Privacy policy

1. Who is responsible for your data

EverFeed is an independent product, made in Brazil. EverFeed is the controller of the data in your account, your billing and your use of the service. Our data protection officer can be reached at contato@everfeed.app.

2. What this policy applies to

It applies to the everfeed.app website, sign-up and the account page, the panel and the EverFeed API. The third-party services you use through EverFeed — Instagram, Facebook, TikTok, AI providers, Google and Stripe — have their own policies.

Other people’s data that you put into the panel — people who appear in the videos, customers in testimonials, contacts in offers: in these cases, you are the controller, and EverFeed processes the data on your behalf, only to provide the service. It is up to you to have a legal basis for this, such as written authorisation from the people who lend their face and voice.

3. What data we process

Account

Name, email, password (stored only as a hash, never the password itself), language, your Google ID if you log in with Google, the dates you signed up, confirmed your account and last accessed it, and failed login attempts, to block attacks.

Payment

Payments are processed by Stripe: your full card number goes straight to Stripe and never touches our servers. We store the Stripe IDs of your customer record, subscription and invoices, plus the plan, currency, amounts and dates, and your account shows the card brand, last four digits and expiry date. To ensure one free trial per card, we store the card fingerprint generated by Stripe — a code that identifies the card without revealing its number.

Panel

• Brand kit: business name and legal name, CNPJ, industry, website, city and state, descriptions, personas, offers and prices, colours, fonts, logos, social network profiles and compliance disclaimers.
• People in the videos: the name, role, face photo and voice sample of anyone you register.
• Content: library files, generated pieces and their previous versions, prompts sent, schedules, posts and the metrics the networks return.
• Connected networks: the name and ID of the account or page and the access credentials you granted, stored encrypted.
• AI: the API keys you add (encrypted; the panel only shows the last few characters), the history of calls to providers, and your credit balance and statement.

Usage and security

IP address, browser, and the date and time of each access and of actions in the panel, used for security, attempt limits and bot checks.

Communication

The emails you send us and the ones we send about your account: confirmation codes, password recovery, receipts and billing notices.

In your browser

The site and the panel keep your session, language, theme and chosen plan in your browser’s local storage. We do not use advertising cookies or any tracking or analytics tools. Some pages load third-party services that may use their own cookies: Stripe, on the payment page, against fraud; Cloudflare Turnstile, on sign-up and login, against bots; and Google Fonts, which receives your IP address when it delivers the fonts.

4. What we use it for, and on what legal basis

• Creating and maintaining your account and providing the service — panel, generation, scheduling, publishing and metrics: performance of the contract.
• Billing, granting the free trial and preventing abuse, such as repeated trials with the same card: performance of the contract and legitimate interest in preventing fraud.
• Protecting your account and the system — attempt limits, bot checks and access logs: legitimate interest and compliance with a legal obligation.
• Sending emails about your account — confirmation, password, billing and trial notices: performance of the contract. We do not send newsletters or marketing emails.
• Keeping tax and access records required by law: compliance with a legal obligation.
• Handling support requests and defending rights in legal proceedings: performance of the contract and the regular exercise of rights.

We do not sell personal data, we do not use it for advertising and we do not use your content to train AI models. Only one decision is automated: refusing the free trial for a card that has already had one. If you disagree with it, ask for a review by email.

5. Who we share it with

Only with those who need the data for the service to work:

• Stripe — payments, subscriptions and fraud prevention.
• AI providers — what is needed to generate the piece: the brief and the brand kit text, reference images and logos and, for videos, the photo and voice of the chosen person. With your own key, the data goes to the provider you added. With EverFeed credits, it goes to the providers we use for each type of piece, such as DeepSeek (text), Alibaba Cloud with the Wan models (video) and Google (image and video).
• Meta (Instagram and Facebook) and TikTok — when you connect an account and publish: the content, the caption and the time. From them we receive the account name and ID and the post metrics.
• Google — Google login and the fonts on the site and in the panel.
• Cloudflare — bot checks on sign-up and login.
• Hosting and email delivery providers — where the system runs and how account emails are sent.
• Authorities — when required by law or a court order.

6. Transfers to other countries

Some of these providers store or process data outside Brazil — in the United States, Singapore, China and other countries where they have servers. These transfers take place to perform our contract with you and follow the safeguards of Brazil’s General Data Protection Law (LGPD), such as contractual clauses and each provider’s data protection rules.

7. How long we keep it

• Account, brand kit, connected networks and credits: for as long as the account exists — including while the panel is paused, so you can pick up where you left off.
• Uploaded and generated files: while the panel is active, they are deleted automatically 15 days after upload or generation, except brand kit files and files for posts that have not gone out yet. While the panel is paused, they are kept until you come back or ask for them to be deleted.
• Logs of access and of actions in the panel: 6 months, as required by Brazil’s Internet Civil Framework (Marco Civil da Internet).
• Billing records and invoices: for the period required by tax law.
• Card fingerprint used for the free trial: kept even after the account is deleted, to prevent repeated trials with the same card.

Once you ask for your account to be deleted, we delete or anonymise the rest of your data within 30 days, including in backups, as part of their normal cycle.

8. Your rights

Under Brazil’s General Data Protection Law (LGPD), you can, at any time:

• confirm whether we process your data and access it;
• correct incomplete, inaccurate or out-of-date data;
• ask for data that is unnecessary or processed in breach of the law to be anonymised, blocked or deleted;
• ask for the portability of your data;
• ask for your data to be deleted and your account closed;
• find out who we share your data with;
• withdraw consent and object to processing;
• ask for a review of automated decisions.

You can do some of this yourself: change your password and cancel your subscription in My account, and remove files and connected networks in the panel. For everything else, write to contato@everfeed.app from the email address on your account. We reply within 15 days. If you are not satisfied, you can lodge a complaint with Brazil’s National Data Protection Authority (ANPD).

Outside Brazil, you can use the same email address to exercise the equivalent rights that the law of your country guarantees.

9. How to delete your data

1. In the panel, disconnect your Instagram, Facebook and TikTok accounts. This deletes that account’s credentials, posts and metrics from EverFeed. To also cut off access on the network’s side, remove EverFeed in the app settings of the network itself.
2. In My account, cancel your subscription.
3. Write to contato@everfeed.app, from the email address on your account, asking for deletion. We confirm the request and delete the data within 30 days, with the exceptions listed under How long we keep it.

10. Security

• All traffic uses HTTPS.
• Passwords are stored only as hashes, and so are session, API and password reset tokens.
• AI keys and network credentials are stored encrypted and never come back in full through the API.
• Your card number never touches our servers.
• Panel files — images, videos, photos and voices — are delivered through long, hard-to-guess addresses that open without logging in. Anyone who has the link can see the file: do not share links to files that should stay private.
• No system is 100% secure. If an incident could cause you significant risk or harm, we notify you and Brazil’s National Data Protection Authority (ANPD), as the law requires.

11. Children and teenagers

EverFeed is for people aged 18 and over and is not directed at children or teenagers. If you are responsible for a minor and think they have created an account, contact us so we can remove it.

12. Changes to this policy

When this policy changes, the date at the top is updated. We give notice of significant changes by email before they take effect.

13. Contact

Data protection officer: contato@everfeed.app.