Polozi Social · Version 1, in force since 13 August 2026
Polozi Social is operated by VIDA PLENA TREINAMENTOS LTDA, registered under Brazilian company number (CNPJ) 20.329.336/0001-00, with registered office at Av. Joaquim Alves Correa, 2800 — Parque Nova Suíça — Valinhos/SP — ZIP 13271-430, Brazil.
This is the same entity whose business verification with Meta appears under the "Polozi Coaching" portfolio.
Data Protection Officer, under article 41 of the Brazilian General Data Protection Law (LGPD): José Carlos Polozi, polozi@polozi.com.br.
Polozi Social lets students of the Mestre das IAs course connect their own Instagram professional account and publish to it content that they themselves create and approve, from their own working environment (Claude Code or Codex).
We are not Instagram and we have no corporate relationship with Meta. We act as a Tech Provider under the Meta Platform Terms: we process data obtained from the platform exclusively on behalf of, and under the instruction of, the data subject themselves.
Name, e-mail, phone/WhatsApp and Brazilian taxpayer number (CPF), collected when you registered for an event and purchased the course. On the connection screen we display them so that you can confirm or correct them — a correction updates your record.
| Data | Purpose |
|---|---|
| Instagram user ID and username | identify which account to publish to |
| Account type (Business or Creator) | validate available features (stories require a Business account) |
| OAuth access token | authorize publishing on your behalf |
| Granted scopes | record exactly what you authorized |
The token is stored encrypted (AES-256-GCM), with the key kept outside the database. We never have access to your Instagram password.
Media type, caption, post ID and permalink, date and time, the identity of whoever approved it, and a cryptographic digest (hash) of the approved content — the last one so we can prove we published exactly what you saw.
Version and hash of the text you read, date and time of acceptance, IP address and browser identification.
Calls to the Instagram API, error codes and rate-limit indicators, retained for 30 days.
If you need a file later, it is on your own Instagram.
We also do not access your direct messages, your followers, your insights or your ad campaigns. We do not request those permissions.
| Processing | Legal basis |
|---|---|
| Providing the service to you, an enrolled student | performance of a contract (art. 7, V) |
| Publishing to your Instagram on your behalf | specific consent (art. 7, I) |
| Technical and security logs | legitimate interest (art. 7, IX), limited to what is necessary |
Consent to publish is separate from the course contract, is specific, and can be withdrawn at any time without affecting your enrolment.
| With whom | What | Why |
|---|---|---|
| Meta Platforms, Inc. | approved content + token | it is the destination of the publication |
| Infrastructure provider | data at rest and in transit | hosting the service |
We do not sell data. We do not use your data for advertising. We do not use your data or your content to train artificial intelligence models.
Meta and our infrastructure providers keep servers outside Brazil. By using the service, your data is transferred internationally, on the basis of the performance of the contract and of your consent, and subject to the contractual safeguards of the respective providers.
| Data | Period |
|---|---|
| Media files | deleted on publishing; sweep within 24h |
| Access token | deleted immediately on disconnection or revocation |
| Publication records | 12 months after publishing |
| Consent records | 5 years after revocation or termination of the service, as proof of compliance |
| Technical logs | 30 days |
The retention period for consent records follows the 5-year limitation period of article 27 of the Brazilian Consumer Protection Code: it is the proof that authorization to publish existed, and it needs to outlive the consent itself. Deletion of the remaining data at the data subject's request does not depend on that period.
Confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing, and withdrawal of consent.
To exercise them: polozi@polozi.com.br, or through the data deletion page. We respond within 15 days.
Token encrypted at rest with the key kept outside the database; data isolation between students enforced at the database level; access restricted to named and audited credentials; verified signatures on calls to the Meta API; and least privilege — the publishing service has no technical access to the commercial database.
No system is immune. In the event of an incident with relevant risk, we notify you and the Brazilian data protection authority (ANPD) under article 48 of the LGPD.
Material changes will be communicated in advance. If a change affects the scope of what you authorized, we will ask for new consent — the previous text remains on record and is identifiable by its hash.
VIDA PLENA TREINAMENTOS LTDA · CNPJ 20.329.336/0001-00
Av. Joaquim Alves Correa, 2800 — Parque Nova Suíça — Valinhos/SP — ZIP 13271-430, Brazil
Data Protection Officer: José Carlos Polozi —
polozi@polozi.com.br