PostatoVersão em português

Privacy Policy

Last updated: October 16, 2026

This policy explains which personal data Postato processes, what it is used for, on which legal basis, who it is shared with, how long it is kept and how you can exercise your rights. It applies to people who use Postato (creators, agencies and their teams), to people who comment on or message an account that uses Postato, and to people who join the waitlist. The Portuguese version is the reference; this is a translation.

1. Who the controller is

Postato is operated by 89DEV INFORMATICA LTDA, a Brazilian company, CNPJ (Brazilian tax ID) 26.220.882/0001-94, with mailing address at Rua Homero Sales, 722, Parque São Domingos, São Paulo, SP, CEP 05126-000, Brazil. It is the controller of the personal data processed in Postato.

2. Data protection officer and privacy channel

Data protection officer (encarregado, LGPD art. 41): Luciano Souza, by e-mail at privacidade@postato.com.br. Use it for any request or question about your data. For anything else, the general contact is contato@postato.com.br.

3. What Postato does

Postato is a panel for creators and teams to read and answer, in one place, the comments and direct messages (DMs) of their own Instagram professional accounts and, when connected, the comments on the videos of their TikTok account. To do that, Postato:

  • classifies every comment and message with artificial intelligence (for example question, compliment, criticism, partnership, abuse or spam) and routes it by the rule the creator chose for that type: wait for a reply, suggest an emoji, ignore or hide. A comment is only hidden automatically on Instagram or TikTok after the creator confirms the hide rule for that type, and it can be shown again at any time;
  • writes reply drafts with artificial intelligence, in the creator's own voice, from the replies they already wrote, the voice guide they review and the facts they confirm. Nothing is sent without the creator or the team, except the automations they turn on;
  • sends automatic replies that the creator sets up and turns on: a public reply and a private message to people who comment a keyword on a post, a message to people who send a keyword by DM, reply to a story or mention the account in a story, a welcome message on the first DM, and an out-of-hours notice to people who send a DM while the account is closed;
  • reads the context of posts: the text in post images and a transcript of the audio of videos, so that drafts know what the post is about;
  • reads the creator's documents and website, when they upload a document or give the address of their site, to suggest facts for their fact sheet (the site is read again every week);
  • organizes people: it keeps the history of each person who talks to the account, the promises the creator made to them, the team's notes and groups, and computes indicators about the relationship (see section 6);
  • shows account and post metrics and groups the topics the audience asks about most;
  • supports teamwork: members with roles, access by profile, reply approval, internal notes and an activity log.

4. Which data we process

From people who use Postato. When you sign in with Google: name, e-mail and photo. When you sign in with e-mail and password: the e-mail and an irreversible code (hash) of the password, never the password itself. When you sign in with the magic link: the e-mail. We also keep the photo you upload, the workspaces and profiles you create, invitations and members (e-mail and role), your settings, plan requests and the team's activity log (who did what and when).

From connected accounts. Only from the accounts the user connects, after they grant permission:

  • Instagram: account id, username, name and photo; posts and their metrics; comments and replies on posts; mentions of the account; direct messages, story replies and story mentions, and reactions to messages;
  • TikTok, when connected: account profile, videos and their metrics, and comments;
  • the access tokens of these accounts, stored encrypted.

From people who comment on or message an account that uses Postato. Their username and id on the platform, what they wrote and when, and, when the platform provides it, name, photo, whether they follow or are followed by the account, follower count and whether the profile is verified. From this, Postato generates: the type of each message, the promises made to the person, suggested attributes the person said about themselves (for example their city), relationship strength and how well the creator knows the person. The team may add notes, groups, a nickname and a photo. Suggested attributes never include health, religion, politics, sex life, money, documents or contact details, and only count once someone on the team confirms them.

Profile enrichment. In workspaces where this feature is on, Postato asks ScrapeCreators for the public name and photo of the Instagram profile of people who commented and do not have a name in Postato yet. It is at most one lookup per person every 30 days, and the name and photo are read again after that period.

Posts shared by DM. When someone shares a public post or Reel in a DM, Postato asks ScrapeCreators once to show its preview (image and caption) and keeps a copy of the image.

The creator's documents and website. The text of the documents the creator uploads and of the pages of the site they give, to extract facts about them and their work.

Waitlist. See section 13.

Technical data. Server logs and logs of the calls to artificial intelligence providers (when, which task, how many tokens and the cost), and the raw deliveries Instagram and TikTok send to Postato (webhooks).

5. What we use the data for, and on which legal basis

  • Providing the service to people who use Postato: sign-in, panel, inbox, classification, drafts, sending replies, automations, hide rules, team features, metrics and service e-mails (sign-in link, invitations, reading finished, summaries and notices). Legal basis: performance of a contract (LGPD, art. 7, V).
  • Processing the data of people who comment or send messages to organize and answer the account's conversations, including with automations and classification. Legal basis: the legitimate interest of the creator and of Postato in relating to people who reached out to the account (art. 7, IX), limited to what the person sent to the account and what the platform provides.
  • Building each person's profile (relationship strength, how well you know them, suggested attributes and name and photo enrichment). Legal basis: legitimate interest (art. 7, IX). The person can object and ask for deletion (section 12).
  • Waitlist: telling you when we open. Legal basis: consent (art. 7, I), which you can withdraw at any time.
  • Security, abuse prevention and cost control (for example limits per IP address, the activity log and the log of calls to artificial intelligence providers). Legal basis: legitimate interest (art. 7, IX).
  • Complying with legal and regulatory obligations, such as keeping the access logs required by the Brazilian Internet Civil Framework (Marco Civil da Internet) and tax and billing records. Legal basis: compliance with a legal obligation (art. 7, II).
  • Exercising rights in judicial, administrative or arbitration proceedings. Legal basis: art. 7, VI.

We do not sell personal data and do not use it for advertising. We do not use the data to train artificial intelligence models.

6. Automated decisions and profiles

Postato carries out three automated processes you should know about:

  • Classification and hiding by rule. Artificial intelligence reads each comment and message and says which type it is. If the creator confirmed the hide rule for that type (abuse, bullying and spam are suggested by default), the comment is hidden on the platform. Everything hidden goes to the panel's Moderation queue, where the creator reviews it and shows it again with one click. The team can also correct the type.
  • Relationship strength. A score from 0 to 100 per person, computed from how often and how recently they interacted with the account (DMs, story replies, mentions, comments) and from the promises made to them. It tells the creator who they are closest to.
  • How well you know them. A count of seven items per person (name, photo, whether they follow the account, an attribute, a note, a DM and a group), each counted only from what the person said or what the team confirmed.

These indicators are not used for any decision about the person outside the creator's panel, are not shared with third parties and never move from one workspace to another. Anyone affected by an automated decision can ask for it to be reviewed (LGPD, art. 20) at privacidade@postato.com.br.

7. Who we share data with

To run the service, we rely on these providers (subprocessors), which process data on our behalf and only for the task shown:

  • Hostinger: the server that holds the database, the task queue and the applications, in São Paulo, Brazil;
  • Cloudflare (R2): storage of images (profile photos, people's photos, copies of post images, of photos, stickers and GIFs received by DM and of previews of posts shared by DM) and of the database backups;
  • Resend: sending the service's e-mails;
  • Anthropic: the artificial intelligence of reply drafts, the voice guide, fact suggestions (including from the creator's documents and website), reading the context of posts (the text in images) and grouping topics. It receives the text of comments and messages, the voice guide, the creator's facts, post images and the text of documents and site pages, depending on the task;
  • OpenAI: only the transcription of the audio of videos;
  • TypeSafe: classification of comments and messages, for which it receives their text;
  • ScrapeCreators: lookup of public profile data (name and photo) and of the public preview of posts and Reels shared by DM (section 4);
  • Meta (Instagram): the platform of the connected account, where comments and messages come from and which receives the replies, messages and hide actions Postato sends on behalf of the account, under its rules;
  • TikTok, when the account is connected: the same, for the comments on videos;
  • Google: only sign-in with a Google account, for people who choose it.

We use no other artificial intelligence providers. This list of subprocessors is kept current on this page. We may also share data when the law or an order of an authority requires it.

8. International transfer

Cloudflare, Resend, Anthropic, OpenAI, TypeSafe, ScrapeCreators, Meta, TikTok and Google process data outside Brazil, mainly in the United States. These transfers are made with the safeguards of art. 33 of the LGPD, such as these providers' data protection contractual clauses, and only for the purposes of this policy.

9. How long we keep data

  • While the workspace is active (on the trial or on a plan), the data is kept.
  • 7-day trial ended without a plan, or plan cancelled at the end of the paid period: the panel is read-only for 30 days. We warn by e-mail 7 days and 1 day before the deletion. After that, the workspace's data is deleted.
  • Workspace deleted by its owner: it disappears from the panel right away, its accounts are disconnected and the data is deleted for good after 30 days, images included.
  • User account deleted: name, e-mail, photo, sessions and sign-in methods are deleted right away; the remaining record is deleted after 30 days. Workspaces where the person was the only member are deleted with it.
  • Deletion request sent by Meta (when you remove Postato from Instagram's settings): the data of that Instagram account is deleted as soon as the request is processed.
  • Account disconnected in the panel: Postato stops accessing the account and deletes its tokens. What was already read stays in the workspace until the workspace is deleted or a deletion request is made.
  • Raw platform deliveries (webhooks): their content is deleted 30 days after processing. Team activity log: 90 days.
  • So that the free trial is used only once per Instagram account, we keep an irreversible code (hash) of the account id, even after deletion.
  • We make daily backups of the database, kept for up to 30 days in Cloudflare storage (R2). Deleted data leaves the backups when they expire.
  • Data the law requires us to keep stays for the legal period (for example, access logs for 6 months and tax records for the period of tax law).

10. How to delete your data

  • In the panel: in Settings, the owner can delete the workspace, and each person can delete their own account.
  • On Instagram: remove Postato from the list of connected apps. Meta sends us a deletion request, which deletes the data of that account.
  • By e-mail: write to privacidade@postato.com.br.

The step by step is on the Data deletion page.

11. Your rights

The LGPD (Brazilian Law 13,709/2018, art. 18) gives you, among others, the rights to: confirm that we process your data and access it; correct incomplete, inaccurate or outdated data; ask for anonymization, blocking or deletion of unnecessary data or data processed unlawfully; ask for portability; ask for deletion of data processed with consent; know who we share it with; withdraw consent; object to processing based on legitimate interest; and ask for automated decisions to be reviewed.

To exercise any of them, write to privacidade@postato.com.br. We may ask for information to confirm the request is yours. We answer within 15 days. You can also complain to the Brazilian National Data Protection Authority (ANPD).

12. If you commented on or messaged an account that uses Postato

Postato keeps what you sent to that account and the profile described above, only inside the workspace of the creator who uses Postato. To object to the profile or ask for your data to be deleted, write to privacidade@postato.com.br with your username and the account you talked to. We delete your data from that workspace, or from all of them if you ask, and confirm by e-mail. What you wrote stays on the platform (Instagram or TikTok) under its own rules.

13. Waitlist

While Postato is not open to everyone, the site has a waitlist form. We keep your e-mail, your Instagram @ (optional), the profile type you chose (creator, team or agency), the language and page you sent it from, and the date.

  • What for: only to tell you when Postato opens and to know what kind of profile is waiting. We send no other e-mails and do not share the list.
  • Legal basis: your consent, when you send the form.
  • How long: until we tell you we have opened; after that notice, the list is deleted within 90 days.
  • How to leave: write to privacidade@postato.com.br asking to leave the list, and your entry is deleted.

14. Security

The tokens of connected accounts are stored encrypted, passwords only as an irreversible code (hash), images are kept in private storage served only to people with access to the profile, and each team member sees only the profiles they were given. When a password is created or changed, we check whether it appears in known breaches with the Have I Been Pwned service, which receives only the first 5 characters of an irreversible code of the password, never the password or the e-mail. No measure is infallible: if an incident happens that may put you at risk, we will tell you and the ANPD, as the law requires.

15. Cookies

The site uses no analytics or advertising cookies. The panel uses session cookies, needed to keep you signed in.

16. Changes to this policy

If this policy changes, the new version will be published on this page, with the update date at the top. Relevant changes will also be announced in the panel or by e-mail.