Privacy policy

1. What data we process

• Account data: email, name and, if you sign in with Google, the basic data from that profile.
• Brand data: logo, colors, photo, business name, phone, email, license or registration number and social accounts you choose to add. There can be several brands per account.
• Kit content: links, listing text, photos and details of what you promote, and the files we generate. If you dictate the details with the microphone, the audio is converted to text and we do not keep it.
• Connected networks: when you connect a network, the name, ID and picture of the account or Page, the Pages you choose and the permission to post. Access keys issued by the networks are stored by our publishing provider; we never see or store your passwords. We also keep what was posted, when, its status and the results reported by the networks (for example, reach and views).
• Payment data: the payment provider tells us the result, amount, currency and an identifier. We do not receive your full card number.
• Lead data: the name, WhatsApp or email and message a visitor leaves on a kit’s web page. We process them on behalf of the person posting, only to forward them by email.
• Assistant chats and correction requests: the messages you send the assistant, its answers and error reports. We use them to answer you, resolve the request, review errors and abuse and improve answers.
• Referrals: your invite code and which accounts signed up or paid with it (without showing you their data).
• Technical data: IP address, approximate country, time zone, browser, language, usage and error logs. We use them for security, to show you your currency, language and your country’s posting times, and to improve the service.

2. What we use it for

• Creating your account, generating and delivering your kits, and saving your brand for next time.
• Posting your campaign on the networks you connect, on the days you chose, and showing you its status and results.
• Charging, issuing receipts, applying discounts and referrals and preventing fraud.
• Sending you emails about your account, kits and campaigns: sign-in, kit ready, preview awaiting payment, deletion notices, disconnected network, campaign paused or about to end, and service notices. You can unsubscribe from non-essential messages using the link in each email.
• Measuring site usage and improving the product.
• Complying with legal obligations and defending our rights.

3. Legal bases

We process your data because it is necessary to provide the service you purchased (account, kit and campaign), based on your consent (for example, when you connect a network or accept measurement in the cookie notice, which you can withdraw at any time), on our legitimate interest in security and improving the service, and to comply with legal obligations. We do not make decisions with legal effects on you based solely on automated processing.

4. Who we share it with

We do not sell your data or use it for third-party advertising. We share it only with providers that help us provide the service, with the content needed for each task:

• Infrastructure and database: Vercel, Supabase, Upstash, Amazon Web Services, Modal and DigitalOcean.
• File storage: Cloudflare R2 and Bunny.
• Artificial intelligence (copy, photos, voices, music, listing reading and assistant): Google, OpenAI, OpenRouter and the models it serves (for example, from ByteDance), only with the content needed to generate each piece.
• Social publishing: Outstand, and the networks you connect (Meta, TikTok, Google/YouTube, LinkedIn), which receive what is posted on your behalf and process that data under their own policies.
• Link reading and neighborhood data: public web page access services (Bright Data), maps (Google Maps and MapTiler) and, in the United States, public property data (RentCast).
• Payments: Stripe and Link (United States, Canada and Mexico), which act as reseller and process your payment and tax data as independent controllers.
• Email: Resend.
• Measurement and security: PostHog and Cloudflare Turnstile, to tell people from bots.

5. What is published

A paid kit’s web page is public to anyone with the link and shows what you chose to include (photos, property and contact details) for 90 days. You can ask us to take it down at any time.

What the campaign posts on your networks is public according to each network’s settings. Those posts stay on your networks even if you cancel the campaign or delete the kit or your account: to remove them, delete them from each network.

A kit’s share link lets anyone who has it view and download the kit, until the kit is deleted.

6. International transfers

Resaltalo is operated from the United States and our providers have servers in the United States and other countries. When you use the service, your data is transferred and stored outside your country, with appropriate security measures and in line with the rules that apply to those transfers.

7. How long we keep it

We keep your account data while it is active. Files from paid kits are kept so you can download them: videos for 6 months from payment and the rest for 24 months. Unpaid previews are deleted after 30 days and items in the trash 30 days after being moved there. The log of what each campaign posted is kept while the kit exists. Billing data is kept for as long as the law requires.

If you disconnect a network, we stop posting to it and ask our provider to delete its access. To close your account, write to info@resaltalo.com: we delete or anonymize your data except what we must keep by law.

8. Your rights

You can request access, correction, update, deletion or portability of your data, object to certain uses or withdraw your consent by writing to info@resaltalo.com. We respond within the time limits of the applicable law. You can also remove Resaltalo’s access from each social network’s settings.

Depending on your country, you can also file a complaint with the data protection authority: in Argentina, the Agency for Access to Public Information; in Brazil, the ANPD (LGPD); in Mexico, the authority designated under the LFPDPPP; in Colombia, the Superintendence of Industry and Commerce; in Chile, the authority set by the data protection law; in Peru, the National Authority for Personal Data Protection; in Uruguay, the URCDP; in Ecuador, the Superintendence of Personal Data Protection; in the Dominican Republic, the courts through a habeas data action; in Paraguay, the authority set by the data protection law; in New Zealand, the Privacy Commissioner. In the United States and Canada, state laws and PIPEDA apply, respectively.

If you live in California, we do not sell or share your data for cross-context behavioral advertising, and you can exercise your CCPA rights at the same email.

If you receive inquiries from interested people through the web page, you are responsible for that data towards them. If an interested person asks us to exercise their rights, we refer them to the person who posted and help where it concerns us.

9. Cookies

We use our own cookies needed for the session, country, language and currency; an invite cookie that remembers for 30 days the referral link you arrived with; and a measurement tool (PostHog) to understand how the site is used and improve it. Where the law requires it, such as in Brazil, measurement only turns on if you accept it in the cookie notice, and you can decline it.

10. Security and minors

We protect data with encryption in transit, restricted access and private files with temporary links. No system is infallible: if we detect an incident that affects you, we will let you know.

Resaltalo is not aimed at minors and we do not knowingly collect their data.

11. Changes

If we change this policy, we will publish the new version with its date and, if the change is significant, let you know by email.

12. What changes depending on your country

These rules add to the rest of this policy for people who live in each country. For any request, write to info@resaltalo.com; if needed, we will ask you to confirm that you own the account.

• Brazil (LGPD, Law 13,709/2018): futuraprop LLC is the controller of your data. Our data protection officer (encarregado) can be reached at info@resaltalo.com with the subject “Encarregado LGPD”. We process your data to perform the contract, with your consent, based on legitimate interest or to comply with legal obligations (article 7). You can request confirmation, access, correction, anonymization, blocking or deletion, portability, information about who we share it with, and withdrawal of consent (article 18). International transfers rely on the safeguards of article 33, such as the ANPD standard contractual clauses. If a security incident may cause you a relevant risk or harm, we will notify you and the ANPD. You can file complaints with the ANPD.
• Argentina (Law 25,326): the data subject has the right to access their personal data free of charge at intervals of no less than six months, unless a legitimate interest is shown (article 14, paragraph 3). The Agency for Access to Public Information, the supervisory authority of Law 25,326, handles complaints about breaches of the personal data protection rules.
• Mexico (Federal Law on the Protection of Personal Data Held by Private Parties): this policy is our full privacy notice. You can exercise your rights of access, rectification, cancellation and objection (ARCO) and withdraw your consent by email; we reply within the legal deadlines.
• Colombia (Law 1581 of 2012 and Decree 1377 of 2013): this policy is our data processing policy. By creating your account you give us your prior, express and informed authorization to process your data for the purposes of this policy. We answer inquiries within 10 business days and claims within 15 business days. You can go to the Superintendency of Industry and Commerce once you have filed your claim with us.
• Chile (Law 19,628 and Law 21,719): you can exercise your rights of access, rectification, erasure, objection, portability and blocking. Once it starts operating, you will be able to file complaints with the Personal Data Protection Agency.
• Peru (Law 29,733 and its regulations): by using the service you consent to the cross-border transfer of your data to the United States and to our providers' countries, for the purposes of this policy. You can exercise your ARCO rights and file complaints with the National Authority for the Protection of Personal Data.
• Uruguay (Law 18,331): you can exercise your rights of access, rectification, updating, inclusion and erasure, and file complaints with the Personal Data Regulatory and Control Unit (URCDP).
• Paraguay: you can exercise the rights given by Paraguay's personal data protection law, including before the authority it designates.
• Ecuador (Organic Law on Personal Data Protection): you can exercise your rights of access, rectification, deletion, objection, portability and suspension of processing, and file complaints with the Superintendency of Personal Data Protection.
• Dominican Republic (Law 172-13 on Personal Data Protection): you can request access, rectification, cancellation and objection, and go to the courts through a habeas data action.
• United States: if you live in Texas (Texas Data Privacy and Security Act), California (CCPA) or another state with a privacy law, you can request access, correction, deletion and a portable copy of your data, and opt out of its sale, targeted advertising and profiling. We do not sell your data or use it for targeted advertising. If we deny your request, you can appeal by replying to our email: we answer within 60 days and, if you still disagree, you can contact your state's attorney general (in Texas, the Office of the Attorney General).
• Canada (PIPEDA and provincial laws, such as Quebec's Law 25): the person in charge of protecting personal information can be reached at info@resaltalo.com. Your data may be stored outside Canada, with the protections of this policy, and be subject to the laws of those countries. You can file complaints with the Office of the Privacy Commissioner of Canada or your province's authority.
• New Zealand (Privacy Act 2020): you can request access to and correction of your data. When we send it outside New Zealand, we send it to providers subject to protections comparable to that Act. If an incident may cause you serious harm, we will notify you and the Privacy Commissioner, with whom you can also file complaints.