Social Studio Privacy Policy

1. Who we are and our roles

Social Studio is operated by Catraca Logística e Intermediações Ltda., CNPJ (Brazilian company registry) 43.734.394/0001-14, Rua do Contorno, 6278, Planalto, Taiobeiras/MG, CEP 39550-000, Brazil (“Catraca”, “we”).

For the account owner's data (sign-up and connection), Catraca is the data controller. For the data of people who comment on or message the account, the controller is the business that owns the account and Catraca is the processor: we handle that data only to provide the service.

2. Data we receive from Instagram when an account is connected

We never receive or store the Instagram password.

• the account identifier and username;
• the access token issued by Instagram, stored encrypted;
• the list of permissions granted;
• the connection and renewal dates.

3. Data of people who interact with the account

If automatic replies are turned on, each reply that is triggered also stores the username, the person's identifier and the text of the comment that triggered it.

• the identifier and username of whoever commented or sent a message;
• the text of the comment or message;
• the post where the comment was made;
• date and time;
• the content of the notification as Meta sends it, kept for the same period.

4. Performance numbers

Reach, saves, shares, likes, comments and views per post, as totals, without identifying people.

5. What we use the data for

To publish what the account owner approved, to reply to people who wrote to the account and to show results to the account owner.

We do not sell data, do not use it for advertising, do not build profiles of people and do not use it to train models.

6. How long we keep the data

Disconnecting the account deletes the access token immediately, but does not immediately delete the history of comments and messages already received: that history is removed within 90 days. Any data can be deleted earlier on request (sections 9 and 10).

• received comments and messages, with Meta's notification: 90 days;
• access token and connection data: until the owner disconnects the account, when they are deleted immediately;
• posts and performance numbers: for as long as the contract with the account owner lasts.

7. Who we share data with

Meta, because it is through Meta that we publish and reply, and our hosting provider. No one else.

8. How we protect the data

• access token stored encrypted;
• access per person and per account;
• message text kept out of technical logs.

9. Your rights and contact

You can ask for access, correction and deletion of your data by writing to our data protection officer (Brazilian LGPD, art. 41): [email protected]. We reply within 15 days.

A request about a comment or message is forwarded to the business that owns the account, which is the controller of that data.

10. How to ask for data deletion

The full step by step is at catraca.co/studio/exclusao-de-dados.

Summary: the account owner disconnects the account in Studio and the access token is deleted immediately; received comments and messages are removed within 90 days. Anyone who commented or sent a message, or an owner who wants everything deleted sooner, asks by email to the data protection officer.