Privacy Policy

The Centriu Tecnologia Ltda. ("Centriu", "we", or "us") is committed to protecting the privacy and personal data of all users, clients, partners, and visitors of our websites and platforms.

This Privacy Policy describes how we collect, use, store, share, and protect your personal data, in compliance with the Brazilian General Data Protection Law (LGPD - Law No. 13.709/2018) and other applicable legislation.

1. Data Controller

The controller of the personal data processed under this Policy is:

2. Personal Data We Collect

We may collect the following types of personal data:

3. Purposes of Processing

We use your personal data for the following purposes:

• Service provision: To provide access to the Centriu OS platform and its modules;
• Account management: To create, manage, and maintain your user account;
• Communication: To send notifications about the service, updates, and marketing communications (when authorized);
• Support: To respond to questions, requests, and provide technical assistance;
• Improvements: To analyze platform usage and enhance our services;
• Security: To detect, prevent, and respond to security incidents;
• Legal obligations: To comply with legal and regulatory obligations;
• Billing: To process payments and issue tax documents.

4. Legal Bases for Processing

Centriu's processing of personal data is based on the following legal bases provided for in the LGPD:

• Performance of a contract: To provide the contracted services;
• Consent: For marketing communications and the use of non-essential cookies;
• Legitimate interest: For security improvements, fraud prevention, and service enhancement;
• Legal obligation: To comply with legal and regulatory obligations.

5. Data Sharing

We may share your personal data with:

• Service providers: Companies that assist us in operations (hosting, payment processing, email delivery), under contracts that ensure data protection;
• Business partners: When necessary for the integrated provision of services;
• Authorities: When required by law, court order, or request from a competent authority;
• Group companies: For internal administrative purposes, always in compliance with this Policy.

We do not sell, rent, or trade your personal data with third parties.

6. Platform Integrations (Meta, Google, TikTok, LinkedIn)

Several modules in the Centriu ecosystem (Atlas, Link, Maestro, Run, among others) offer OAuth integrations with social media and marketing platforms. When the user (the legitimate account administrator) authorizes the connection, the module receives an access token to collect specific data from the accounts connected by the user themselves.

6.1. Data collected from Meta (Instagram and Facebook)

• Facebook Pages managed by the user (id, name, photo) — via pages_show_list
• Linked Instagram Business accounts (username, photo, bio, followers, media count) — via instagram_basic
• Published posts (id, caption, media, public URL, publication date)
• Per-post Instagram metrics (impressions, reach, likes, comments, shares, saves, video plays) — via instagram_manage_insights
• Page-level Facebook metrics (unique impressions, page views, engagement) — via read_insights
• Direct messages (DM) on Instagram and Messenger from the user's customers, displayed in the service center (Link) — via instagram_manage_messages, pages_messaging
• Comments on the user's own posts (Atlas Social Listening module) — via pages_read_user_content
• Meta Ads ad accounts and campaign metrics (Maestro module) — via ads_management, ads_read, pages_manage_ads

6.2. How this data is used

• Displayed in Centriu's authenticated dashboard only to the administrator of the connected account and their team within the same organization
• Stored in our database (Supabase) per organization, with Row Level Security (RLS) that prevents cross-access between clients
• Processed by AI models (Google Gemini, OpenAI) to generate textual interpretations (e.g., "engagement dropped 22% on Reels this week")
• Aggregated into weekly/monthly PDF reports exportable by the user
• Used to reply to messages (in the case of DMs) — always triggered by a human click, never automatically

6.3. What Centriu does NOT do with this data

• We do not share it with third parties for retargeting or advertising
• We do not sell the data
• We do not use the data to train proprietary AI models
• We do not collect data from accounts that were not explicitly connected by the user
• We do not send unsolicited messages (broadcasts) — all DM replies are initiated by the user in response to received messages, within Meta's 24-hour window (or with Human Agent when applicable)

6.4. Access revocation and deletion

You can disconnect a social network at any time in Settings → Integrations of any Centriu module. Upon disconnecting, the OAuth token is revoked immediately and the historical data collected is marked for deletion within 90 days. For immediate deletion, send an email to contato@centriu.com or follow the instructions at Data Deletion.

6.5. Compliance with platform terms

Centriu operates in compliance with the Meta Platform Terms and Developer Policies, as well as analogous terms from Google, TikTok, and LinkedIn. Data use is restricted to the purposes approved by the platforms' App Reviews and to the permissions explicitly granted by the user in the OAuth flow.

7. International Data Transfer

Some of our service providers may be located outside Brazil. In such cases, we ensure that the international transfer of data is carried out in accordance with the LGPD, using:

• Approved standard contractual clauses;
• Recognized certifications and codes of conduct;
• Transfer to countries with an adequate level of data protection.

8. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes for which it was collected, including:

• During the term of the service agreement;
• For the period required by legal, tax, or regulatory obligations;
• For the regular exercise of rights in judicial, administrative, or arbitration proceedings.

After the retention period ends, the data will be securely deleted or anonymized.

9. Data Security

We adopt technical and organizational measures to protect your personal data, including:

• Encryption of data in transit and at rest;
• Role-based access controls (RBAC);
• Continuous monitoring and audit logs;
• Regular backups and recovery plans;
• Staff training on data protection;
• Periodic vulnerability assessments.

10. Your Rights as a Data Subject

Under the LGPD, you have the following rights:

• Confirmation and access: Confirm the existence of processing and access your data;
• Correction: Request the correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion: Request when the data is unnecessary or processed in non-compliance;
• Portability: Request the transfer of your data to another provider;
• Deletion: Request the deletion of data processed on the basis of consent;
• Information: Be informed about the sharing of data with third parties;
• Withdrawal of consent: Withdraw consent at any time;
• Objection: Object to processing when carried out in non-compliance with the law.

To exercise your rights, access our LGPD Channel or send an email to contato@centriu.com.

11. Mobile App

The Centriu Axis app is available for Android and iOS devices. When using the mobile app, the following permissions may be requested:

• Internet: Required for the platform to function;
• Microphone: For recording voice messages and participating in video calls (requests explicit permission);
• Camera: For participating in video calls (requests explicit permission);
• Push notifications: To receive alerts about messages, approvals, tickets, and updates (requests explicit permission).

All permissions are optional and can be revoked at any time in the device settings.

Third-Party Services in the App

• Supabase: Database, authentication, and file storage;
• Firebase Cloud Messaging (Google): Sending push notifications;
• Jitsi Meet: Video call infrastructure (self-hosted at meet.centriu.com).

12. Cookies

We use cookies and similar technologies on our websites and platform. For detailed information about how we use cookies, see our Cookie Policy.

13. Minors' Data

Centriu does not intentionally collect data from individuals under 18 years of age. Our services are intended for companies and professionals. If we become aware that we have collected data from a minor without the consent of their parents or guardians, we will take measures to delete that information.

14. Changes to this Policy

We may update this Privacy Policy periodically. When we make significant changes, we will notify you by email or through a prominent notice on our platform. We recommend reviewing this page regularly.

The "Last updated" date at the top of this page indicates when the Policy was last revised.

15. Contact

If you have questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, please contact us: