Privacy Policy

Last updated: September 4, 2026

This Privacy Policy explains how BigWorks ("BigWorks", "we", "us" or "our") collects, uses, stores, shares and protects personal data in connection with BigWorks Social, the social-media scheduling and publishing platform we use for the Prompt do dia project and related accounts. The public project site is https://social.bigworks.com.br (the "Site"). Authorised team access to the scheduling tool may use a separate login host operated by BigWorks (the "Service"). This policy applies to authorised users, visitors and anyone who interacts with the Service or Site. For contractual terms, see our Terms of Service.

1. Data Controller

BigWorks is the data controller for personal data processed through this Service. We operate from Brazil.

Privacy questions and requests: lgpd@bigworks.com.br

2. What the Service Does

BigWorks Social lets authorised users connect social-media accounts and schedule, publish and manage content. This instance is operated by BigWorks for its own editorial and marketing properties, including automated carousel publishing for @prompt.do.dia on Instagram, Threads, Facebook, TikTok and other connected channels.

3. Data We Collect

3.1 Account and identity data

• Name, email address, password (stored as a salted hash), profile picture, organisation, role, language and timezone preferences.
• Workspace membership, invitations and permissions.

3.2 Connected platform data (including TikTok)

When you connect a social or messaging account, we receive and store via that platform's API:

• OAuth access and refresh tokens, encrypted at rest, the scopes you granted, platform username and identifier, and account metadata (profile picture, follower counts, page IDs, channel IDs).
• TikTok specifically: when you authorise TikTok, we store the OAuth tokens and scopes needed to publish content to your TikTok account, read basic account information required by the TikTok developer programme, and process publish requests you initiate in the Service. We do not sell TikTok account data.
• Content and engagement data needed to provide the Service: posts you create or schedule, publish status, post-level analytics the platform exposes, and media files you upload for publishing.
• For YouTube, the Service uses YouTube API Services. You can revoke Google access at Google Account Permissions.

3.3 Content you upload

Text, images, video, audio, captions, links, hashtags, schedules and other content you upload or generate within the Service, including media hosted at public URLs under social.bigworks.com.br/uploads/ when required for platform publishing.

3.4 Logs, usage and device data

• IP address, user-agent, browser type, operating system, referrer, language and approximate location derived from IP.
• Application telemetry: pages visited, features used, posts created, published or failed, API calls, error reports and performance metrics.
• Session and authentication data, including login timestamps and security events.

3.5 Communications

Messages you send to us by email or support channels related to the Service.

3.6 Cookies and similar technologies

We use cookies and local storage for authentication, security, preferences and analytics. Disabling strictly necessary cookies may break parts of the Service.

4. How We Use Data

• Provide the Service - authenticate users, manage accounts, store and publish content to connected platforms, return analytics and provide support.
• Secure the Service - detect abuse, fraud and unauthorised access; enforce our Terms.
• Operate and improve - monitor uptime, debug errors and improve reliability.
• Comply with law - respond to lawful requests and defend legal claims.

We do not use the content of your scheduled posts to send you advertising, and we do not sell personal data.

5. Legal Bases (where GDPR or similar law applies)

We process data based on performance of a contract (providing the Service), legitimate interests (security and improvement), consent where required (non-essential cookies or optional features), and legal obligation.

6. AI-Assisted Features

Optional AI features may transmit your prompts and selected inputs to third-party model providers acting as sub-processors. You remain responsible for reviewing AI output before publishing.

7. Who We Share Data With

We do not sell personal data. We share data only with:

• Infrastructure and sub-processors - cloud hosting, storage, databases, email, monitoring and similar providers that process data on our instructions under contractual safeguards.
• Connected third-party platforms - when you schedule or publish content, we transmit it to the platform you selected (including TikTok). Each platform's privacy policy governs its further processing.
• Other workspace members - according to roles and permissions you assign.
• Authorities - when legally required or necessary to prevent fraud, abuse or harm.
• Successors - in a merger, acquisition or asset sale, subject to notice where required by law.

8. International Transfers

Data may be processed in Brazil and in countries where our sub-processors operate. Where required, we use appropriate safeguards such as standard contractual clauses.

9. Data Retention and Deletion

• Account data - kept while your account is active. After closure, deleted or anonymised within 90 days unless longer retention is required by law.
• Scheduled content - kept until published or deleted by you.
• Published records and analytics - kept while your account is active.
• OAuth tokens - kept while the connection is active; revoked tokens are deleted promptly. Disconnect any platform from account settings or revoke access on the platform.
• Logs - typically up to 12 months.
• Backups - roll off on their normal schedule (typically 30-90 days) after deletion from live systems.

10. Security

We use administrative, technical and organisational measures including TLS in transit, encryption of OAuth tokens at rest, password hashing, access controls and incident-response procedures. No system is fully secure.

11. Your Rights and Revocation

Depending on your location, you may have the right to access, correct, delete or restrict processing of your personal data, object to certain processing, withdraw consent, and lodge a complaint with a supervisory authority.

Revoking platform authorisation: disconnect a platform in the Service or revoke the BigWorks application on the platform (for TikTok: TikTok app settings / authorised apps). Revocation stops future publishing through that connection.

Requests: lgpd@bigworks.com.br. We respond within applicable legal timeframes and may verify your identity.

12. LGPD (Brazil)

Where Brazil's Lei Geral de Proteção de Dados (LGPD) applies, you have the rights set out in Section 11, including confirmation of processing, access, correction, anonymisation, portability, deletion, information about sharing, and revocation of consent. Contact our privacy channel above or the Brazilian national data protection authority (ANPD) if you believe your rights were violated.

13. Children

The Service is not directed to children under 18. We do not knowingly collect personal data from children. Contact us if you believe a child provided data and we will delete it.

14. Third-Party Sites and Services

Connected platforms handle your data under their own policies. Review the privacy policy of each platform you connect, including TikTok Privacy Policy for TikTok integrations.

15. Changes to this Policy

We may update this Policy from time to time. Material changes will be posted here with an updated date. Continued use after the effective date constitutes acknowledgment.

16. Contact

Privacy questions and requests: lgpd@bigworks.com.br

BigWorks · Brasil · site.bigworks.com.br