content: while the account exists. When it is closed, or at your request, we delete or anonymize, except what the law requires us to keep.
• Application access logs: six months, as the Internet Civil Framework requires.
• Tax and billing documents: for the legal period (generally five years).
• Details of the CRM AI agent's turns: purged after six months.
• Access tokens for Meta, Google and other platforms: until you disconnect, or until the platform revokes the access; after that, they are deleted (section 12).
• Website-diagnosis lead: it is not saved in a database; it is delivered to our team by message and used only to talk about the diagnosis.

You can disconnect an account and ask for deletion of the data that came from it at any time, in any of these ways:

• In the system: sign in at app.fullturi.com, open Integrations, go to Social networks and click "Disconnect" on the account. The access is switched off and the token stops being valid for us.
• Through Facebook or Instagram: in your Meta account settings, open "Business Integrations" (or "Apps and Websites"), find Fullturi and remove it. Meta notifies us automatically, and we then switch off the accounts linked to that authorization and delete the token.
• Requesting data deletion: if you ask Meta to delete the data linked to the app, or write to us, we delete the Facebook and Instagram accounts linked to your authorization and the stored credentials, and return a confirmation code. You can follow the request at the address Meta shows, or with the code, at fullturi.com/privacidade.
• YouTube: under Integrations, click "Disconnect" on the channel. We revoke the access at Google and immediately delete the tokens and the channel data (identifier, name and picture). If you prefer to remove Fullturi on your Google Account security page (https://security.google.com/settings/security/permissions), the access stops working at once, and we delete the channel data as soon as the system notices the removal, within 30 days at most. If you ask us by e-mail, we delete it within 7 days.
• By e-mail: write to the contact at the end of this text, stating your account e-mail. We reply within 15 days.

What is deleted: the Instagram and Facebook accounts linked to your authorization (name, picture, identifiers) and the access tokens. What remains: the publications and history of the project belong to the customer who created them, stay with them and no longer have any link to your Meta account. Records that the law requires us to keep remain for the legal period.

Deleting data in our system does not remove what was already published on Instagram, Facebook or YouTube: you delete that on the platform itself.

We adopt technical and organizational measures proportionate to the risk. Among them:

• Encrypted connection (HTTPS) between you and the system.
• Third-party access tokens and keys encrypted in the database (AES-256-GCM); they are not sent back to the screen.
• Separation between organizations: each organization sees only its own data, and per-project access is controlled by role.
• Two-step authentication available, an audit log of sensitive actions, and customers' access links stored only as a fingerprint (hash).
• Usage limits and abuse checks, and uploaded files are rewritten by us before being stored.

No system is infallible. If an incident occurs that may cause relevant risk or harm, we will notify Brazil's data protection authority (ANPD) and the affected people, within the time and in the form the regulation requires.

The LGPD (art. 18) guarantees you, regarding the data for which we are the controller:

• to confirm that we process your data and to access it;
• to correct incomplete, inaccurate or outdated data;
• to request anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
• to request data portability;
• to request deletion of data processed with your consent;
• to know who we share data with;
• to know that you may refuse consent, and the consequences;
• to withdraw consent, when that is the basis;
• to object to processing based on legitimate interest;
• to request review of decisions made solely by automated processing.

To exercise any of them, write to the contact below. We confirm receipt and reply within 15 days. We may ask for information to confirm who you are, so we do not hand data to the wrong person. You can also complain to the ANPD (gov.br/anpd).

The system is aimed at companies and professionals aged 18 or over. We do not knowingly collect data from children and teenagers. If you think that happened, tell us and we will delete it.

When we change something relevant, we update the effective date at the top and, for account holders, notify you in the system or by e-mail. The previous version remains available to whoever asks.

For any privacy and data protection matter, including talking to the data protection officer (the person who handles this here), write to [email protected]. We answer general questions on WhatsApp (+55 79 99116-7468), but formal requests about personal data must come by e-mail.