Mov Labs Privacy Policy.

1. Who we are

Movie Maker LTDA (Brazilian company registration CNPJ 14.576.514/0001-02) builds and operates Mov Labs and is the controller of the data processed in it, with the exception explained right below.

• Contact: fale (at) moviemaker.com.br
• Data protection officer: João do Amaral, at the same address

When an agency uses Mov Labs: if an agency or team uses Mov Labs to manage its own clients' accounts, that agency is the controller of its clients' data, and Movie Maker is the processor (LGPD, art. 5, VI and VII). This means Movie Maker processes that data only to provide the service, following the agency's instructions and this policy. Requests about that data can be sent to the agency or to Movie Maker, which will notify the agency.

2. What Mov Labs is

Mov Labs is Movie Maker's platform for scheduling and publishing content on social media: Instagram, Facebook, Threads, TikTok and YouTube. It is built for agencies, social media teams and creators who manage professional accounts.

• Mov Labs is used by the Movie Maker team and by the agencies, teams and creators that Movie Maker grants access to. Each person signs in with their own login and two-step verification.
• It only accesses the accounts that the owner authorizes on each network's official authorization screen. The owner can revoke this access at any time.
• Nothing is published without approval from a person on the team responsible for the account.
• On Instagram, the client can turn on messaging automations: anyone who comments a keyword on a post, replies to a story or sends the keyword by direct message receives, on behalf of the account, the reply and the link they asked for (section 4).

3. What data we process

From the connected account, received from the social network with the owner's authorization:

• ID, name, username, profile picture and account type (business or creator);
• the Pages and professional accounts the person chooses to connect;
• the access keys (tokens) the network gives us, stored encrypted;
• data about the posts and comments made through Mov Labs: ID, link, date and status;
• post and account metrics, such as reach, views, likes and comments, always as aggregate numbers, when the client asks for reports.

Content: photos, videos, captions, comments and schedules that we prepare with the client for publishing.

Mov Labs users: name, e-mail, WhatsApp number and dashboard access logs.

People who write to the account, only when the client turns on an Instagram messaging automation:

• the ID Instagram gives the person for the app (not their phone number or e-mail) and their username;
• the ID of the comment or message that triggered the automation. The text is checked on the spot, only to find the keyword, and is not stored;
• whether the person follows the account, checked on the spot when the automation asks people to follow before sending the link, and not stored;
• the person's step (received the message, tapped the button, received the link) and whether they clicked the link.

What we do not access:

• social network passwords;
• direct message history: Mov Labs only receives new messages sent to the account, to check the keyword of an active automation, and does not store their text;
• follower lists;
• personal data of people who follow, like or comment, beyond what is described above for automations.

4. How we use it

• To publish and schedule approved content on the client's accounts.
• To post comments on the account's own posts, such as the first comment, when scheduled and approved by the team.
• When the client turns on an Instagram automation, to reply to people who comment a keyword on the account's post, reply to a story or send the keyword by direct message: a reply to the comment and, by direct message, the message the client wrote, with the requested link. The conversation always starts with the person: Mov Labs never messages anyone who has not contacted the account, and it follows Meta's messaging windows and limits. The same person receives it once a day per automation.
• To show the team and the client what was published and whether it succeeded, and the automations' numbers (how many people received the message, tapped the button, received the link and clicked).
• To prepare the client's own performance reports.
• To keep the tool secure and prevent abuse.
• To comply with legal obligations.

The legal bases are (LGPD, Brazil's General Data Protection Law, art. 7):

• the agreement with the Mov Labs user (a Movie Maker client or an agency), together with the authorization the account owner gives on the social network;
• legitimate interest, for the security of the tool and, in automations, to reply to people who asked for the content;
• compliance with the law, for access logs.

5. What we never do

• Sell, rent or transfer the data.
• Use the data for advertising, ad profiling or data brokering.
• Use data received from social networks to train artificial intelligence.
• Like or follow automatically.
• Message anyone who has not commented or written to the account first, or send advertising the person did not ask for.
• Comment on other accounts' posts.
• Publish without approval from a person on the team.

6. Who we share data with

Only with those we need to provide the service, always under contract and only for that purpose:

• the team responsible for the account: Movie Maker's, or that of the agency that connected the account;
• the social networks themselves, to publish, fetch metrics and send the automations' messages: Meta (Instagram, Facebook and Threads), TikTok and Google (YouTube);
• companies that store and process data for us:
  • Vercel, which hosts the dashboard;
  • Supabase, the database, in São Paulo, Brazil;
  • Movie Maker's own server, in Brazil, where files are stored;
• Anthropic, whose AI assistant (Claude) helps the team write captions from the client's material. Anthropic does not receive the access keys and does not use this data to train models;
• authorities, when required by law.

7. Data outside Brazil

Some of these services, such as Vercel and Anthropic, are located in the United States. These transfers follow the LGPD (art. 33), under contracts that require protection equivalent to Brazilian law. The database is located in São Paulo.

8. How long we keep data

• Access keys: while the account is connected. They are deleted immediately when the account is disconnected or when the owner removes Mov Labs on the social network.
• Account data, posts and metrics: for the duration of the agreement with the Mov Labs user, for the account's reports. After disconnection or the end of the contract, we delete them within 30 days.
• Deletion requests: when the owner asks, we delete everything within 7 days and send a confirmation.
• Files sent for publishing: the copy used for publishing is deleted within 30 days after publication.
• Messaging automation data (ID, username, steps and clicks of people who wrote to the account): 90 days after the person's last contact with the automation. The notifications Meta sends (only the event ID) are kept for 7 days, so we never reply twice.
• Dashboard access logs: 6 months, as required by Brazil's Internet Civil Framework (Law 12,965/2014, art. 15).

9. How we protect data

• Access keys are encrypted and stored only on the server, never in the browser.
• Dashboard access only for authorized people, with individual logins and mandatory two-step verification.
• Movie Maker grants and controls access, and can suspend access immediately.
• Every post is logged with the name of the person who approved it, the date and the time.
• Connections are always protected (HTTPS).

10. Your rights

Under the LGPD (art. 18), you can request:

• confirmation that we process your data, and access to it;
• correction and deletion;
• portability;
• information about who we share it with;
• withdrawal of your authorization.

Send your request to fale (at) moviemaker.com.br. People who received an automated message can also ask there for their data to be deleted, giving their Instagram username. We reply within 15 days. If you are not satisfied, you can file a complaint with Brazil's National Data Protection Authority (ANPD).

11. How to remove access and delete your data

Step-by-step instructions are on the Data deletion page (moviemaker.com.br/movlabs/data-deletion). You can also remove access directly on the social network at any time.

12. Social network rules

When you connect an account, each network's rules also apply:

• Meta: Meta Privacy Policy, Instagram Terms of Use and Facebook Terms of Service;
• TikTok: TikTok Privacy Policy;
• YouTube: YouTube Terms of Service and Google Privacy Policy. Access granted through Google can be removed at security.google.com/settings/security/permissions.

13. Cookies

The dashboard uses only one technical session cookie, so users can sign in. We do not use advertising cookies.

14. Minors

Mov Labs is for businesses, agencies and creators. It is not intended for anyone under 18.

15. Changes to this policy

We notify Mov Labs users of important changes. The date at the top shows the version in effect.