Privacy Policy

Data We Collect

We collect account email addresses and WhatsApp numbers for authentication and support, workspace and billing metadata, connected Instagram account identifiers, encrypted Instagram access tokens, campaign settings, webhook payloads, comments needed to process campaigns, delivery logs, and operational diagnostics.

For accounts that grant the direct message permission, we also process the direct message conversations of the connected account: the message text, the sender's Instagram-scoped ID and username, and the timestamp. We read this only for conversations the connected account is already part of. Message content is fetched from the Meta API when a screen is opened and is not stored in our database; what we keep is the derived lead record — the sender's Instagram-scoped ID and username, the conversation status, and the time of the last contact.

How We Use Data

We use this data to authenticate users, connect Instagram integrations, match comment keywords, send private replies through the official Meta APIs, prevent duplicate sends, troubleshoot failures, and protect the service.

Direct message data is used to show the connected account which of its own conversations are still unanswered, to rank them by how much of Meta's 24-hour messaging window remains, and to deliver the replies the account's own operator writes. We do not use message content for advertising, we do not sell it, and we do not combine it across customers.

Instagram And Meta Data

Comentou does not ask for Instagram passwords, scrape Instagram, or use browser automation. Instagram tokens are encrypted at rest and are used only to perform actions authorized by the connected business account.

Subprocessors

The hosted Comentou service runs on infrastructure provided by Vultr Holdings Corporation, which hosts the application servers, the PostgreSQL database, and the Redis queue where Platform Data is stored. We also use Stripe for subscription payments and Resend for transactional email. These providers process data only as needed to run the service and are not permitted to use it for their own purposes.

Retention And Deletion

An Instagram connection with no campaign or account history can be disconnected from Settings; this removes its stored access token and the otherwise empty connection. When persisted operational or commercial history exists, self-service disconnection is blocked so that opportunities, delivery records, attribution and follower history are not erased by accident. Customers can request verified deletion of that data through the Data Deletion page linked from the footer. Direct message content is read live from the Meta API when a screen is opened and is not stored in our database.

Contact

For privacy questions, data access requests, or deletion requests, contact us at bentoneto.com@gmail.com or on WhatsApp at +55 41 98896-9127. We answer within 5 business days.