Privacy Policy
This Privacy Policy describes how Connekit, operated by Sevn Solutions LLC ("Connekit", "we"), collects, uses, shares and protects personal data, in compliance with Brazil's General Data Protection Law (LGPD — Law No. 13,709/2018), the European General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), where applicable.
1. Our roles in processing data
With respect to Creator data (users who create a Connekit Account), we act as Controller: we decide the purposes and means of processing.
With respect to Visitor data from interactions with a published Media Kit (for example, viewing the public page or filling out a contact form), we act as Processor on behalf of the Creator, who decides what to publish and which contact information to make public.
2. What data we collect
2.1 Creator data
- Registration data: name, email, password (stored hashed), public username.
- Profile data: display name, bio, professional categories, profile photo, cover image, portfolio, presentation video, partner brands, business email and WhatsApp number you provide.
- Payment data: processed directly by our payment provider (Stripe); Connekit stores only subscription identifiers and billing status, never the full card number.
- Technical data: IP address, session identifiers, essential cookies (see our Cookie Notice), access and security logs.
2.2 Media Kit Visitor data
- Technical browsing data collected when accessing a Media Kit's public page (IP address, device type, pages visited), collected for security, abuse prevention and the Creator's aggregated audience metrics.
- Data voluntarily provided when contacting a Creator through the channels displayed on the Media Kit (for example, the Creator's own email or WhatsApp) — that contact happens directly with the Creator; Connekit only displays the information the Creator chose to publish.
2.3 Data obtained via the Instagram Graph API
When you connect a professional Instagram account, through your explicit OAuth authorization, we import:
Our use of this data is limited as set out in our Limited Use Policy, which details exactly what these data are and are not used for.
- Public profile information (username, photo, bio, follower count);
- Content metrics (reach, engagement, views, likes, comments, saves, shares) for your own posts;
- Aggregated audience demographic data, when made available by the API for your account;
- The OAuth access token, stored encrypted (AES-256), used exclusively to sync the data above on your behalf.
3. Purposes and legal bases for processing
The table below summarizes, for the main data categories, the processing purpose and the corresponding legal basis under the LGPD (with the equivalent GDPR basis in parentheses, where applicable).
| Data | Purpose | Legal basis (LGPD) |
|---|---|---|
| Registration (name, email, password) | Create and authenticate your Account | Contract performance (art. 7, V) |
| Media Kit profile data | Generate and publish your Media Kit | Contract performance (art. 7, V) |
| Instagram data via API | Sync real metrics on your Media Kit | Data subject consent (art. 7, I) and contract performance |
| Payment/subscription data | Process recurring billing and issue receipts | Contract performance and legal (tax) obligation |
| Technical logs and IP address | Security, fraud and abuse prevention | Legitimate interest (art. 7, IX) |
| Essential cookies | Maintain session, language and preferences | Contract performance / legitimate interest |
| Visitor browsing data | Aggregated Media Kit audience metrics and security | Legitimate interest (art. 7, IX) |
| Support communications | Respond to requests and provide support | Contract performance / legitimate interest |
| Email for marketing communications | Send news, when you opt in to receive them | Data subject consent (art. 7, I) |
4. Data sharing and subprocessors
We do not sell your personal data. We share data only with service providers that help us operate Connekit (for example, hosting, file storage and payment processing), under contractual confidentiality obligations and processing limited to our instructions.
The complete, up-to-date list of subprocessors, including what each one processes, is available on our Subprocessors page.
5. International data transfers
Connekit is operated from the United States, and our servers and infrastructure providers are located in the US. This means personal data of data subjects in Brazil and the European Economic Area is transferred internationally for processing.
Where applicable, these transfers are supported by Standard Contractual Clauses (SCCs) entered into with our subprocessors, or another transfer mechanism recognized by the LGPD and the GDPR, to ensure an adequate level of protection for the transferred data.
6. Data retention and deletion
We keep your data while your Account is active and for the additional time needed to comply with legal, tax or regulatory obligations, or to resolve disputes.
You can disconnect your Instagram account at any time from the Media Kit editor, which immediately stops any further syncing. To request full deletion of your Account and associated data, see our Data Deletion page or email support@connekit.me. Deletion requests are processed within 30 days.
7. Your rights as a data subject
Under the LGPD and, where applicable, the GDPR, you have the right to:
- Confirmation of, and access to, the personal data we process about you;
- Correction of incomplete, inaccurate or outdated data;
- Deletion of data processed with your consent, or anonymization/blocking of unnecessary data;
- Portability of your data to another service provider, upon express request;
- Objection to processing carried out on the basis of legitimate interest;
- Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
- Information about who we share your data with.
How to exercise your rights
Many of these rights can be exercised directly in the Media Kit editor (profile correction, Instagram disconnection, content deletion). For other requests, email support@connekit.me describing your request. We will respond within the timeframes required by applicable law.
8. Data Protection Officer (DPO)
Our Data Protection Officer can be reached at hello@connekit.me for questions about this Policy, data subject requests, or issues related to Connekit's processing of personal data.
9. Information security and incident notification
We adopt reasonable technical and organizational measures to protect your data, including encryption of sensitive tokens at rest, least-privilege access control, and isolation between user accounts.
In the event of a security incident that could pose a relevant risk or harm to data subjects, we will notify Brazil's National Data Protection Authority (ANPD) and affected data subjects within the timeframes and manner required by the LGPD and other applicable laws, describing the nature of the affected data, the technical measures taken, and precautionary recommendations.
10. Notice specific to California residents (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, grants the additional rights described below.
Categories of personal information collected
In the past 12 months, we may have collected the following categories of personal information, as defined by the CCPA: identifiers (name, email, IP address); commercial information (subscription history); internet activity (interactions with the Platform); professional information (content category, partner brands); and inferences (aggregated audience metrics derived from Instagram data).
"Do Not Sell or Share My Personal Information"
Connekit does not sell or share personal information for third-party behavioral advertising purposes, as defined by the CCPA. Should this change, you may exercise your opt-out right at any time at hello@connekit.me.
You also have the right to know, delete and correct your personal information, and not to suffer discriminatory treatment for exercising these rights.
12. Minors
Connekit is not intended for individuals under 18 and does not knowingly collect data from minors. If we become aware that an Account belongs to a minor, it will be closed and the associated data deleted.
13. Changes to this Policy
We may update this Policy periodically. Material changes will be communicated by email or notice on the Platform with reasonable advance notice.
14. Contact
Questions about this Policy, including those directed to our Data Protection Officer, can be sent to hello@connekit.me.