Privacy policy

Who controls the data

The controller is OLHARY LTDA, a Brazilian company registered under CNPJ 60.758.275/0001-10, at Rua Ilicínia 222, Horto Florestal, São Paulo/SP 02378-070, Brazil. The data protection officer (DPO) is Gustavo Salomé Silva, reachable at info@olhary.ai.

What we collect

Sign-up: name, email and password (stored hashed) or your Google login.

SmartGenius usage: language, time zone, profiles, each profile's brand (such as its colors, logo and tone of voice), posts, files you upload and your ratings of what we generate.

Instagram, if you connect it: account identifier, handle, access token (encrypted) and, with your authorization, the profile's public posts and images, used to learn its style.

API keys, if you create one: the name you gave it, who created it, when it was last used, and a cryptographic hash of the key. Never the key itself, which only you see, once.

Technical: IP address, browser and error logs. Payments: processed by Stripe. We never store card numbers.

What we use it for

Providing the service you signed up for: generating content, building posts and publishing to Instagram on your instruction (performance of a contract).

Billing, issuing invoices and meeting legal obligations.

Keeping the service secure, preventing fraud and abuse, and improving the product (legitimate interest).

Contacting you about your account (published posts, failures, charges) and, if you want them, news and tips. The next section covers each kind.

Emails we send

About your account: sign-up confirmation, password resets, receipts and changes to your plan. We also write when a post is waiting for your approval or someone asks for changes to it, when a scheduled post goes live or doesn't go out, when Autopilot stops and when Instagram needs reconnecting. Those you turn on and off in Account → Notifications. The rest are part of the service and keep coming while the account exists.

News and tips: we send none today. If we ever start, only people who left the box ticked at sign-up will get them, and every email will carry an unsubscribe link. Legal basis: legitimate interest, with an opt-out at any time.

We don't sell your email address.

Artificial intelligence and processors

To generate copy and images we send the necessary material (your idea, copy, photos and your profile's brand) to AI providers (such as Google and OpenAI), which act as processors and use that material only to produce what you asked for. [Confirm in each provider's contract: no use of the data to train models.]

This may involve international data transfers, made with the safeguards the LGPD requires.

Signing in with Google

If you sign in with Google, all we receive is what the consent screen shows: your name, your email address and your profile picture. We use them to create your account, recognise you when you come back and write to you about the service.

We do not ask for access to your Gmail, your Drive, your calendar or your contacts. We do not sell this data, we do not use it for advertising, and we do not train AI models on it.

To disconnect, remove SmartGenius at myaccount.google.com/permissions. Your account stays: set a password in settings to sign in without Google, or delete the account there.

SmartGenius’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Instagram

We access your account only through Meta's official API, with the permissions you grant, to publish what you approved (or what goes out through Autopilot, as you set it) and, if you authorize it, to read the profile's posts to learn its style.

For the radar, we also read public posts of profiles you name or that it finds about your subject, only what anyone can see without signing in to Instagram, never through your account. You can take any of them off the list at any time.

When you disconnect, the token is deleted immediately. If you remove SmartGenius from within Instagram, Meta notifies us and we delete the connection the same way.

Who we share with

We do not sell data. We share only with processors the service needs: hosting and database, AI providers, Stripe (payments), Amazon SES, the email service of Amazon Web Services (which receives your name, your email address and the message itself in order to deliver it) and Meta, when you publish. Amazon SES works in the United States, in AWS's us-east-1 region. AWS may keep and scan each message to block spam and viruses. If an email from us bounces for good or is marked as spam, Amazon SES stops sending to that address until we take it off the list.

Also when required by law or by order of a competent authority.

How long we keep it

For as long as your account exists. When you delete it, we erase your data within 30 days, except what the law requires us to keep: tax records for 5 years and access logs for 6 months (Marco Civil da Internet, Brazil's internet law).

Images made through the API are deleted 8 days after they were made.

Your rights

The LGPD guarantees you the right to confirm whether we process your data, access it, correct it, request anonymization, deletion or portability, know who we share it with, and withdraw consent.

You can export your data and delete your account in your settings. For everything else, email the DPO. We reply within 15 days.

Cookies and local storage

Only the essentials: your login session and preferences (language, theme) live in the browser. No advertising cookies, no third-party trackers.

The email you type on the login and sign-up screens stays in this browser only, for up to 30 minutes, so the next screen can fill it in. It is cleared when you sign in.

We log SmartGenius usage events (for example, "post created") on your account to understand and improve the product.

Security

Encryption in transit and at rest for tokens, hashed passwords, restricted team access and daily backups. No system is infallible: material incidents are reported to you and to the ANPD as the law requires.

Minors

The service is for adults 18 and over. We do not knowingly collect data from minors; if we find any, we delete it.

Changes

We may update this policy. Material changes are announced by email or in SmartGenius before they take effect.

Contact

Data protection officer (DPO): Gustavo Salomé Silva, at info@olhary.ai.