SistemA+ Privacy Policy

The data we receive from Facebook, Instagram and WhatsApp

This is a translation. If it differs from the Portuguese version, the Portuguese version prevails.

This policy explains how Reproduzindo Talentos Marketing Ltda. (Brazilian company registration CNPJ 47.387.316/0001-41), a digital marketing agency, handles the data that the SistemA+ app receives from Meta's platforms (Facebook, Instagram and WhatsApp).

SistemA+ is the app that connects those platforms to our management platform, the hub (hub.reproduzindotalentos.online), used by the agency team and by the agency's client businesses. The rest of the service is covered by the platform Privacy Policy (in Portuguese), which this policy complements.

1. Who uses SistemA+

SistemA+ is built for businesses: the agency's clients, the people they authorize and the agency team. It is not meant for personal use or for children.

SistemA+ only accesses a business's Meta accounts when that business authorizes it: through Meta's login (Facebook Login for Business or Instagram Login) or by sharing the accounts with the agency's business portfolio. The business can withdraw that authorization at any time (see the data deletion page).

2. What data we receive

Only what the business authorized and what the contracted service needs:

• Ads: ad accounts, campaigns, ad sets and ads (names, settings, status and budget), performance and spend metrics, and the creatives.
• Connected Facebook Pages and Instagram profiles: name, ID, picture and follower count; the posts and their metrics; and audience metrics, always as totals that identify no one.
• Scheduled posts: the files and captions of the posts the team publishes on the business's account.
• WhatsApp Business (the official API): the business's accounts and phone numbers (with each number's quality rating and messaging limit) and the message templates (status and category). When the business sends messages through the platform, we also store each recipient's phone number, the content and status of each message (sent, delivered, read or failed), the replies and the opt-out requests.
• From the person who logs in: the name and ID of the account that authorized the app and the access token Meta issues to the app.

3. How we use it

• To show performance reports and dashboards to the client business and to the agency team.
• To create, edit, activate and pause campaigns at the business's request (the agency team does this).
• To publish on Instagram the posts prepared for the business.
• To send, on behalf of the business, WhatsApp template messages approved by Meta to the business's own contacts, and to show the replies to the business's team.
• To answer, through the agency's artificial intelligence assistant, questions from the team and from clients about ad results.
• To keep the service secure, provide support and keep an audit log.

We do not sell this data. We do not use it for our own advertising or to build profiles of people, and we do not share it with other companies beyond the service providers in section 5.

4. WhatsApp: consent and opt-out

• The client business decides to send a message. Under Brazil's data protection law (LGPD) it is the controller of its contacts' data, and Reproduzindo Talentos runs the sending on its behalf.
• Messages go only to people who gave their number to the business and agreed to receive its messages. The platform records who confirmed that consent and when.
• Anyone who replies "parar" or "sair" ("stop" in Portuguese), or uses WhatsApp's own option to stop receiving the business's messages, is left out of that business's later sends.

5. Who we share it with

With the service providers that make the service work, each one with the minimum it needs:

• Hetzner Online GmbH: the servers and the database, in Finland, and the backups, in Germany.
• Cloudflare, Inc.: the network and the servers where the hub runs and where Meta's webhooks arrive.
• OpenAI: processes the text of the questions and the metrics the artificial intelligence assistant needs to answer.

Data also goes back to Meta itself when, at the business's request, we publish, send a message or report a conversion. It may be disclosed to an authority when the law or a court order requires it.

6. International transfer

The servers and the database are in Finland and the backups in Germany, both in the European Union. Traffic goes through Cloudflare's network, which operates in many countries, and OpenAI processes in the United States. These transfers are needed to provide the service and are made under Brazil's General Data Protection Law (LGPD).

7. How long we keep it

• While the business is a client of the agency, the data is kept to preserve the history of reports and conversations.
• Disconnecting an account (in the hub or at Meta) stops access to new data but does not by itself delete what was already stored. To delete it, follow the data deletion page.
• Backups are made daily and kept for up to 14 days. Deleted data leaves them when that cycle completes.
• Access and security logs may be kept longer when the law requires it.

8. Security

Connections are encrypted (HTTPS). Access to the data is restricted by role and by project, and only the agency's authorized technical team can access the infrastructure and the database. Access tokens and technical credentials have specific protections, and important actions are logged.

9. Your rights

The LGPD guarantees, among others, the rights to confirm whether we process your data, to access it, to correct it and to request its deletion.

If you are a contact of a client business (for example, you received a WhatsApp message from it), that business is responsible for your data. You can contact the business or us: we forward the request and help fulfil it. To request deletion, see the data deletion page.

10. Contact

Questions about this policy or your data: contact the Data Protection Officer of Reproduzindo Talentos.

11. Changes to this policy

When the service changes, this policy may be updated. The date at the top shows the version in force, and relevant changes are announced to client businesses.