Direct Português
Versão em português

Privacy Policy · Direct DispariX

Version {DDX_TERMOS_VERSAO} · Last updated {DATE}

Who we are

Direct DispariX is a web service that sends automatic replies to comments on the Instagram professional accounts of the businesses that use it. It is operated by {EMPRESA}, CNPJ {CNPJ}, {ENDERECO}, Brazil ("we"). On Instagram's connection screen, our app appears as "{NOME_APP_META}".

Data protection officer (Encarregado): {ENCARREGADO}, {EMAIL_PRIVACIDADE}.

Data about our customers

When a business owner connects an Instagram professional account with Business Login for Instagram, Instagram sends us: the account ID, the app-scoped user ID, username, name, profile picture, account type, the permissions granted and an access credential, which we store encrypted. We never see the Instagram password.

We also keep: the email address, if you give it; the devices signed in to the dashboard (a browser summary and a code derived from the IP address, never the IP address itself); your acceptance of these documents; the settings you create (automations, products, links and texts); and a record of actions in the dashboard, for security.

Data about people who comment

When someone comments on a post, reel or ad of a business that uses Direct DispariX, Instagram sends us that comment. We keep: the comment ID; a short excerpt of the text (up to 140 characters, with @mentions, phone numbers and email addresses removed) for 30 days; codes derived from the commenter's Instagram ID and username, which do not reveal them; the date; and what was done (card sent, public reply sent, ignored or not sent).

When someone taps a link in the card, we count the click with a device code that changes every day. We do not keep the IP address of the click.

What we use the data for

Only to: reply, on behalf of the business, to people who commented; show the business owner the history and the numbers; keep the service safe; bill our customers; and comply with the law.

We do not sell data, do not use it for advertising and do not build profiles. We do not publish, follow or like anything on your behalf.

Brazilian General Data Protection Law (LGPD). For our customers: performance of the contract (art. 7, V). For people who comment: we act on behalf of the business that owns the post, which answers a request the person made in public (art. 7, IX). {TEXTO_FINAL_ADVOGADO}

Who else processes data

How long we keep it

Security

Connections use HTTPS. The Instagram access credential is stored encrypted (AES-256-GCM). Each customer's data is isolated in the database. Our staff accesses the admin area only with password, a second factor and from approved networks.

Your rights

Under the LGPD you may ask for: confirmation and access, correction, deletion, portability, information about sharing, and withdrawal of consent. Customers can download their data in Privacy, inside the dashboard. Anyone can write to {EMAIL_PRIVACIDADE}. We answer within 15 days.

How to delete your data

See {BASE}/deletion. In short: remove our app in your Instagram settings, or remove the account in the dashboard (Accounts › Remove), or write to {EMAIL_PRIVACIDADE}. When Instagram tells us that you removed the app and asked for deletion, we delete the data of that account right away and give you a code to follow the request at {BASE}/exclusao/status.

People who commented: write to {EMAIL_PRIVACIDADE} with your @ and the link of the post.

Automated replies

Every card sent in Direct starts with "Resposta automática" (Portuguese for "Automated reply"). Replies go through the official Instagram API. If the person answers, the business owner continues the conversation in the Instagram app; our service sends no follow-up messages.

Other uses of the same Meta app

The same Meta app is also used by our team for: (a) an internal dashboard that reads advertising results of our own ad accounts; (b) automatic replies to comments and Direct messages received by Instagram accounts that our own team owns and operates. These uses follow this policy. Requests about them: {EMAIL_PRIVACIDADE}.

Dashboard cookies

The dashboard uses only necessary cookies: the session cookie (to keep you signed in, up to 30 days) and the sign-in security cookie. We do not use the Pixel, advertising or third-party tools in the dashboard.

Sales page: cookies and Pixel

The Direct DispariX sales page uses cookies and the Meta Pixel to measure our ads (visit, interest in the plans and click to the waiting list or to get started). You can decline in the notice on the page; declining applies from then on. The waiting list runs through the KS WhatsApp: what you tell us in the conversation (such as your @) stays in a KS sales spreadsheet for up to 6 months after the launch, and you can ask to leave it at any time.

International transfer

Some services (such as Meta and the email provider) may process data outside Brazil, with the safeguards provided for in the LGPD.

Changes

When this policy changes, the version above changes and the dashboard asks you to accept it again.

Contact

{EMAIL_PRIVACIDADE} · {SUPORTE_URL}