Privacy Policy

1. Who we are

AgineOS (“AgineOS”, “we”, “us”) is a software platform for marketing agencies, available at agineos.com. It is operated by ADL Promoção e Pesquisas de Mercado LTDA, a company registered in Brazil (“ADL”). ADL is the data controller for personal data processed through AgineOS, except where our agency customers act as controllers of their own clients’ data — in that case we process it on their behalf, as a processor.

For any privacy matter, contact [email protected].

2. Data we collect

Account and workspace data

• Name, email address and password (stored as a salted hash) when you create an account.
• Workspace settings, branding assets and team member information added by your workspace admin.
• Billing details processed by our payment provider (Stripe). We do not store full card numbers.

Data you bring into the platform

• Prospect and client records you create or import: business names, public contact details, notes, pipeline stages and communication history.
• Content generated for your work: audits, proposals, reports and outreach messages.

Data from connected platforms

• When you connect a third-party account (for example a Meta ad account), we access only the data needed to show your reports: campaign structure, performance metrics and account metadata. Access is read-only and authorized by you through the platform’s own consent flow (OAuth). We receive access tokens, which are stored encrypted, and never your platform passwords.

Usage data

• Log and device data (IP address, browser type, pages viewed, timestamps) used for security, debugging and product improvement.
• When you are signed in, a device identifier generated by your browser, linked to your account, so we can recognize the devices that access it and flag unusual sign-ins.

Our public website (the pages you can see without signing in) does not use advertising or analytics trackers, and does not identify your device.

3. How we use data

• To provide the service: audits, reports, CRM, proposals, the client portal and billing.
• To secure accounts, prevent abuse and comply with legal obligations.
• To communicate service updates. Marketing emails are opt-in and can be unsubscribed at any time.
• To improve the product, using aggregated or de-identified information wherever possible.

We do not sell personal data. We do not use data from connected advertising platforms for any purpose other than providing the reporting and analysis features to the workspace that connected the account.

4. Platform data from Meta and other providers

Where AgineOS integrates with Meta’s products, we process “Platform Data” as defined by the Meta Platform Terms, and we comply with those terms, including:

• Using Platform Data only to provide the features the connecting user requested.
• Never selling, licensing or sharing Platform Data with data brokers or ad networks.
• Keeping Platform Data logically separated per workspace (tenant).
• Deleting Platform Data when the user disconnects the integration, deletes their account, or when Meta requires deletion — see Data deletion below.

The same principles apply to any other advertising or analytics platform we integrate with.

5. Legal bases

We process personal data under the legal bases of the Brazilian LGPD (Lei 13.709/2018) and, where applicable, the GDPR: performance of a contract (providing the service), legitimate interest (security, product improvement), consent (marketing communications, platform connections) and compliance with legal obligations.

6. Sharing

We share data only with service providers necessary to run AgineOS:

• Hosting and infrastructure providers (application hosting, database, file storage).
• Stripe, for payment processing.
• Email delivery providers, for transactional and (where opted-in) marketing email.

These providers act as processors under contract and may not use the data for their own purposes. We may also disclose data if required by law or to protect our legal rights.

7. International transfers

Our infrastructure providers may store data outside Brazil. Where data crosses borders, we rely on the safeguards provided by our processors (such as standard contractual clauses) as permitted by the LGPD and GDPR.

8. Retention

• Account data: kept while the account is active.
• Platform Data from connected accounts: kept while the connection is active; deleted when the connection or the account is removed.
• After account deletion, remaining personal data is removed from production systems within 30 days, and from backups within 90 days. We may retain what is strictly required for legal or accounting obligations.

9. Security

Data is encrypted in transit (TLS) and at rest. Access tokens for connected platforms are stored encrypted. Access to production systems is restricted and logged. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you and the competent authority as required by law.

10. Your rights

Under the LGPD (and GDPR where applicable) you may request: confirmation of processing, access, correction, portability, anonymization, deletion, and information about sharing. To exercise any right, email [email protected]. We respond within the legal deadlines. If you are an end client of an agency that uses AgineOS, we may redirect your request to that agency, which is the controller of your data.

11. Data deletion

You can delete your data at any time, in three ways:

• Disconnect an integration: in Settings → Integrations, remove the connected platform account. We delete the stored tokens immediately and the associated platform data within 30 days.
• Delete your account: in Settings → Account, request deletion. All workspace data follows the retention schedule in section 8.
• By email: send a request to [email protected] from the address associated with your account. We will confirm completion.

Requests originating from Meta’s data deletion callback are honored automatically for the requesting user’s Platform Data.

12. Children

AgineOS is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18.

13. Changes

We may update this policy. Material changes are announced by email or in-app notice at least 15 days before taking effect. The “Last updated” date at the top always reflects the current version.