Privacy Policy
Last updated: July 3, 2026
1. Who we are
ORQENZA is an AI-powered marketing automation SaaS platform. This Privacy Policy explains how we collect, use, store, and protect your personal data.
Data Protection Officer (DPO): privacidade@orqenza.com
2. Data we collect
| Data | Purpose | Legal basis (LGPD Art. 7) |
|---|---|---|
| Name and email | Account creation and management | Contract performance (§V) |
| Payment data | Billing via Stripe | Contract performance (§V) |
| Anonymized IP | Security and fraud prevention | Legitimate interest (§IX) |
| Usage data (analytics) | Improving the platform | Consent (§I) |
| Marketing cookies | Ad personalization | Consent (§I) |
| Access logs | Audit and security | Legal obligation (§II) |
We never collect sensitive data such as racial origin, religious beliefs, health, or biometrics.
2.1 Data from connected social platforms (Meta, LinkedIn, X, TikTok)
When you connect a Facebook Page, an Instagram Business account, or another social channel, you explicitly authorize Orqenza — through the platform's own OAuth consent screen — to access data on your behalf via its official APIs (for Facebook and Instagram, the Meta Graph API):
| Platform data | Purpose |
|---|---|
| Page / account identifiers and names | Identify and display your connected channel |
| Access tokens | Act on your behalf to publish and read engagement (stored encrypted) |
| Your posts, comments and their public metrics | Show them in your dashboard and inbox, and let you reply |
| Direct messages (only when messaging features are enabled for your account) | Show and answer them in the unified inbox, within the platform's messaging window |
TikTok. Access is granted through TikTok's own OAuth consent screen and is limited to the permissions you approve there:
| TikTok data | Permission | Purpose |
|---|---|---|
Account identifier (open_id) and username |
user.info.basic |
Identify and display your connected channel |
| Follower, like and video counts | user.info.stats |
Show your account totals on the channel card |
| Your public videos, and their like, comment, share and view counts | video.list |
Show per-publication metrics in Analytics |
| Publishing videos on your behalf | video.publish |
Publish the content you schedule in Orqenza |
We do not read or reply to TikTok comments or direct messages — TikTok's public API offers no permission for that. We do not use video.upload: nothing is placed in your TikTok drafts.
We process this data only to provide the features you actively use. We never use it to build advertising profiles, and we never sell it or share it with third parties. Access tokens are stored encrypted at rest (AES-256).
This data is retained only while the channel remains connected. When you disconnect a channel, or delete your account, the access tokens are revoked and the associated synced data is deleted — see How to delete your data. Content you already published to your social networks stays on those networks and must be removed there directly.
3. Cookies used
| Name | Type | Duration | Purpose |
|---|---|---|---|
session |
Essential | Session | Authentication and security |
XSRF-TOKEN |
Essential | Session | CSRF protection |
orqenza_cookie_consent |
Essential | 12 months | Consent record |
_ga, _gid |
Analytics | 13 months | Google Analytics 4 |
_fbp |
Marketing | 90 days | Meta Pixel / Facebook Ads |
Analytics and marketing cookies are loaded only after your explicit consent.
4. Third-party sharing
We share data only with:
- Stripe Inc. — payment processing (PCI DSS level 1)
- Google LLC — Google Analytics 4 (with anonymized IP, consent only)
- Meta Platforms Inc. — Meta Pixel for marketing (consent only) and, when you connect a channel, the source of your social data through the Meta Graph API under your explicit OAuth authorization
- Infrastructure providers — cloud servers with confidentiality agreements
We do not sell, rent, or trade your personal data with third parties for commercial purposes.
5. Retention periods
| Data | Period |
|---|---|
| Connected social platform data (tokens, synced posts/comments/messages) | While the channel is connected; deleted on disconnect or account deletion |
| Account data | While account is active + 5 years |
| Consent records | 5 years (Art. 19, LGPD) |
| Access logs | 6 months (Brazilian Internet Law) |
| Tax/fiscal data | 5 years (tax legislation) |
| Consent cookies | 12 months (renewed each visit) |
6. Your rights as a data subject
Under Art. 18 of Brazil's LGPD, you have the right to:
- Confirmation and access — know what data we hold about you
- Correction — update incomplete or outdated data
- Anonymization, blocking, or deletion — of unnecessary data
- Portability — receive your data in structured format
- Revocation — withdraw consent at any time, without prejudice
- Objection — to processing based on legitimate interest
To exercise these rights: privacidade@orqenza.com
Response time: up to 15 business days (Art. 18, §5).
7. How to revoke cookie consent
You can review or revoke your cookie preferences at any time using the button below or visiting the LGPD page.
Revocation does not affect processing performed before it.
8. Security
We apply technical and organizational measures to protect your data:
- AES-256 encryption for sensitive data at rest
- HMAC-SHA256 for secure lookups without decryption
- HTTPS/TLS mandatory for all communications
- RBAC with role-based access control
- Audit logging for all critical operations
More details on our Security Page.
9. International transfers
Some of our providers (Stripe, Google, Meta) process data outside Brazil. All transfers are made with standard contractual clauses ensuring equivalent protection.
10. Contact
ORQENZA
Email: privacidade@orqenza.com
This policy may be updated periodically. We will notify you of significant changes by email.