Privacy policy.

1. Who controls the data

MiauLabs is an initiative of Romulo Gatto Consultoria Ltda., CNPJ 48.547.421/0001-63, which acts as the controller for the processing described in this policy.

2. Scope

This policy applies to labs.grupomiau.co and to the MiauLabs Publisher application used to connect authorized LinkedIn members and Miau Labs Page administrators.

LinkedIn is a separate controller for its platform. Its own privacy policy and terms also apply when you use LinkedIn or authorize an application there.

3. Website data

The public website does not currently use analytics, advertising trackers, contact forms, or tracking cookies. Our infrastructure provider may process standard technical request data—such as IP address, timestamp, requested URL, browser information, and security events—to deliver and protect the service.

If you choose the external contact link, the information you send is processed by the destination service under its own terms and privacy policy.

4. LinkedIn data we process

When an authorized person connects MiauLabs Publisher to LinkedIn, we may process:

• the LinkedIn member or organization identifier needed to identify the publishing actor;
• basic profile fields that LinkedIn may return with its OpenID profile response, such as name, given name, family name, profile-picture URL, and locale;
• authorization scopes, access tokens, refresh tokens when LinkedIn provides them, and token expiration data;
• administrator or authorization status needed to confirm that a person may act for a LinkedIn Page;
• content submitted or approved for publication, including post text, comments, links, and related metadata;
• LinkedIn response identifiers and publication status; and
• limited operational records such as timestamps, attempts, errors, idempotency records, and audit events.

The application reads the OpenID subject identifier to bind the authorization to the expected member. Other basic profile fields returned in that response are handled transiently and are not stored in the MiauLabs database. We do not receive or store your LinkedIn password. The requested scopes are limited to identity verification, authorized publishing, comments, and Page-administrator verification for this workflow.

5. How we use the data

We process this data to:

• authenticate and maintain authorized LinkedIn connections;
• verify the intended member or Page publishing identity;
• publish approved posts and first comments;
• prevent duplicate publication, retry recoverable failures, and reconcile uncertain outcomes;
• keep security and accountability records, investigate incidents, and provide support; and
• comply with applicable law and enforce our rights.

6. Legal bases

Depending on the context, processing is based on consent, steps requested by you or performance of a contract, compliance with legal obligations, and our legitimate interests in operating a secure, auditable publishing service. Where we rely on consent, you may withdraw it at any time without affecting prior lawful processing.

7. Sharing and international processing

We share data only as needed with:

• LinkedIn, to authenticate the connection and perform the publication you authorized;
• Cloudflare, which provides hosting, storage, networking, and security infrastructure;
• authorized service providers or contractors bound by confidentiality and data-protection duties; and
• public authorities or other parties when required by law or necessary to protect rights and security.

These providers may process data outside Brazil. Where applicable, we use contractual, organizational, and technical safeguards for international transfers. We do not sell personal data or share it for cross-context behavioral advertising.

8. Retention and deletion

• OAuth authorization state expires after 10 minutes and is deleted when used.
• Encrypted access and refresh tokens are kept while the connection is active. Disconnecting clears the stored token material immediately.
• Connection identifiers and metadata are deleted through our monthly cleanup process and, absent a documented legal exception, no later than 60 days after disconnection.
• Publication and operational records are deleted through that process after 24 months of inactivity and, absent a documented legal exception or unresolved external effect, no later than 25 months after their last activity.

You may disconnect the application through LinkedIn and request deletion through our contact channel. A verified deletion request can shorten these periods. We will delete or anonymize eligible data under our documented privacy-request procedure, subject to legal obligations and records that must be retained to establish, exercise, or defend legal claims.

9. Security

We use safeguards proportionate to the data and risk. OAuth tokens are encrypted before storage. We also use encrypted transport, restricted administrative access, short-lived authorization state, logging controls, and publication safeguards designed to prevent unauthorized or duplicate actions. No system is completely secure, but suspected incidents are investigated and handled under applicable law.

10. Your rights

Subject to applicable law, including Brazil’s Lei Geral de Proteção de Dados (LGPD), you may request confirmation of processing, access, correction, anonymization, blocking, deletion, portability where available, information about sharing, review of certain automated decisions, and withdrawal of consent. You may also object to processing in the circumstances provided by law and lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

We may need to verify your identity and authority before fulfilling a request.

11. Children

The website and publishing application are intended for business users and are not directed to children. We do not knowingly collect personal data from children through these services.

12. Changes to this policy

We may update this policy when the service, providers, or legal requirements change. Material changes will be identified here by a new effective date.