Privacy Policy

Last updated: September 16, 2026

This policy explains what data Alquimista processes, why, who it is shared with, how long it is kept and how you can exercise your rights. It covers the website and dashboard at alquimista.app and the integrations with Pinterest, Instagram (Meta) and Telegram. It also covers Cartboard, our Pinterest content and commerce product, which runs inside the same dashboard.

1. Who we are

Alquimista is a content studio for marketing agencies and brands. The service is run by Pollyana Gomes Melo, an individual resident in Spain (Barcelona), who is the person responsible for the data processing described here.

Contact for any privacy matter: pollyana.pgm2@gmail.com.

Alquimista has not appointed a Data Protection Officer (DPO). Requests are handled directly by the person responsible.

2. Our role

Alquimista serves agencies, which in turn serve their own brands. Our role depends on the data:

• We are the controller for data about people who use the dashboard (name, email, login) and for technical data needed to run and secure the service.
• We are a processor for brand content: submitted ideas, generated content, approvals and data from connected social accounts. Here, the agency or brand that hired us decides about the data, and we process it only to provide the service to them.

If you are a client of an agency that uses Alquimista, you can contact your agency or us directly. If the request reaches us, we let the agency know.

3. What data we process and why

About free-form content. A voice note or a message can contain anything, including data about other people or sensitive data (such as health). The system cannot filter this before it arrives. Please do not send sensitive data or third-party data that the content does not need.

Legal bases

Where we are the controller, we rely on:

• performance of a contract with the client agency or brand, to provide the service and dashboard access;
• authorization given by the account owner, for Pinterest and Instagram connections, granted on each platform's official screen and revocable at any time;
• legitimate interests, to keep the service secure, investigate errors and prevent abuse;
• legal obligation, when the law requires data to be kept or disclosed.

Where we are a processor, the legal basis is set by the agency or brand that hired us.

4. Data from connected platforms

Alquimista only acts on a social media account after the brand authorizes it on the platform's official screen (OAuth). We never ask for Pinterest, Instagram or Facebook passwords, and we do not use session cookies from those platforms.

The access tokens we receive are stored encrypted in our database, with an encryption key kept outside the database. They are used only to serve the brand that connected the account.

Pinterest

Scopes requested: user_accounts:read, boards:read, boards:write, pins:read and pins:write. Pinterest requires boards:write to create a Pin on a board; we never create, edit or delete boards.

What we read:

• the username and ID of the connected account, to show which account was authorized;
• the account's list of boards, to find the board the brand chose;
• Pins created by Alquimista and their analytics (impressions and outbound clicks), to show results to the brand;
• trending keywords and categories in the brand's region, to suggest topics and products to that same brand.

What we write: we create a Pin on the brand's account, on the board the brand chose, only after a person approves that specific Pin in the dashboard. Alquimista does not like, follow, comment, message or save other people's Pins.

What we store: the connected username, the encrypted tokens, the ID, link and board of each Pin created by Alquimista, daily analytics for those Pins, and the trend lists used for suggestions.

Instagram and Facebook (Meta)

The connection uses Facebook Login for Business. Meta's screen shows the permissions requested, which are used to read the Instagram professional account linked to the Facebook Page and its insights (such as instagram_basic, instagram_manage_insights and pages_read_engagement).

What we read: the ID and username of the Instagram professional account; account figures (followers, following, number of posts, reach, views, accounts engaged, likes, comments, shares, saves and profile link taps); and, for each post, its type, date, permalink and its reach, views, likes, comments, shares and saves.

What we write: nothing. Alquimista currently does not publish to Instagram, does not read direct messages and does not read comment text.

What we store: the account ID and username, the encrypted token and the daily history of the metrics.

Telegram

There is no login on Telegram. You choose to send messages to Alquimista's bot. We receive your chat ID and the content of your messages, and we use this channel to reply and to send notices and approval links. Telegram is operated by Telegram Messenger.

Until September 2026 we also received ideas through WhatsApp. Anything that arrived that way, including the phone number, follows the same retention periods and can be deleted on request (section 8).

How to revoke access

You can cut off access at any time, in any of these ways:

• On Pinterest: in your account settings, go to the section listing apps with access to your account and remove the Alquimista app.
• On Meta: on Facebook, go to Settings & privacy → Settings → Business integrations and remove Alquimista. On Instagram, also check the apps and websites section.
• On Telegram: stop sending messages or block the bot, and ask us to remove your contact.
• With us: email pollyana.pgm2@gmail.com asking us to disconnect the account or delete the data.

After access is revoked, Alquimista can no longer read from or publish to that account. Data already stored remains until the end of its retention period or until you ask for deletion (section 8).

What we never do with this data

• We do not sell, rent or share platform data with third parties other than the subprocessors in section 5, which process it only to provide the service.
• We do not use this data for advertising outside the platforms themselves.
• We do not combine data across different clients' accounts.
• We do not use Pinterest data, Meta data or brand content to train or improve artificial intelligence models.

5. Who we share data with: subprocessors

Alquimista relies on the providers below. Each one receives only what it needs for its task.

Transfers outside the European Economic Area. Some of these providers are located outside the EEA, mainly in the United States. In those cases, transfers rely on the GDPR mechanisms the provider offers, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

We may also disclose data when a competent authority requires it by law.

6. Use of artificial intelligence

Part of the content is created with third-party AI models (Anthropic, Google, AssemblyAI and Voyage AI, listed above). In practice:

• AI suggests; a person reviews, edits and approves each piece before anything is published;
• each provider receives only what it needs for that task;
• Alquimista does not use your content or platform data to train AI models, and does not hand it to anyone for that purpose;
• the system learns from approval and editing decisions only to tailor suggestions for that same brand, by keeping examples in our database, without training any model;
• no decision with legal or similarly significant effect on a person is made automatically.

7. How long we keep data

After a deletion, data may still exist for up to 15 days in backups, which expire on their own. If a backup has to be restored during that period, the deletion is applied again before the backup is put back into use.

8. Your rights and how to exercise them

Under the General Data Protection Regulation (GDPR) and, for data subjects in Brazil, the Brazilian General Data Protection Law (LGPD), you can ask for:

• access to your data and a copy of it;
• rectification of inaccurate or incomplete data;
• erasure of your data;
• portability, in a structured, commonly used format;
• restriction of processing or to object to it, where it is based on legitimate interests;
• withdrawal of the authorization given to a platform at any time, without affecting what was done before;
• information about who your data is shared with (LGPD).

To exercise any right, email pollyana.pgm2@gmail.com. We may ask you to confirm your identity first. We reply within one month. If the request concerns data we process on behalf of an agency, we let that agency know.

Data deletion request

1. Email pollyana.pgm2@gmail.com with the brand name and, if any, the connected Pinterest or Instagram account.
2. We confirm your identity and log the request.
3. A daily routine deletes the brand's data: submitted ideas, content plans, pieces and versions, approval and editing history, voice profile, Telegram contacts (and WhatsApp ones, where they exist), connected social accounts with their tokens and analytics, and the Pin library data and images. Cost records are unlinked from the brand, and the brand name is replaced with a deletion marker.
4. We confirm by email when it is done.

Deletion at Alquimista does not remove what has already been published on your social accounts. That stays under your control on each platform. It also does not remove copies that the providers in section 5 keep under their own retention rules.

Complaints

If you believe your data was not handled properly, you can complain to Spain's Agencia Española de Protección de Datos (AEPD), to the data protection authority of your EU country or, in Brazil, to the Autoridade Nacional de Proteção de Dados (ANPD). If you can, please contact us first so we can try to fix it.

9. Cookies and browser storage

• These public pages (such as this Privacy Policy) use no cookies, no JavaScript and no analytics. The typeface is served from our own domain.
• The dashboard uses no advertising or analytics cookies. It uses browser local storage (localStorage) for two things: keeping you signed in for up to 8 hours, only if you tick that option at login, and remembering the language chosen on the login screen.
• The "Sign in with Google" button loads a Google script on the dashboard login screen. Google may use its own cookies for that, under Google's privacy policy.

To clear what is stored, log out of the dashboard or clear the site data in your browser settings.

10. Security

• Encrypted connections (HTTPS) on every page and integration.
• Social account tokens encrypted in the database.
• Passwords stored only as hashes.
• Server access restricted to keys and protected by a firewall.
• Dashboard with login and per-user permission levels.
• Daily backups and automatic failure monitoring.

No system is fully immune to incidents. If a personal data breach puts you at risk, we notify the competent authority and the people affected within the legal deadlines.

11. Children

Alquimista is a professional service for agencies and brands. It is not intended for anyone under 18, and we do not knowingly process children's data.

12. Changes to this policy

We may update this policy when the service changes. The date at the top shows the latest version. If a change is significant, we tell clients through the dashboard or by email before it takes effect.

13. Contact

• Alquimista, run by Pollyana Gomes Melo
• Email: pollyana.pgm2@gmail.com

Back to top ↑