Legal document
Privacy Policy
Last updated: October 12, 2026. See also the Terms of Use.
This is a translation. If there is any divergence between versions, the Portuguese version prevails, under Brazilian law. Português
This policy explains in full which personal data Mavve processes, why, for how long, and how you control and delete that data. It applies to the site and dashboard at https://gomavve.com and follows the Brazilian General Data Protection Law (LGPD, Law 13.709/2018).
1. Who is responsible
The data controller is RIVEA MARKETING E TECNOLOGIA LTDA, registered under no. 66.981.235/0001-10 (CNPJ), based in Itumbiara, GO, Brasil, who operates Mavve. Data protection contact: atendimento@gomavve.com.
For personal data received from TikTok we act as an independent controller and comply with the LGPD through transparency, a lawful basis and responding to data subject rights.
2. Data we process
| Data | Where it comes from | What for |
|---|---|---|
| Name, e-mail, chosen language and password (stored only as an irreversible hash) | You provide it at sign-up | Create and protect your account, send service notices in your language |
| TikTok account identifier (open_id), display name and profile picture | TikTok, with the "read profile info" permission | Show you which account is connected and which account will receive each post |
| Access and refresh tokens for the authorization, stored encrypted | TikTok, when you authorize | Post on your behalf the videos you ask for and check the result |
| Account information at posting time: nickname, username, visibility options, allowed interactions and maximum video duration | TikTok, with the "post content" permission | Build the posting screen with your account's real options. It is queried live and not stored, except the nickname and username, which are kept in the post history |
| Videos, captions, posting options, date and time, and the record of your consent on each post | You upload and choose | Post the video as you set it and show the history |
| Posting result: status, post identifier and error codes | TikTok | Tell you the progress and the result |
| Technical logs: IP address, date, time and security events (logins, access attempts) | Generated by use | Security, abuse prevention and the legal duty to keep access logs |
| Subscription data: Stripe customer and subscription identifiers, plan and payment status | Stripe, which processes the payment | Activate, change or end your plan. We do not receive or store the card number |
| Messages sent to support | You send them | Reply to your request |
We do not request or process sensitive data (such as racial origin, health, religion, political opinion or biometrics). Do not include that kind of data at sign-up or in messages to support. The service is intended for people aged 18 or older.
We do not read your public videos, followers, statistics or messages on TikTok. Mavve does not request those permissions.
3. Purposes and legal bases
- Providing the service you signed up for (performance of contract): registration, temporary storage of the video, posting on the scheduled date, history, subscription billing, service notices and support.
- Accessing your TikTok account (consent): only after you authorize on TikTok's screen, and only while the authorization exists. You can withdraw consent at any time by disconnecting the account.
- Security and abuse prevention (legitimate interest): login attempt limits, protection against automated use and spam.
- Legal obligations: keeping access logs for the period set by Brazilian internet law and tax obligations related to billing.
We do not use your data for advertising, do not sell data and make no automated decisions that produce legal effects on you.
4. TikTok data
The data we receive from TikTok is used for one purpose only: to make the connection you authorized work, that is, to show the connected account, post what you ask us to post and show the result. Regarding this data:
- we do not sell, rent or share it with third parties;
- we do not use it for advertising or to train artificial intelligence models;
- we do not build profiles, lists or databases about people, accounts or content, and do not combine it with data from other sources;
- we do not collect information by bots or scraping;
- we keep only the minimum necessary and delete it when you disconnect the account, delete your registration or the TikTok integration ends.
No TikTok data is sent to Stripe or to any other provider. TikTok's own use of your data follows TikTok's privacy policy.
5. Who we share with
- TikTok: receives the video, the caption and the posting options you chose, because that is what you ask us to do. TikTok fetches the file from a temporary address unique to the post, which stops existing after the post is published.
- Stripe (payment processor): when you subscribe to a plan we send Stripe your e-mail, your Mavve account identifier, the chosen plan and the language. Card details, name and billing address are entered by you directly on Stripe's page and never pass through our servers. Stripe processes this data under its own privacy policy.
- Other providers that operate the service for us, under contract and with the same protection obligations: server hosting and transactional e-mail (Resend).
- Authorities, when there is a legal obligation or a court order.
Some of these recipients, such as TikTok, Stripe and the e-mail service, process data outside Brazil. This international transfer happens to fulfil your request and with the safeguards provided by the LGPD.
6. Retention
| Data | How long it is kept |
|---|---|
| Video file | Until it is posted or cancelled, when it is deleted from the server. Drafts and posts waiting for action are deleted after 7 days |
| TikTok tokens, identifier and profile picture | While the account is connected. Deleted immediately when you disconnect, delete your registration, or TikTok tells us the authorization was removed |
| Post history (caption, options, date, result, account nickname) | Until you delete the post from your history or delete your registration |
| Registration (name, e-mail, language, password hash) and subscription identifiers | While the account exists |
| Dashboard notices | 90 days |
| Access logs | 6 months, as required by Brazilian internet law |
| Messages to support | Up to 12 months after the reply |
| Backups | Up to 30 days, then overwritten |
Payment records are kept by Stripe for the periods the law requires of it.
7. How to disconnect and delete your data
- Disconnect a TikTok account: in the dashboard, under Accounts, click Disconnect. We revoke the authorization at TikTok and immediately delete that account's tokens, identifier and picture. Posts still scheduled for it are cancelled and their videos deleted.
- Remove access from TikTok: in the TikTok app, open Settings and privacy, Security and permissions, Manage app permissions, and remove Mavve. When TikTok notifies us, we delete that account's tokens.
- Delete a post from your history: on the post page, click Delete from history.
- Delete your account and all data: in the dashboard, under My account, click Delete my account and confirm with your password. We cancel your subscription, if any, revoke all TikTok authorizations and immediately delete the registration, videos, posts, notices and sessions. Only the records the law requires us to keep remain, for the legal period.
- By e-mail: if you cannot log in, request deletion at atendimento@gomavve.com from the registered e-mail. We respond within 15 days.
8. Your rights
You can, at any time and free of charge: confirm whether we process your data, access it and receive a copy, correct incomplete or outdated data, request deletion, request portability, learn who we share it with, withdraw consent and object to unnecessary processing. Send your request to atendimento@gomavve.com; we respond within 15 days. You may also complain to the Brazilian data protection authority (ANPD).
9. Security
- HTTPS-protected connection across the whole site.
- Passwords stored only as an irreversible hash (scrypt), never in plain text.
- TikTok tokens encrypted in the database (AES-256-GCM), with the key kept outside the database, never sent to the browser and never written to logs.
- Card data never passes through our servers: payment happens on Stripe's page.
- Protected session cookie, request-forgery protection and login attempt limits.
- Administrative access restricted to the person responsible for the service, under a duty of confidentiality, with no access to video content beyond what is needed to operate the service.
- In case of a security incident that may put you at risk, we notify those affected and the authorities within the legal deadlines and disconnect from TikTok until it is fixed.
10. Cookies
We use essential cookies only: the session cookie, which keeps you logged in, a form-protection cookie and a cookie that remembers the chosen language. The light or dark theme preference is stored in your browser. We use no advertising cookies or third-party tracking tools. Stripe's payment page uses its own cookies.
11. Changes to this policy and languages
We may update this policy to reflect changes in the service or in the law. Relevant changes are announced by e-mail or in the dashboard before they take effect. The date of the last update is at the top of this page.
This policy exists in Portuguese, English and Spanish. If there is any divergence between versions, the Portuguese version prevails, governed by Brazilian law.
12. Contact
Privacy and personal data: atendimento@gomavve.com. Support: atendimento@gomavve.com. Form: contact page.