LGPD and your data
What data Relator processes, why, on what legal basis, where it is stored, for how long, and how to exercise your rights as a data subject.
In this article · 8 sections
Relator processes personal data under Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018). This article sums up, in plain language, what the Privacy Policy says (in the site footer, under Privacy). If the two ever differ, the policy prevails.
Who is responsible for what
- Controller: for the data you give us directly (sign-up and platform usage), Relator decides how and why it is processed.
- Processor: for the data you authorize us to fetch from connected platforms (Meta Ads, Google Ads, GA4, Search Console, RD Station, RD Station CRM and HubSpot), Relator only processes it according to your instructions, to build dashboards and reports.
- When you connect an account, you state that you are authorized to do so: you are the owner or have the owner's authorization (Terms of Service, section 4). For agencies, this applies to every client account connected.
What data we process
Sign-up
- What it includes
- Name, email, preferred language and session data
- Why
- Create the account and authenticate access
Platform usage
- What it includes
- Pages visited, actions, device, IP, time zone and timestamps
- Why
- Operate, protect and improve the product
Integrations
- What it includes
- Authorized access to platforms (encrypted), account identifiers and metrics
- Why
- Sync and show data in dashboards and reports
Billing
- What it includes
- Company name, CNPJ, billing address and the last 4 digits of the card
- Why
- Charge the subscription and meet tax obligations
| Type | What it includes | Why |
|---|---|---|
| Sign-up | Name, email, preferred language and session data | Create the account and authenticate access |
| Platform usage | Pages visited, actions, device, IP, time zone and timestamps | Operate, protect and improve the product |
| Integrations | Authorized access to platforms (encrypted), account identifiers and metrics | Sync and show data in dashboards and reports |
| Billing | Company name, CNPJ, billing address and the last 4 digits of the card | Charge the subscription and meet tax obligations |
Legal bases
- Performance of contract (art. 7, V): operate the platform and deliver the contracted service.
- Legal obligation (art. 7, II): meet tax, regulatory and judicial obligations.
- Legitimate interest (art. 7, IX): security, fraud prevention and aggregate product improvement.
- Consent (art. 7, I): when required, for example for marketing communications. It can be withdrawn at any time.
Where data is stored
Data is hosted in the United States, with providers that only access what they need to run the service. When data is processed outside Brazil, we require contractual and technical safeguards equivalent to the LGPD. The list of providers (sub-processors) is in section 5 of the Privacy Policy.
Data from Google APIs follows Google's user data policy, including the Limited Use requirements: it is not sold, not used for our own advertising and not used to train generalized AI models.
How long we keep data
Account data
- Period
- While the account is active
Identifiable personal data after the account is closed
- Period
- Deleted within 30 days
Billing and tax records
- Period
- 5 years, required by tax law
Operational logs
- Period
- Up to 90 days
Encrypted backups
- Period
- Up to 35 days after deletion
| Data | Period |
|---|---|
| Account data | While the account is active |
| Identifiable personal data after the account is closed | Deleted within 30 days |
| Billing and tax records | 5 years, required by tax law |
| Operational logs | Up to 90 days |
| Encrypted backups | Up to 35 days after deletion |
Your rights (LGPD art. 18)
At any time and free of charge, you can request:
- Confirmation that we process your data, and access to it.
- Correction of incomplete, wrong or outdated data.
- Anonymization, blocking or deletion of unnecessary data or data processed out of compliance.
- Data portability.
- Deletion of data processed based on consent, and withdrawal of that consent.
- Information about who we share your data with.
How to make a request
- 1Step 1
Write to privacidade@relator.digital
Send it from the email registered on the account. Say which right you want to exercise (access, correction, deletion, etc.) and include your full name, sign-up email and the related agency or company.
- 2Step 2
Confirm your identity if asked
We may ask for additional information, only what is needed to confirm that you are the data subject or are related to the account.
- 3Step 3
Follow up by email
Answers and updates arrive in the same email thread, within the legal deadlines. There is no form or tracking code: to ask for news, reply to the thread.
Legal documents
- Privacy Policy: in the site footer, under Privacy.
- Terms of Service: in the footer, under Terms.
- Cookie Policy: in the footer, under Cookies.
- Data Deletion: in the footer, under Data deletion.
Frequently asked questions
Does Relator sell or share my data for advertising?
No. Data is only shared with providers needed to run the service and with the platforms you connect yourself.
I am an agency. Who is responsible for my clients' data?
For data coming from connected accounts, Relator acts as a processor and handles it according to the instructions of whoever connected it. The agency needs each client's authorization to connect their accounts.
Do you sign a data processing agreement (DPA)?
Write to privacidade@relator.digital with your request and your company details.
How do I find out about policy changes?
The policy shows the last update date at the top. Relevant changes are announced by email 15 days in advance.
Does RelatorAI use my data to train models?
Data from Google APIs is not used to train generalized AI models. See how RelatorAI handles data in AI limits and privacy.
Read next
- Privacy and securityDelete data and accountFrom smallest to largest: disconnect a source, archive a client, cancel the subscription, or request full deletion of your data.
- Privacy and securityHow we protect your accessHow Relator stores access to your platforms, keeps each client's data separate, and what you can do to keep everything secure.
- Privacy and securityPermissions requested from platformsWhat Relator requests when connecting Meta, Google, HubSpot and RD Station, why each permission is needed, and how to review or revoke them.
- RelatorAIRelatorAI limits and privacyWhat RelatorAI doesn't do, why you should review its answers, and how the client's data is handled when you use the AI.