About your data.

1. Who is the controller

The controller of the personal data in your account is the company responsible for metrifree, identified in the contract. For data our customers place in their brands (such as comments and messages from followers synced from the networks), the customer is the controller and metrifree acts as processor, following their instructions.

2. Data we process

We process only what is needed to provide the service.

• Sign-up: name, email, password (stored only as a hash), time zone
• Organization and billing: company name, plan, subscription status; card data stays with Stripe, not with us
• Connected network accounts: identifiers, profile name and access tokens (encrypted)
• Content: texts, media, schedules, notes and approvals
• Metrics and public or authorized interactions from the connected accounts
• Technical usage: IP address, access and error logs, for security and support

3. What we use it for and on which legal basis

Each use has a legal basis under the LGPD (art. 7).

• Providing the contracted service and the free trial: performance of a contract
• Billing and issuing invoices: performance of a contract and legal obligation
• Security, fraud prevention and access logs: legitimate interest and legal obligation (Brazilian Internet Civil Framework)
• Service emails (confirmation, password, billing, publishing notices): performance of a contract
• News and marketing communications: consent, which can be withdrawn at any time

4. Who we share it with

We do not sell personal data. We share it only with the service providers the service needs, who process the data according to our instructions.

• Stripe: payment processing
• Hosting and database provider (application servers)
• Cloudflare: media storage and content delivery
• Transactional email provider: sending the service's emails
• Social networks you connect: only what you tell us to publish or authorize us to read
• Authorities, when required by law or court order

5. International transfers

Some providers (such as Stripe, Cloudflare and the email provider) may process data outside Brazil. These transfers rely on the safeguards in art. 33 of the LGPD, such as contractual clauses and the adequacy of the providers.

6. How long we keep it

Account data is kept for as long as the account exists. When you delete the account, the data is removed from the main database immediately and from backup copies within 30 days. Access logs are kept for 6 months (Brazilian Internet Civil Framework), and tax data for the period required by tax legislation.

7. Your rights

You may exercise the rights in art. 18 of the LGPD: confirmation and access, correction, anonymization or deletion, portability, information about sharing and revocation of consent. In the app, under My account, you can download your data and delete your account yourself. For other requests, contact us by email at privacidade@metrifree.com. We respond within 15 days. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).

8. Security

We use technical and administrative measures to protect the data.

• Always encrypted connection (HTTPS)
• Passwords stored with scrypt hashes; network tokens encrypted in the database
• Permissions verified on the server for each brand and action
• Daily backups and restricted access to the infrastructure

9. Cookies

The app uses a session cookie needed to keep you signed in. The marketing site stores, for 90 days, a cookie with the origin of the visit (campaign and landing page), without identifying you. Details are on the cookies page.

10. Data protection officer and changes

The data protection officer can be contacted by email at privacidade@metrifree.com. This policy may be updated; material changes will be announced by email or in the app.