Privacy Policy · Keryxion

1. About this policy

Keryxion is the automation application operated by MLU Dev, available at flow.mludev.com.br. This policy explains how data is processed when you use the service and connect external platform accounts.

MLU Dev is responsible for processing registration data and operating the service. When an organization configures automations using third-party data in its workspace, that organization is also responsible for defining the purpose and legal basis of that use; MLU Dev processes the data to carry out the requested configurations.

For privacy questions or to exercise your rights, contact contact@mludev.com.br.

2. Data processed

Depending on the features used and the permissions granted, the service may process:

• Registration and account data: name, email, authentication credentials, user identification and workspace membership.
• Integration data: account identifiers, profile names, metadata, granted permissions and access or refresh tokens. Private Discord webhook URLs are also credentials.
• Instagram/Meta: messages, comments and mentions received through the authorized API, profile identifiers and usernames, captions, post links, dates and available metrics. Availability depends on Meta permissions and limitations.
• Google: authorized account identification and spreadsheet metadata for selection. Automations send or update values in spreadsheets selected by the user.
• Discord: identification of the connected channel or webhook and configured alert content, including links to moderation actions.
• Configuration and operations: automation rules, field mappings, execution history, step results and technical error and security logs.

3. Purposes and legal bases

We use data to authenticate users, administer workspaces, connect authorized services, run automations, record results, provide support and protect service operations.

Depending on the context, processing is based on performance of a contract or procedures requested by the user, compliance with legal obligations, legitimate interests in security and operations subject to data subject rights, or consent where necessary. OAuth authorization does not replace the user’s obligation to have a legal basis for processing third-party data.

Data received from APIs is used for the requested integration and automation features. Users should limit content and permissions to what is necessary for their purpose.

4. Sharing and external services

An automation may transmit fields you configure to a Google spreadsheet or a Discord channel. Review mappings and who has access to those destinations before activating it.

Data may also be processed by infrastructure providers needed for hosting, storage, communications and service operations, and disclosed when required by a legal obligation or an order from a competent authority.

Meta, Google and Discord process data under their own policies. Those services and the infrastructure involved may operate outside Brazil; where applicable, transfers must comply with the safeguards required by data protection legislation.

The use and transfer of information received from Google APIs must comply with the Google API Services User Data Policy, including the Limited Use requirements.

5. Storage and security

Automation data is associated with the relevant workspace, with access controls based on user and role. Integration tokens and webhook credentials are stored encrypted in the API and are not returned in connection listings.

Execution histories may contain data processed by automations. Avoid sending sensitive information unnecessarily and protect access to connected accounts.

No system is entirely immune to incidents. If you suspect unauthorized access, revoke the integration with the provider, secure your account and notify MLU Dev through the contact channel.

6. Retention and deletion

Data is retained for as long as necessary to provide the account, integrations, automations and their history, handle requests, protect the service or comply with legal obligations. Retention needs are assessed according to the data category and purpose.

Disconnecting an integration removes the connection stored in the workspace, but does not automatically delete execution history or data already sent to Google Sheets or Discord.

You may request deletion of data or your account using the procedure on the Data Deletion Instructions page. Records that must be retained by law will be limited to the applicable purpose; backups follow the infrastructure replacement cycle.

7. Your rights

Under applicable law, including Brazil’s LGPD, you may request confirmation of processing, access, correction, information about sharing, anonymization, blocking or deletion of unlawfully processed data, portability where applicable and withdrawal of consent. Send your request to contact@mludev.com.br.

We may request proportionate information to confirm your identity and connection to the data, preventing third parties from improperly accessing or deleting information. Requests are assessed according to the rights, deadlines and exceptions provided by law.

8. Browser storage and updates

The interface uses browser local storage to maintain the authentication session, workspace selection and language preference. Signing out removes the session information used by the interface; you can also clear site data in your browser settings.

This policy may be updated to reflect changes to the service or legislation. The update date is shown on this page. Changes requiring new authorization will be handled under applicable law.

9. Google APIs and Limited Use requirements

Keryxion, operated by MLU Dev, uses Google permissions exclusively for integration features requested by the user. The spreadsheets scope allows creating, reading and updating spreadsheets; automations access only documents selected or configured by the user. The drive.metadata.readonly scope lists metadata of spreadsheets accessible to the account for the selector, without reading the contents of other Drive files. The openid, email and profile scopes identify the connected account.

Google user data is not sold, used for third-party advertising or used to train artificial intelligence or machine learning models. It is not shared with third parties for independent purposes. Transfers are limited to what is necessary to provide the requested feature, necessary service providers under data protection obligations, security or legal obligations permitted by Google policy. Human access is limited to permitted exceptions, such as explicit consent for support, security or legal obligations.

Keryxion’s use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements. These restrictions also apply to data derived from that information.

OAuth access and refresh tokens are stored encrypted in the backend, isolated by workspace and used only for authorized operations, including listing spreadsheets in the selector and executing tasks configured by the owner. OAuth authorization does not make your documents public.

You can revoke access at any time at https://myaccount.google.com/permissions and disconnect the integration on Keryxion’s Connections page. To request complete deletion of your data, connection records, tokens and related histories, email contact@mludev.com.br. Revocation does not automatically delete previously stored or exported data; requests are verified and handled subject to applicable law, third-party rights and legal retention requirements.

Where applicable, you may exercise rights under the LGPD and GDPR, including access, correction, deletion, restriction, objection, portability and withdrawal of consent, and lodge a complaint with the competent data protection authority. The contact for the controller MLU Dev is contact@mludev.com.br.

10. LGPD requests and privacy contact

MLU Dev privacy and support contact is contact@mludev.com.br. State the right requested and minimum information needed to locate the account or processing; never send passwords, tokens or unnecessary complete documents. Identity and representation may be proportionately verified. Confirmation and access follow legal forms and deadlines, including a complete statement within 15 days where applicable; other requests follow applicable deadlines and exceptions. If a request cannot be fulfilled, we explain the grounds. You may petition the ANPD and consumer protection bodies.

11. Automated decisions and workspace responsibilities

Workspace administrators define conditions and actions that can classify mentions and transmit data to external destinations. We do not use this mechanism for credit scoring or advertising profiles. If an exclusively automated decision affects your interests, request review and information on criteria and procedures from the privacy contact, subject to trade secrets. The organization defining automation purposes must establish its legal basis and assist data subjects; we can assist within our role.

12. Minimization, incidents and international transfers

Configure only necessary fields and permissions. The product is not designed to collect sensitive or children data for automations; do not send it without need, a legal basis and adequate safeguards. OAuth and cookie acceptance are not blanket consent for all processing. Incidents that may create relevant risk or harm will be notified to the controller, ANPD and affected subjects under applicable law and deadlines. International transfers must observe LGPD and ANPD mechanisms; information about recipients and safeguards may be requested from the privacy contact.

13. History, permanent cleanup and consent

Denied, pause and archive retain operational history. Permanent panel deletion removes the collab, steps and audit from the active database, not exported Sheets or Discord copies. Linked diagnostics are cleaned; operational logs and backups may remain according to retention cycles and legal duties and are not instantly deleted by the panel. Request account or other category deletion from the privacy contact. Cookie preferences are recorded for 180 days and can be reviewed through Cookie preferences; no optional trackers are installed. Consent withdrawal does not invalidate prior lawful processing or legally necessary retention.