---
title: Privacy Policy | Zynta Flow
description: "Zynta Flow privacy policy: what data we collect, which providers receive it, how long we keep it and how to exercise your rights."
---

<https://www.zyntaflow.com/?hsLang=en>

[Product](https://www.zyntaflow.com/product?hsLang=en)[Solutions](https://www.zyntaflow.com/for-creators?hsLang=en)[Pricing](https://www.zyntaflow.com/pricing?hsLang=en)[Examples](https://www.zyntaflow.com/examples?hsLang=en)[Blog](https://www.zyntaflow.com/blog?hsLang=en)

🇧🇷

🇺🇸

[Log in](https://app.zyntaflow.com/login)[Get Started](https://app.zyntaflow.com/signup)

[Product](https://www.zyntaflow.com/product?hsLang=en)[Solutions](https://www.zyntaflow.com/for-creators?hsLang=en)[Pricing](https://www.zyntaflow.com/pricing?hsLang=en)[Examples](https://www.zyntaflow.com/examples?hsLang=en)[Blog](https://www.zyntaflow.com/blog?hsLang=en)

🇧🇷

🇺🇸

[Log in](https://app.zyntaflow.com/login)[Get Started](https://app.zyntaflow.com/signup)

# Privacy Policy

Last updated: October 28, 2026

## 1. Who we are

Zynta Flow (zyntaflow.com) is operated by **Epic Digital Marketing & Tech LLC**, headquartered at 6751 Forum Drive, Suite 240, Orlando, FL 32821, United States. Epic Digital Marketing & Tech LLC is the controller of your personal data for the purposes of the LGPD (Brazil, Law 13.709/2018) and, where it applies, the GDPR (EU and UK).

This policy explains what data Zynta Flow collects, what it is used for, who it is shared with, how long it is kept and how you exercise your rights. It describes what the product does today. When the product changes, this page changes with it.

## 2. Data we collect

- **Account:** email and password (we keep only a hashed version of the password, which nobody can read). If you sign in with Google, Google sends us your name, email and picture. At signup you may give your first and last name, phone and country.
- **Approximate location:** when you use the app, our hosting provider (Vercel) tells us the city, country and approximate coordinates derived from your IP address. We store them on your account to know where our customers come from. We also use the country to pick the site language. We do not use GPS or ask for your device location.
- **Brand and content:** what you put in brand kits (name, logos, colors, fonts, tone of voice, personas, website), carousels, captions, images, videos, ideas, calendar, reports, link-in-bio pages and approval comments. If you ask us to build the brand from a website, we read that address's public pages.
- **Social networks you connect:** Instagram, Facebook (Pages), Threads, LinkedIn, TikTok, Pinterest, YouTube and Bluesky. We receive the profile ID, username, name and picture, and store an encrypted access token to publish and read metrics on your behalf. We store the metrics of your posts and account (for example reach, likes, followers and aggregated audience data). On Threads we also store the replies other people leave on posts Zynta Flow published (text and username). If you connect a Meta ad account, we read your campaign metrics. We do not access your follower list.
- **Instagram Automations (comments and direct messages):** yes, Zynta Flow reads and stores direct messages. If you use Automations and grant the comments and messages permissions, Meta sends us the comments on your posts and the direct messages, story replies and story mentions your account receives. We store the text, attachment links, the sender's ID, username and name, and the time. We also store the replies Zynta Flow sends, the record of each flow run and the clicks on links sent. When someone writes an email address or phone number in a conversation with you, we save it on that person's contact card, together with the tags and fields you or your flows add. This is what makes automations, the inbox and the contact list work. We use this content only for that, never for advertising.
- **HubSpot you connect:** we store the HubSpot account ID, an encrypted access token and the permissions granted. We read campaign names, UTM parameters, status and attribution reports. Reports that list contacts return HubSpot contact IDs, which we cache for up to 15 minutes; we do not request those contacts' names or emails. When you tie a scheduled post to a campaign, we store the campaign ID and its UTMs with the post. If you use the "Send to HubSpot" step in an automation, Zynta Flow creates or finds a contact by the email the person sent in the Instagram conversation, logs a note about where they came from and fills two Zynta Flow properties; in that mode it never changes data already on the contact. In "form submission" mode, we read the account's forms and their fields and submit the lead to the form you pick, which updates the fields of an existing contact; the consent sent with it is the DM message that asked for the email or the legitimate interest set on the form. With the "Add to HubSpot list" step, we read the names of your static contact lists and add that contact to the list you pick, or to a "Zynta · flow name" list created the first time. When a scheduled carousel post is tied to a campaign, Zynta Flow writes the carousel files (a PDF and a PNG per slide, private) to a Zynta folder in your account's File Manager and associates them with the campaign.
- **Google Analytics and Search Console for your site:** if you connect the Site tab, we read (read only) the GA4 and Search Console reports for the properties you pick and store an encrypted token.
- **AI assistants (MCP):** if you connect an AI assistant to your account, we store its access tokens and a log of the actions it took.
- **Support:** the messages you send, the screenshots you attach and your email.
- **Payment:** Stripe processes card payments and collects card details and billing address directly. Stripe sends us the plan, subscription status, amounts and dates. We never see full card numbers and never store them.
- **Product usage:** pages viewed and product steps (for example, opened Create, generated a carousel). Section 5 says what is recorded with and without your consent.
- **Referrals:** if you arrive through a referral or partner link, we store who referred you.
- **Contacts of our own Instagram:** when someone talks to the Zynta Flow Instagram profile and asks for material or an invite, the tool we use on that profile (ManyChat) sends us the contact ID, username, name and, if the person gives them, email and phone. We use this to tie the request to the signup that may follow.

## 3. What we use it for, and the legal basis

- **Providing the service** (performance of contract): generating content with AI, publishing and scheduling on the networks you connected, showing metrics, running your automations, inbox and contact list, and giving access to your team and clients.
- **Billing and managing your subscription and credits** (performance of contract and legal obligation).
- **Sending service emails**, such as account confirmation, security, low balance, renewal and notice of drafts about to be deleted (performance of contract). Product news, promotions and newsletter emails go only if you have not turned them off in Settings; every email has an unsubscribe link.
- **Security and abuse prevention**, such as usage limits per account, email and IP (legitimate interest).
- **Understanding usage and improving the product** (legitimate interest; consent for analytics cookies).
- **Measuring our ads**, by telling Meta when someone who came from an ad signs up, starts using Zynta Flow, starts a trial or buys (legitimate interest; see section 6).
- **Meeting legal and tax obligations** and answering authorities when the law requires it.

We do not sell your data. We do not use the content of your direct messages or your contacts for advertising.

## 4. Providers that receive data

These are the providers (processors) that receive personal data when you use Zynta Flow, what each receives and why. Social networks receive data only if you connect your account on them.

- **Supabase:** database, login and file storage. Holds everything in your account. Servers in Brazil (São Paulo) or the United States.
- **Vercel:** app hosting, with servers in Brazil (São Paulo) or the United States. Receives every request (with IP and browser), provides the approximate location from the IP (section 2) and counts visits and product steps without cookies (Vercel Web Analytics), with the page address stripped of parameters except UTMs.
- **Anthropic (Claude):** generates and edits carousels, captions, ideas, calendar plans and personas, builds the brand from a website and writes analyses of your metrics. Receives the text, brand data, website content and metrics those features use. It does not receive Automations messages. Under its API terms, Anthropic does not use this data to train models.
- **OpenAI:** AI image generation. Receives the image request, with your brand instructions, when you use that feature. Under its API terms, OpenAI does not use this data to train models.
- **Unsplash:** stock images. Receives search terms and serves the images you pick.
- **Google:** Google sign-in; YouTube publishing and metrics, if you connect it; reading your GA4 and Search Console, if you connect the Site tab; editor fonts, which your browser downloads from Google Fonts (Google receives your IP); Google Tag Manager and Google Analytics on our site (section 5). Our server may also send Google Analytics a purchase record, with value, currency and an identifier derived from the account ID, without the email.
- **Meta (Instagram, Facebook, Threads):** receives what you publish, the replies and messages your automations send and metric requests, including ads, if you connect. It also receives our ad measurement data: the Meta Pixel in the browser, only with advertising consent (section 5), and the Conversions API from our server (section 6).
- **LinkedIn, TikTok, Pinterest and Bluesky:** receive what you publish and metric requests, if you connect.
- **HubSpot:** in three roles. (1) Shows the cookie banner and stores your choice on every page; with analytics consent, it records visits and the signup and checkout-start events. It also hosts our www.zyntaflow.com site and may show the support chat. (2) It is our support desk: support messages, screenshots and your email go to our support inbox in HubSpot. (3) If you connect your own HubSpot, the data described in section 2 flows between Zynta Flow and your account.
- **Microsoft Clarity:** heatmaps and session recording (clicks, scrolling, movement), only with analytics consent. Text and form fields are masked by default. When you are logged in, the session is tied to your account ID, which Clarity stores hashed.
- **Stripe:** card payment processing. Receives your email, country, billing and card details (typed straight into Stripe's form) and your account ID.
- **Resend:** delivery of Zynta Flow emails. Receives your email address and each message's content.
- **Upstash:** usage limits against abuse. Receives identifiers such as the account ID, the email in a password reset request and the IP, for a few minutes.
- **ManyChat:** automation of Zynta Flow's own Instagram profile. Receives and sends us the data of people who talk to that profile (section 2).

**International transfers:** the database, files and app servers are in Brazil (São Paulo) or the United States, depending on our infrastructure. We will email you before we change where the data of existing accounts is stored. Several providers above (Anthropic, OpenAI, Google, Meta, Microsoft, HubSpot, Stripe, Resend, Upstash, ManyChat and the social networks) process data outside Brazil, mainly in the United States and the European Union. We make these transfers under Art. 33 of the LGPD, to perform the service you signed up for, with providers that offer contractual data protection safeguards, including the standard contractual clauses approved by Brazil's ANPD.

## 5. Cookies, tracking and the banner

**Essential cookies**, always on: your login session, language, active brand and the invite or trial code you opened. In the browser (localStorage) we keep preferences such as theme and language.

**What loads on every page**, before any choice: on every page of zyntaflow.com and app.zyntaflow.com, Google Tag Manager (a Google container that loads other scripts) loads when the page opens, with Google Consent Mode set to "denied" for analytics and advertising. Tag Manager loads the HubSpot script, which shows the cookie banner and stores your choice. Just by loading, these two scripts make your browser talk to Google and HubSpot servers, which receive your IP and technical browser data. Under HubSpot's configuration, its tracking cookies are set only after you accept.

**What fires only after you accept in the banner:**

- **Analytics:** Google Analytics, Microsoft Clarity and the signup and checkout-start events in HubSpot.
- **Advertising:** Meta Pixel, with the signup and checkout-start events.
- With no choice, or if you decline, none of these fire.

**What happens regardless of the banner:**

- Vercel Web Analytics counts visits and product steps without cookies and without identifying you.
- If you arrive from a Meta ad (the link carries the fbclid parameter), we store that click identifier in our own cookie, zf\_fbc, for 90 days, and our server reports the visit to Meta. This identifier is used for the measurement in section 6.

**Pages without tracking:** shared reports (/r), the client approval portal (/review), invite pages (/i), cards (/card) and link-in-bio pages (/bio). Tag Manager may load there, but no analytics or advertising tag fires and the page address is not sent. The exception is a visit from a Meta ad to an invite page, reported by the server as described above.

**Changing your choice:** there is no link on the site to reopen the banner today. To change it, delete the zyntaflow.com cookies in your browser; the banner comes back on your next visit. We do not use advertising cookies without your acceptance.

## 6. Server-side ad measurement

To know which ads bring customers, our server sends Meta (Conversions API) four events: when you finish signing up, when you spend your first credit (for example, generating your first carousel), when you start a trial and when you make a purchase. The event carries your email and account ID turned into a code (a SHA-256 hash, which cannot be turned back into text but which Meta can match against its own data), the IP, the browser, Meta's click and browser identifiers when they exist, the value and currency for purchases and, for the first credit spent, which action it was. This does not depend on your banner choice. Internal and test accounts are left out.

If you do not want your events sent to Meta, write to [contato@zyntaflow.com](mailto:contato@zyntaflow.com).

## 7. Who else sees your data

- **Your team and the members of each brand kit** see that brand's content, calendar, metrics, inbox and Automations contacts.
- **Your clients** see what you send for approval in the approval portal, and you see their comments.
- **Anyone with the link** sees reports and carousels you share by link, and your link-in-bio pages are public.
- **Media files** (images, videos and exports) live at public addresses that are hard to guess, because social networks need to download the file to publish it. Anyone with the exact address can open the file.
- **Agency partners:** if you created your account through a partner agency's link, the agency sees your name or company, your plan and your subscription status.
- **Authorities**, when the law or a court order requires it.

## 8. How long we keep it

- **Account:** while it is active.
- **Carousel drafts:** a draft not edited for 30 days gets a notice (in the app and by email) and is deleted, with its images, 45 days after its last edit. Editing the draft after the notice restarts the clock. Carousels that were exported, published, scheduled, shared or sent for approval are outside this rule.
- **Post media:** 45 days after publishing, we recompress the post's images and videos so they take less space. The post published on the network does not change.
- **Carousel exports (PNG and ZIP):** deleted 45 days after they were made. You can generate them again at any time.
- **Account without a plan for more than 45 days:** we delete the files (images, videos and brand materials). The account and the text stay.
- **Automations comments and direct messages** (text, attachment links and the sender's ID, username and name), the replies Zynta Flow sends and the record of each flow run: deleted 90 days after they were received. A conversation stays in the inbox while it has a message from the last 90 days. The raw notification Meta sends for each comment or message is cleared after 30 days. Message usage counters last 3 days. The list of who received a broadcast is deleted 90 days after sending. Totals, such as how many times a flow ran or how many people a broadcast reached, are kept without any of that content.
- **Replies on your Threads posts:** deleted 90 days after they were written.
- **Automations contact list** (Instagram ID, username and name, any email or phone the person wrote, tags and fields): kept while your account is active, including after you disconnect Instagram, so your contacts are still there when you reconnect. Deleted with your account, when you remove Zynta Flow in your Instagram settings and ask Meta to delete your data, or earlier on request at [contato@zyntaflow.com](mailto:contato@zyntaflow.com), including when a person who wrote to you asks for their data to be deleted.
- **Network metrics, published content, brand kits, calendar, reports and approximate location:** no period of their own. Kept until you delete them or until the account is deleted.
- **Log of AI assistant (MCP) actions and log of emails sent:** 90 days. The one exception is the record of the notice that your team became inactive, kept while the account exists so the notice is not sent twice.
- **One-time codes** created while connecting an account or an AI assistant: deleted after 1 day. Revoked or expired AI assistant tokens: deleted 30 days later.
- **Social network tokens:** deleted the moment you disconnect the network. HubSpot tokens stop being used when you disconnect; for a connection made with Connect with HubSpot, disconnecting also uninstalls the app from your HubSpot account, which revokes the token. A private app token stays valid in HubSpot until you delete that private app there.
- **Support:** tickets are kept until the account is deleted. The copy of the conversation in our HubSpot support inbox is not deleted automatically; ask for deletion at [contato@zyntaflow.com](mailto:contato@zyntaflow.com).
- **Contacts of our own Instagram (ManyChat):** kept until someone asks for deletion. If the contact's email is your account email, it is deleted with the account.
- **Payments:** we keep payment records for as long as tax law requires of us. Stripe keeps its own records for as long as the law requires of it.

**Account deletion:** when you delete your account (in Settings \> Account), we immediately delete the account, the data tied to it and the files. Content you created inside a brand kit owned by someone else (for example, as a member of a client's team) moves to that kit's owner, so their work does not disappear. If there is an active subscription, it is cancelled and paid access ends at the end of the period already paid, with no further charge. Data already sent to Meta, Google or HubSpot follows each one's rules.

## 9. Security

We use encrypted connections (TLS) for all traffic, passwords hashed by our login provider, network and HubSpot access tokens encrypted with AES-256-GCM, and database access rules that limit each account to its own data and the brands shared with it. No system on the internet is 100% secure. If an incident may cause you relevant risk or harm, we will notify you and the ANPD, as the LGPD requires.

## 10. Your rights (LGPD, Art. 18)

At any time you can ask for:

- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of data that is unnecessary, excessive or processed outside the LGPD;
- portability of your data to another provider;
- deletion of data processed with your consent;
- information on who we share your data with (section 4);
- information on the option not to consent and what happens if you do not;
- withdrawal of consent;
- objection to processing based on legitimate interest, such as the ad measurement in section 6.

**How to ask:**

- **Export:** in Settings \> Account, the export button downloads a JSON file with your account, brand kits, carousels, captions, calendar, folders, credits, connected networks (without tokens), support tickets, notifications and AI assistant tokens (without the secret). What is not in that file yet (Automations contacts and messages, metrics, approvals, ideas, reports, image and video files and email history) you get by asking at [contato@zyntaflow.com](mailto:contato@zyntaflow.com).
- **Correct:** directly in the app (profile and brand kits) or by email.
- **Delete:** in Settings \> Account \> Delete account, or by email. To delete only the data of one Instagram account, remove Zynta Flow in your Instagram settings and ask for deletion; Meta tells us and we delete it.
- **Disconnect networks and HubSpot:** at any time, in the app settings.
- **Emails:** choose what you get in Settings or through the link at the end of each email.
- **Anything else:** write to [contato@zyntaflow.com](mailto:contato@zyntaflow.com). We answer within 15 days.

**If you wrote to a Zynta Flow customer on Instagram:** the business that owns that account decides what to do with the conversation, and Zynta Flow stores the data on its behalf. You can ask the business or us, at [contato@zyntaflow.com](mailto:contato@zyntaflow.com); we help fulfil the request.

If you think we did not resolve your request, you can complain to Brazil's National Data Protection Authority (ANPD) or to your local data protection authority.

## 11. Minimum age

Zynta Flow is for people 18 and older, as the Terms of Service say. We do not knowingly collect data from children or teenagers. If you know of such an account, write to [contato@zyntaflow.com](mailto:contato@zyntaflow.com) and we will delete it.

## 12. Changes to this policy

When this policy changes, we publish the new version on this page and update the date at the top. We notify you by email or in the app of material changes, including a change of controller, before they take effect.

## 13. Contact

**Controller:** Epic Digital Marketing & Tech LLC · 6751 Forum Drive, Suite 240, Orlando, FL 32821, USA

**Data Protection Officer (Encarregado, LGPD Art. 41):** reachable at privacidade@epic.digital

**Email:** [contato@zyntaflow.com](mailto:contato@zyntaflow.com) · **Website:** https://zyntaflow.com

Social Media Performance

[Product](https://www.zyntaflow.com/product?hsLang=en)[Pricing](https://www.zyntaflow.com/pricing?hsLang=en)[MCP](https://www.zyntaflow.com/mcp?hsLang=en)[Blog](https://www.zyntaflow.com/blog?hsLang=en)[About](https://www.zyntaflow.com/about?hsLang=en)[Login](https://app.zyntaflow.com/login)[Get Started](https://app.zyntaflow.com/signup)

[For agencies](https://www.zyntaflow.com/for-agencies?hsLang=en)[For creators](https://www.zyntaflow.com/for-creators?hsLang=en)[For brand teams](https://www.zyntaflow.com/for-brands?hsLang=en)

[AI Carousel Generator](https://www.zyntaflow.com/ai-carousel-generator?hsLang=en)[Instagram Carousel Maker](https://www.zyntaflow.com/instagram-carousel-maker?hsLang=en)[LinkedIn Carousel Generator](https://www.zyntaflow.com/linkedin-carousel-generator?hsLang=en)

[Contact](https://www.zyntaflow.com/contact?hsLang=en)[Privacy](https://www.zyntaflow.com/privacy)[Terms](https://www.zyntaflow.com/terms?hsLang=en)[Refund](https://www.zyntaflow.com/refund?hsLang=en)

Open this page in[ChatGPT](https://chatgpt.com/?q=Read%20this%20page%20and%20help%20me%20apply%20it%3A%20https%3A%2F%2Fwww.zyntaflow.com%2Fprivacy)[Claude](https://claude.ai/new?q=Read%20this%20page%20and%20help%20me%20apply%20it%3A%20https%3A%2F%2Fwww.zyntaflow.com%2Fprivacy)[Perplexity](https://www.perplexity.ai/?q=Read%20this%20page%20and%20help%20me%20apply%20it%3A%20https%3A%2F%2Fwww.zyntaflow.com%2Fprivacy)

© 2026 Epic Digital Marketing & Tech LLC · 6751 Forum Drive, Suite 240, Orlando, FL 32821, USA