Privacy Policy

Last updated: April 26, 2026

This Privacy Policy describes how Lucas Carvalho Serviços de Tecnologia (CNPJ 57.590.985/0001-70) ("we", "our") collects, uses, and protects information obtained through the Instagram Widget by Luck platform, in compliance with the General Data Protection Regulation (GDPR), the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018), and Meta platform policies.

1. Who we are

The Instagram Widget by Luck is an API service that displays Instagram feeds on third-party websites, operated by Lucas Carvalho Serviços de Tecnologia, registered under the CNPJ under No. 57.590.985/0001-70. We operate as a data processor in relation to the information provided by the Instagram / Meta API.

2. Data we collect

2.1 Customer data (users of the service)

When subscribing to the Instagram Widget by Luck, we collect:

• Name and contact information (email)
• Domain(s) of the customer's website

2.2 Instagram data (via OAuth authorization)

When the customer authorizes our app via Instagram, we receive from the Meta API:

• Instagram user ID
• Username
• Long-lived access token — stored securely to fetch the feed
• Post metadata: ID, caption, media type, media URL, permanent URL, and publication timestamp

We do not collect passwords, emails, phone numbers, banking information, or any other personal data from Instagram other than the items above.

2.3 Technical data

• Origin domain of API requests
• Access logs (for security and diagnostic purposes)

3. How we use the data

• Fetch and deliver the customer's Instagram feed to their website
• Cache the feed (Redis, 2-hour TTL) to optimize performance
• Automatically renew the access token before it expires
• Validate that requests originate from domains authorized by the customer

We do not sell, rent, share, or use the data for advertising purposes.

4. Storage and security

Data is stored on AWS servers. We adopt the following security measures:

• HTTPS communication on all endpoints
• Access tokens stored in databases with restricted access
• Multi-tenant isolation — each customer only accesses their own data
• Origin validation (CORS) per registered domain

5. Data retention

Data is retained as long as the service agreement is active. After cancellation, data is deleted within 30 days, unless legally required to be retained.

6. Your rights (GDPR / LGPD)

You have the right to:

• Confirm the processing of your data
• Access your data
• Correct incomplete or outdated data
• Request the deletion of your data
• Revoke consent at any time

To exercise your rights, please visit our data deletion page or contact us via email at privacidade@luck.app.br.

7. Third-party data (Meta / Instagram)

Our use of Meta APIs is subject to the Meta Platform Terms and Policies. We do not store Instagram data beyond what is necessary to provide the service.

8. Cookies

This website does not use tracking or advertising cookies. We only use strictly necessary storage for the API's operation.

9. Changes to this policy

We may update this policy periodically. We will notify active customers of relevant changes by email. Continued use of the service after notification constitutes acceptance of the new conditions.

10. Contact

Questions about this policy? Contact us:

• Lucas Carvalho Serviços de Tecnologia — CNPJ 57.590.985/0001-70
• Email: contato@luck.app.br
• Website: luck.app.br