Worxpace Privacy Policy

2. Data we collect

• User registration: full name, email, profile photo (avatar), and role at the agency (administrator or custom).
• Agency registration: name, logo, and internal settings.
• Registration of the agency's clients: name, logo, briefs, brand guidelines, and associated social profiles.
• Content produced: jobs (brief, media, history), internal comments, approval flows, and scheduled posts.
• OAuth integrations: when you connect Meta (Instagram/Facebook), LinkedIn, TikTok, or YouTube accounts, we store access tokens encrypted with AES-256-GCM, along with the account's external identifier, the public name (display name or channel name), and the profile/avatar/channel photo (only the URL of the image hosted by the platform itself — we do not make a local copy). We do not store your password for these platforms.
• YouTube data (YouTube API Services): when you connect a YouTube channel via Google OAuth, Worxpace uses YouTube API Services. We collect only public metadata of the authorized channel (channel ID, name, avatar, subscriber count, and video count) to display the selected channel in the agency's dashboard. The `youtube.upload` scope is used exclusively to publish videos scheduled by the agency itself on the connected channel. You can revoke access at any time at myaccount.google.com/permissions. This integration complies with the YouTube API Services Terms of Service and the Google Privacy Policy.
• Usage data: records of actions in the system (job creation, status changes, comments) used for history and auditing.
• Technical sign-up signals (free trial abuse prevention): when you create an agency and when you subscribe to a plan, we collect the IP address of the connection and a device fingerprint built from characteristics reported by the browser (system, language, time zone, screen resolution, number of cores). We also use the email domain and the CPF/CNPJ provided at payment. The IP and the device fingerprint are never stored in plain text: we keep only a cryptographic digest (SHA-256 hash with a server secret key), which serves to compare two sign-ups and does not allow the original value to be recovered or the person to be identified. From the email we keep only the domain (e.g., “gmail.com”). We do not use canvas fingerprinting, WebGL fingerprinting, third-party cookies, or any cross-site tracking.

3. How we use your data

• Product operation: authentication, permission management, display of jobs, comments, approvals, and reports.
• Automatic publishing: the social integration tokens are used exclusively to publish posts on the dates/times scheduled by the agency, on the accounts connected by the client itself.
• Notifications: in-app alerts about mentions in comments, pending approvals, publishing failures, and job assignments.
• Public approvals: unique links (`/aprovacao/<token>`) allow the end client to approve or request changes without needing to register.
• Free trial abuse prevention: the technical sign-up signals are combined into a risk score, used only to decide whether a new free trial period is granted. No single signal blocks anything, the decision never prevents the purchase of a paid plan or access to an existing account, and the score and the signals are recorded so that we can review cases upon request. If you believe there has been a mistake, write to the contact at the end of this page — we review manually. This data is not used for commercial profiling, advertising, or any other purpose.

We do not use your data for sale, behavioral marketing for third parties, or training of AI models outside the context of Worxpace itself.

4. Sharing with third parties

We work with vendors that process data on our behalf, always under contractual agreements and only for the purposes described here:

• Supabase — PostgreSQL database and authentication. Location: AWS São Paulo (sa-east-1).
• Vercel — hosting of the front end and serverless functions.
• Meta Platforms (Instagram & Facebook) — content publishing via the official Graph API, only on the accounts voluntarily connected by the client.
• LinkedIn — content publishing via the official API, only on the connected accounts/pages.
• TikTok — content publishing via the official Content Posting API, only on the connected accounts.
• Google & YouTube — authentication via Google OAuth and video publishing via YouTube Data API v3, only on the connected channels.
• cron-job.org — triggering of scheduled tasks (automatic publishing of scheduled posts).
• Anthropic — assisted copy generation via the Claude API, when the user explicitly triggers the AI tools.

We never sell your data.

5. Security

• All communication takes place over HTTPS/TLS.
• Social integration tokens are encrypted at rest with AES-256-GCM.
• The database uses PostgreSQL Row Level Security (RLS) to isolate each agency's data and prevent cross-access.
• User passwords are never stored by Worxpace — all authentication happens via Supabase Auth with secure hashing.
• httpOnly cookies and CSRF validation in the OAuth flows protect against request forgery.

6. Your rights

• Access your data: view all the information we hold about you in the Worxpace dashboard.
• Revoke integrations: at any time, in “Cliente → Integrações → Desconectar”. The tokens are deleted immediately from our database. You can also revoke access directly in Meta Business Suite, in LinkedIn Settings, in TikTok Settings, or at myaccount.google.com/permissions (Google/YouTube).
• Request account deletion or data export: send an email to contato@agenciabehave.com and we will respond within 7 business days.
• Correct inaccurate data: most of the information can be edited directly in the dashboard.

7. Retention

We keep your data for as long as the account is active. When you request deletion, we remove personal information within 30 days, except where there is a legal retention obligation (tax records, for example).

The technical sign-up signals (IP and device fingerprint hashes, email domain, and the risk score) are kept for 12 months from sign-up, the period necessary for abuse prevention to work, and after that they are discarded.

8. Cookies and local storage

We use httpOnly cookies only for authentication (Supabase session) and temporary cookies during OAuth flows (CSRF validation). We do not use tracking cookies or third-party analytics.

9. Changes to this policy

We may update this policy periodically. Material changes are communicated via email or notification in Worxpace, at least 15 days in advance.

10. Contact

Questions, requests, or complaints about this policy:
contato@agenciabehave.com