Transparency & Data Protection (LGPD)

Privacy Policy

Last updated: October 23, 2026

1. Data we collect

Culto em Cortes keeps what it needs to create the media packages and manage subscriptions:

Account: email address, the name of the person responsible and the church's name.
Services: the public YouTube links you submit, the church identity applied to the materials (name, Instagram, logo and service times) and publishing schedules.
Orders: email address, plan, amount, payment method and date, and the IP address and browser of whoever placed the order.
Security and operations: IP address, browser and pages visited in each session and in the audit logs, and the messages sent through Support (name, contact details and text).
Errors: when something breaks, our error monitoring service (Sentry) receives the page visited and the IP address of the person browsing.

2. Google / YouTube Data API v3 Integration (OAuth 2.0)

When a user chooses to connect the church's YouTube channel under My Account → Channels & Autopilot:

We request only the youtube.upload and youtube.readonly scopes through Google's official OAuth 2.0.
We store the access token and refresh token securely, only to identify the name of the connected channel and to publish short videos (YouTube Shorts) that the church has explicitly scheduled in the Weekly Autopilot.
We do not read, change or delete existing videos on the channel, and we do not share Google/YouTube data with third parties or external models.
The user can disconnect the channel at any time under My Account or revoke access directly in the security settings of their Google Account.

3. Instagram Reels and TikTok (No credentials collected)

For Instagram Reels and TikTok, Culto em Cortes never asks for social media logins or passwords: at the scheduled time, we email the church's media team the vertical (9:16) MP4 file, ready to download, along with the caption and hashtags.

4. Payments and Security

Card payments are processed directly by Stripe, and PIX payments (Brazil only) through the Brazilian banking system. We do not store credit card data on our servers.

5. Your Rights (LGPD) and account deletion

To delete your account, use the Delete my account button in My Account. If you cannot access your account, ask through the Support page and we will do the same. Deletion is immediate and cannot be undone:

We permanently erase the account's email address and name, open sessions, access codes and links, the YouTube connection (including tokens), the team invitations you sent and received, and publishing schedules.
Analyzed services come from public YouTube videos and stay in the system, but they are no longer linked to you, and their notification contact is erased.
Paid orders are kept as tax records (plan, amount and date), with the email address replaced by an anonymous marker and without IP address or browser. Unpaid orders are erased. Deleting your account does not cancel a card subscription: cancel it in Stripe first.
In the audit logs, your email address is replaced by the same marker, the IP address and browser of the related entries are erased, and the content of support messages sent with your email address is removed.
If you sign in again with the same email address, a new, empty account is created, without the services, orders or team of the previous account.

Disconnecting the YouTube channel under My Account also erases the tokens immediately. To request an export of your data, use the Support page.