Privacy policy
Champi Labs (https://app.champilabs.com) is a platform that creates videos, images and text for social media with artificial intelligence and publishes them to the accounts each customer connects. The service is operated by MBX Marketing, CNPJ 49.619.838/0001-57, located at Rua Sucupira - Goiania - Goias - Brazil, the controller of the personal data described here under Brazil's General Data Protection Law (Law 13,709/2018, LGPD). Contact: [email protected].
1. Data we collect
- Account: name, email, password (stored only as a hash), language, plan and credit balance.
- Projects: the settings you fill in (name, audience, country, topics, style, voice, schedule), your logo and any media you upload.
- Generated content: scripts, captions, narration, images and videos created for your projects, and your approval or rejection of each one.
- Connected social accounts: the account or page ID and name, access and refresh tokens (encrypted), granted permissions, token expiry, and the link and status of each post.
- Telegram (optional): the chat ID, if you link the notification bot.
- Technical data: session cookie, language and theme cookies, IP address and server access logs.
2. How we use social media data
When you connect YouTube, Instagram, Facebook, TikTok or Bilibili, we use the access you grant only to: show which account is connected, publish the content you approved or set to publish automatically, and display the status and link of each post. We do not read messages, comments, followers or analytics, we do not post anything you have not set up, we do not sell this data, and we do not use it for advertising or to train artificial intelligence models.
- YouTube: Champi Labs uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service and the Google Privacy Policy. You can revoke access at any time at security.google.com/settings/security/permissions. Champi Labs's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- Instagram and Facebook: access can be removed under Settings › Apps and websites, on Facebook or Instagram. See also the data deletion page.
- TikTok and Bilibili: access can be removed in each platform's authorized apps settings.
- In every case, the Disconnect button under Profile › Social networks deletes the tokens we store right away.
3. Why we use your data
- To provide the service: generate content, send it for approval and publish it (performance of contract).
- To connect to and publish on your social accounts (consent, which you can withdraw at any time).
- To send account, content-ready and publishing-failure notices by email or Telegram (performance of contract).
- To keep the service secure, prevent abuse and fix errors (legitimate interest).
- To meet legal obligations, such as keeping access logs as required by Brazil's Internet Civil Framework (legal obligation).
4. Who we share data with
We share only what each step needs, with providers that process data on our behalf:
- OpenAI: topics, project settings and research snippets, to write scripts and captions, look up information and generate images.
- Google Cloud (Text-to-Speech) and ElevenLabs: narration text, to generate the voice.
- Runway: images and scene descriptions, when a project uses AI video scenes.
- Hostinger: the server that hosts the application, database and files.
- Email provider and Telegram (if linked), for notices.
- The social networks you connect, which receive the published content.
Some of these providers are outside Brazil (for example, in the United States). These international transfers are made to deliver the service you signed up for, with providers that apply security measures consistent with the LGPD.
So that the networks can fetch them, generated videos and images are stored at direct-access addresses (https://s3.champilabs.com) with hard-to-guess names and no public listing. Anyone with the exact link can open the file.
We do not sell personal data. We may disclose data to authorities when required by law.
5. How long we keep data
- Account and project data: while the account is active.
- Deleted project: the project, its content and its files are deleted immediately.
- Disconnected network: its tokens are deleted immediately.
- Closed account: all data is deleted within 30 days, except what the law requires us to keep (such as access logs, for 6 months).
6. Security
All traffic uses HTTPS. Passwords are stored only as hashes. Social media tokens are encrypted (AES-256-GCM) and used only by the server. Administrative access is restricted.
7. Your rights
Under the LGPD you can ask us to confirm whether we process your data, and request access, correction, anonymization, portability, deletion, information about who we share it with, and withdrawal of consent. Write to [email protected] from your account's email address. We reply within 15 days. You can also complain to Brazil's National Data Protection Authority (ANPD).
8. Cookies
We use only essential cookies: the session cookie (to keep you signed in) and the language and theme cookies. We do not use advertising or tracking cookies.
9. Minors
Champi Labs is not intended for anyone under 18.
10. Changes
We may update this policy. Material changes will be announced by email or in the app, and the date at the top of this page always shows the version in force.