Pangolin Media LabPrivacy Policy
What Pangolin processes when a company requests a piece and connects its Instagram, TikTok or YouTube, why, where it is kept and for how long.
1. What Pangolin Media Lab is, and who we are
Pangolin Media Lab is a communication system for businesses. It is used by a client company: the company requests an image or video piece, Pangolin's artificial intelligence creates a proposal, a person from the company asks for changes or approves it, and the approved piece is published to the Instagram, TikTok or YouTube account the company connected. Nothing is published without a person's approval.
Pangolin Media Lab is developed and operated by ARXS LAB LTDA, CNPJ 68.114.066/0001-46, based in São Paulo, Brazil («ARXS», «we»). Until October 2026 it was called ARXS Media Lab.
Pangolin is currently in a closed pilot, with companies invited by ARXS. This policy describes what it does in this pilot, and it is updated before Pangolin starts doing anything else.
Until sign-up opens, ARXS keeps a waiting list at pangolin.media. Its data is described in this policy, and ARXS decides about it, as controller.
Data Protection Officer (DPO), under art. 41 of Brazil's General Data Protection Law (LGPD): dpo@arxs.com.br — the channel for any request or complaint about this policy.
2. Who decides what: the client company and ARXS
For the data the client company brings to Pangolin — requests, the brand profile, pieces and the accounts it connects —, the client company decides what is processed and why: under the LGPD it is the controller. ARXS acts as processor: it processes this data only to deliver the service, following the client company's instructions, and never for a purpose of its own.
For the data of people who sign in to Pangolin on behalf of the client company (name and login email) and for the waiting list, ARXS is the controller.
3. What data we process
What the client company writes and approves
- The brand profile: how the company presents itself and what it wants to communicate;
- Piece requests and change requests: the text the person writes;
- The images the company sends with a request (a reference, the logo, the product), which may show people: they are kept in the company's files, with who sent them and when;
- The pieces: the images created, each version, the caption, and who approved them and when.
From the account the client company connects, through Meta (Facebook and Instagram)
When the client company connects its account, Meta gives Pangolin limited access to the Page and the Instagram account it chose when connecting, and to nothing else:
- Facebook Page and Instagram account: name, identifier and access key, to publish the approved piece and confirm it was published;
- Post metrics: Pangolin asks Meta for permission to read the reach and interactions of posts, which are aggregate numbers, not the identity of who saw them. In the pilot, it does not collect them yet.
What Pangolin does NOT do with the Meta account: it does not read inboxes, does not access the profiles of followers or people who interact, does not create ads, and does not use one client company's data for another.
From the account the client company connects, through TikTok
The client company connects its account through TikTok's official login, and TikTok gives Pangolin only what the company authorized on the permission screen:
- Basic profile: the account identifier, name and profile picture, to show which account is connected;
- The access and refresh keys, to publish the approved piece, or send it to TikTok drafts when the person chooses to finish it there;
- The account options, checked before each post (who can view the post, whether comments are allowed), to show them to whoever publishes;
- The status of each post, to confirm it went out.
What Pangolin does NOT do with the TikTok account: it does not read messages, does not access followers or other people's videos, does not publish without action from whoever approved, and does not use one client company's data for another. The published piece is labeled as AI-generated content.
From the channel the client company connects, through YouTube
Pangolin uses YouTube API Services. The client company connects its channel through Google's official login, and Google gives Pangolin only what the company authorized on the permission screen:
- The channel: the identifier, name, handle (@) and channel picture, to show which channel is connected;
- The access and refresh keys, to upload the approved video to the channel, with the title, description, thumbnail and the choices of whoever publishes (visibility, whether the video is made for kids and whether it contains altered or synthetic content);
- The status of each uploaded video (processing and visibility), to confirm it went out.
What Pangolin does NOT do with the YouTube channel: it does not read comments, subscribers, history or other channels' videos, does not change or delete videos already on the channel, does not publish without action from whoever approved, and does not use one client company's data for another.
Pangolin's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. By connecting YouTube, the client company agrees to the YouTube Terms of Service, and Google handles its data under the Google Privacy Policy. To revoke Pangolin's access at any time, in addition to disconnecting the channel in Pangolin, use your Google Account permissions page: security.google.com/settings/security/permissions.
Sign-in data: the name and email of whoever signs in to Pangolin on behalf of the client company, the password (stored only as an irreversible code) and access logs (date, time, IP address), for security.
Cookies and browser storage: Pangolin uses a single cookie, the session cookie, which keeps the person signed in; the pangolin.media page stores in the browser only the chosen language. We do not use advertising or analytics cookies, and we do not allow third parties to place cookies or serve content or ads in Pangolin.
The pangolin.media waiting list: name, email, WhatsApp (if the person chooses to provide it) and the type of business they want to promote. Used only to announce Pangolin's launch and, if the person replies, to talk about using it. Not sold or shared, and not added to any other mailing list.
What we do not process: sensitive personal data (art. 5, II of the LGPD). Pangolin was not designed to receive third-party personal data in the text of a request, and we ask the client company not to include it.
4. Why we process data, and on what legal basis
| Purpose | Legal basis (LGPD) |
|---|---|
| Deliver the service to the client company: create the piece, record the approval and publish | Performance of a contract (art. 7, V) |
| Notify people on the waiting list about Pangolin's launch | Consent (art. 7, I), given when submitting the form, which says what the contact will be used for. It can be withdrawn at any time |
| Security, fraud and abuse prevention, and fixing system errors | Legitimate interest (art. 7, IX) |
5. Where data is kept, and who it is shared with
Pangolin is a single system, and each client company's data is kept separate from the others': every query is bound to the company of whoever has the session open, and one company cannot see another's data. The database and the server are in São Paulo, Brazil. The access keys to Meta, TikTok and YouTube accounts are encrypted, and the key that opens them is kept outside the database.
The artificial intelligence runs on our server, with ARXS accounts. The client company does not need an account with any AI provider.
We do not sell data. We share it only with those who process data on our behalf, to the minimum necessary:
| Who and where | What for | Receives |
|---|---|---|
| Neon — Brazil (São Paulo) | database | all service data |
| Amazon Web Services (AWS) — Brazil (São Paulo) | server where Pangolin runs | all service data, while processing |
| Cloudflare — United States (eastern North America) | stores files | the images of pieces and those the company sends with a request |
| Anthropic — United States | the language model that reads the request and writes the proposal | the request text, the change request and the brand profile |
| OpenAI — United States | the model that creates the image | the description of the image to create and the images the company sent as reference |
| Sentry (Functional Software) — United States | receives the system's error reports | the address of the screen or operation that failed and the system version, without the request content and without identifying the person; kept for 30 days |
| Meta Platforms | the platform where the client company publishes | the approved piece and caption |
| TikTok | the platform where the client company publishes | the approved piece, title and caption |
| Google (YouTube) | the platform where the client company publishes | the approved video, title, description, thumbnail and the choices of whoever publishes |
Anthropic and OpenAI do not use this content to train their models, under the terms ARXS has with each.
For the waiting list only: Cloudflare hosts the pangolin.media page and receives the form; Resend delivers each sign-up to ARXS by email; and Google (Google Workspace) is the ARXS mailbox where sign-ups are kept. The waiting list is not stored in a database: each sign-up arrives as an email in the ARXS contact mailbox, where it is kept and deleted.
International transfer: providers based in the United States process data outside Brazil. In these cases, we adopt the safeguards required by arts. 33 to 36 of the LGPD.
6. Security
We adopt technical and administrative measures to protect data (art. 46): encryption in transit, separation between client companies in every query, encrypted access keys, passwords stored only as irreversible codes, system logs without personal data, and a person's approval before any publication. In case of a security incident with relevant risk, we will notify the client company, affected data subjects and the ANPD (Brazil's data protection authority), as required by art. 48.
7. How long we keep data
- While the client company uses Pangolin, its account data is kept.
- When the client company disconnects an account (in Pangolin, by removing the app in Meta, TikTok or Google settings, or by asking us), access is revoked immediately, and the data that came from that account is deleted within 30 days.
- On YouTube, the period is shorter when the channel is disconnected through Pangolin: the data that came from it is deleted within 7 days. If access is revoked through the Google permissions page, within 30 days. The stored channel name and picture are refreshed, or deleted, every 30 days.
- The images the company sends with a request are kept while it uses Pangolin, and deleted with its other data.
- When the contract or the pilot ends, the client company's data is returned to it, if it asks, and then deleted within 30 days.
- Waiting list: until the launch notice and, at most, 12 months after sign-up. Before that, if the person asks to leave, the sign-up is deleted within 15 days.
- Only what the law requires us to keep remains (for example, tax records), for the legal period and with no other use.
8. Your rights
The LGPD (art. 18) guarantees: confirmation and access; correction; anonymization, blocking or deletion; portability; information about who we share data with; withdrawal of consent; and objection to processing based on legitimate interest.
If your data reached Pangolin through a client company (for example, if your name appears in one of its pieces), the request should go to that company, which is the controller — and we help it comply. In any case, you can write to dpo@arxs.com.br: we reply within 15 days.
To leave the waiting list, just reply to any message from us asking to, or write to dpo@arxs.com.br.
How to request deletion of your data: pangolin.media/data-deletion.
9. Children and teenagers
Pangolin Media Lab is a service for businesses and is not intended for anyone under 18.
10. Changes to this policy
Relevant changes are communicated to client companies before they take effect. The date of the last update and the version are at the top.
11. Contact
ARXS LAB LTDA — CNPJ 68.114.066/0001-46 R. Afeganistão, 107 — Jardim Solange, São Paulo/SP, CEP 04948-010, Brazil Data Protection Officer (DPO): dpo@arxs.com.br