Privacy Policy

1. Who we are and how to reach us

HUB-CRM is a software-as-a-service (SaaS) for CRM, business management, landing pages (direct-response marketing) and social media publishing, operated by HUB-CRM ("we").

• Privacy and Data Protection Officer (DPO) channel: privacidade@byoffersperday.com
• Website: https://hub-crm.byoffersperday.com

We answer privacy requests within 15 days.

2. Our role

Controller: we are the controller of the data of people who subscribe to and use HUB-CRM (subscribers and their users), visitors of our website and the data of connected social media accounts, to the extent needed to provide the service.

Processor: data that each subscribing company enters or captures in HUB-CRM (contacts, leads, customers, conversations, orders, finances, documents, etc.) belongs to that company. In those cases the subscribing company is the controller and we process the data only as a processor, following its instructions and these terms. If you are a customer or lead of a company that uses HUB-CRM, please contact that company first — we will help it handle your request.

3. Data we process

3.1 Sign-up and account

• Name, e-mail, phone, password (stored only as a hash), company name and web address (subdomain), Brazilian tax ID (CPF/CNPJ) or equivalent, country, industry and language.
• Users invited by the company: name, e-mail, access role and, if enabled, the second authentication factor (MFA).
• Sign in with Google or Microsoft (optional): name, e-mail and account identifier, provided only for authentication.

3.2 Subscription and payment

• Subscriptions are billed by Kiwify. We receive purchase data (name, e-mail, tax ID, product, amount, subscription status). We do not receive or store card data.

3.3 Service usage, security and cookies

• Access and audit logs: IP address, date and time, browser and actions taken in the dashboard (required by Brazilian law and for security).
• Strictly necessary cookies: login session and chosen language. We do not use advertising cookies in the HUB-CRM dashboard.

3.4 Data entered by subscribers

• Contacts, leads, deals, activities, appointments, orders, contracts, finances, tax documents, WhatsApp messages and files the company chooses to keep in HUB-CRM, including data coming from its other systems (Integration Hub).

3.5 Landing page visitors

• Data the visitor fills in forms (e.g. name, e-mail, WhatsApp), visited page, source and campaign parameters (UTM, fbclid, gclid, ttclid) and view/click events, to measure the subscriber's results.
• If the subscribing company sets up Meta Pixel, Google Analytics or TikTok Pixel on its page, those tools may use their own cookies. The decision and the legal basis for it (including cookie notice and consent where required) are the subscribing company's responsibility.

3.6 Connected social media accounts

• Instagram and YouTube: detailed in sections 4 and 5.

4. Instagram (Instagram API — Meta)

When you click Connect Instagram, you are taken to Instagram's official login and choose to authorize HUB-CRM. We request only the permissions needed to publish:

• instagram_business_basic — ID, username, name, profile picture and type of the professional account, to show which account is connected.
• instagram_business_content_publish — publish Reels and photos that you upload and ask us to publish (immediately or scheduled).

We do not access direct messages, comments, followers, likes, insights or any other account content.

How we use and store it

• The access token is stored encrypted, isolated per company, and refreshed automatically while the account stays connected.
• The uploaded video or photo stays on our server only until it is published: it is made available to Instagram through a private signed link and deleted right after publishing (or when the post is cancelled). We keep the caption, date, status and post link for your history.
• Instagram data is used only to publish what you asked for and to show the history in your dashboard. We do not sell it, use it for advertising or to train artificial intelligence models, or share it with third parties other than Meta itself.

How to revoke and delete

• In HUB-CRM: Posts → Connected accounts → X (Disconnect). The account, its token and its scheduled posts are deleted immediately.
• On Instagram: Settings → Apps and websites (https://www.instagram.com/accounts/manage_access/) and remove HUB-CRM.
• You can also request deletion by e-mail at privacidade@byoffersperday.com (see section 11).

Use of Instagram is also governed by the Instagram Terms of Use and the Meta Privacy Policy. HUB-CRM is not affiliated with, sponsored or endorsed by Meta.

5. YouTube (YouTube API Services — Google)

HUB-CRM uses the YouTube API Services. By connecting a channel you agree to be bound by the YouTube Terms of Service, and data processed by Google is also subject to the Google Privacy Policy.

When you click Connect YouTube, you are taken to Google's official login and choose to authorize HUB-CRM. We request only these permissions:

• youtube.readonly — read your channel ID, name, @handle and image, to show which channel is connected.
• youtube.upload — upload to your channel the videos you select and ask us to publish, with the title, description, tags (caption hashtags), visibility (public, unlisted or private) and "made for kids" setting that you choose.

We do not access your existing videos, comments, subscribers, playlists, analytics, history or any Google account data beyond the above, and we never edit or delete videos.

How we use and store it

• Google access and refresh tokens are stored encrypted, isolated per company, and used only when uploading a video you scheduled or asked to publish.
• We store the channel data (ID, name, @handle and image) and, for each video uploaded through HUB-CRM, its ID, title, description, visibility, date and link — to show the history in your dashboard.
• The video file stays on our server only until the upload finishes and is deleted right after (or when the post is cancelled).
• YouTube data is used only to upload the videos you asked for and to show the history. We do not sell it, use it for advertising or to train artificial intelligence models, or share it with third parties other than Google itself.
• HUB-CRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How to revoke and delete

• In HUB-CRM: Posts → Connected accounts → X (Disconnect). We revoke the access with Google and immediately delete the channel, its tokens and its scheduled posts.
• On Google: open your Google Account security settings — third-party access and remove HUB-CRM.
• If you revoke access through Google, we delete the stored channel data within 7 days after we detect the revocation (at the latest on the next upload or check).
• You can also request deletion by e-mail at privacidade@byoffersperday.com.

Videos already published on YouTube become your YouTube content: use YouTube Studio to remove them. HUB-CRM is not affiliated with, sponsored or endorsed by Google or YouTube.

6. Purposes and legal bases (LGPD)

• Provide the contracted service (create and maintain the account, store CRM data, publish to connected networks, send system e-mails) — performance of contract (art. 7, V).
• Billing, invoices and accounting duties — legal obligation (art. 7, II) and performance of contract.
• Keep access logs for 6 months — legal obligation (Internet Civil Framework, art. 15).
• Security, fraud prevention and auditing — legitimate interest (art. 7, IX).
• Connect Instagram and YouTube — performance of contract, at your request, with your express authorization on Meta's or Google's screen, which you may revoke at any time.
• Improve the product and provide support — legitimate interest, using aggregated data whenever possible.
• Product news — consent, with unsubscribe in every message.
• Exercise of rights in legal, administrative or arbitration proceedings (art. 7, VI).

We do not make automated decisions that produce legal effects on you.

7. Who we share data with

We do not sell personal data. We share only what is necessary with vendors (sub-processors) that help us run the service, under confidentiality and security obligations:

• Hostinger — hosting of application and database servers.
• Kiwify — subscription sales and billing.
• Meta Platforms — Instagram (publishing) and, if the company enables it, WhatsApp Business.
• Google — YouTube (video uploads) and Sign in with Google; Microsoft — Sign in with Microsoft.
• Transactional e-mail and file storage providers (for exports).
• If the subscribing company enables them: billing (Asaas) and invoicing (Focus NFe) providers.

We may also share data with authorities when required by law or court order, and in case of corporate reorganization, keeping the guarantees of this Policy.

8. International transfers

Some vendors (such as Meta, Google and Microsoft) process data on servers outside Brazil. These transfers happen to perform the contract at your request and with vendors that adopt contractual clauses and protection standards compatible with the LGPD (art. 33).

9. How long we keep data

• Account and CRM data: while the subscription is active. After cancellation the company may export its data for 30 days; after that it is deleted, except what the law requires us to keep.
• Subscription tax and financial data: for the legal period (generally 5 years).
• Access logs: 6 months, or longer under court order.
• Video and photo files for publishing: deleted right after publishing or cancellation.
• Instagram and YouTube tokens: deleted when the account is disconnected.
• Backups: rotated in cycles of up to 30 days.

10. Security

• Encrypted connections (HTTPS/TLS).
• Per-company data isolation in the database (row-level security).
• Integration tokens and credentials encrypted with a per-company key.
• Passwords stored only as hashes; two-factor authentication (MFA) available.
• Role-based access control and audit trail.
• Daily backups.

No system is 100% invulnerable. If a security incident may cause relevant risk or damage, we will notify those affected and the Brazilian Data Protection Authority (ANPD), as required by the LGPD.

11. Your rights and data deletion

Under the LGPD (art. 18) you may request at any time: confirmation and access; correction; anonymization, blocking or deletion of unnecessary or unlawfully processed data; portability; deletion of data processed based on consent; information about sharing; information about not giving consent; withdrawal of consent; and review of automated decisions.

How to ask — including deletion of Instagram and YouTube data

• Send an e-mail to privacidade@byoffersperday.com with the subject "Privacy", stating your name, the account e-mail and what you want (e.g. "delete the data of my Instagram account @user" or "delete all my data").
• We may ask for a confirmation to make sure it is you.
• We answer within 15 days. Connected accounts can be deleted immediately from the dashboard (sections 4 and 5).
• Company administrators can also export or delete a contact's data directly in HUB-CRM.

If you are not satisfied with our answer, you may file a complaint with the Brazilian Data Protection Authority (ANPD): https://www.gov.br/anpd.

12. Children and teenagers

HUB-CRM is intended for businesses and people aged 18 or older. We do not knowingly collect data from children or teenagers as users of the service. Subscribing companies that process minors' data in the CRM must comply with art. 14 of the LGPD.

13. Changes to this Policy

We may update this Policy to reflect changes in the service or in the law. The update date is shown at the top of the page; relevant changes will be announced in the dashboard or by e-mail before they take effect.