Datapex
privacy policy.

Part 1

This website

Preparing the message

The contact fields help organize a message on the page itself. They are not sent automatically, saved by the site in local storage or included in the URL.

The copy button uses your device's clipboard. The email link opens your email application with the recipient's address; you paste the text, review it and decide whether to send it.

Sending by email

Once you send it through your email application, the content reaches Datapex and the email services involved. Use this channel to describe your needs and to request clarification about how the information you provide is handled.

Browsing

This version does not include advertising or analytics tools. Fonts and images are served by the site itself. The hosting infrastructure may log technical access information for operations and security; this page does not claim that such logs do not exist.

Demonstration

The public demo uses a fictional dataset generated by a program. It contains no real customer data.

Analysis settings are not saved. Reloading the page returns it to its starting point.

Confidential information

Do not send credentials, datasets or confidential documents in your first contact. If the project requires access to this information, the conditions must be discussed beforehand.

Part 2

Estúdio MKT and the Instagram and Facebook integration

Estúdio MKT (mkt.datapexbi.com.br) is Datapex's AI-powered marketing platform. With it, a brand creates social media content, plans its content calendar, publishes on Instagram and tracks how its posts perform. Nothing is published without a person's approval.

Who this part applies to

• Client brands (Estúdio's customers) and the members of their teams who use Estúdio;
• anyone who connects an Instagram or Facebook account to Estúdio through Meta login;
• anyone who interacts with a client brand's account on Instagram (by commenting or sending a message), when customer messaging is turned on for that brand.

For Estúdio usage data (team registration and access logs), Datapex is the controller. For the content of each brand's account and for the messages and comments of the people who interact with it, the brand decides what is done with that data and Datapex processes it on the brand's behalf, as a processor (under the LGPD — Lei Geral de Proteção de Dados Pessoais, Brazil's General Data Protection Law, Law No. 13.709/2018).

What data we receive from Meta

Only with the permission granted at Meta login, and only from the professional account the brand has connected:

• Account: the ID of the Instagram professional account and of the Facebook Page linked to it, the username (@), the follower count and the list of permissions granted. The access token is stored encrypted and never appears on screen.
• Media: the account's posts (ID, type, caption, publication date and link) and the posts Estúdio itself publishes at the brand's request.
• Metrics: figures for each post (reach, views, likes, comments, saves, shares, profile visits, new followers and average Reels watch time) and daily account figures (reach, interactions, followers gained and lost). For the audience, only aggregated figures (age range, gender, city and the times when followers are online), never data about any individual.
• Messages and comments, only when the brand turns on customer messaging: the text of the direct messages and comments received, the identifier Instagram assigns to the sender, and their @ and public name. Images, videos or audio received in messages are not stored; we keep only a record that an attachment arrived and of its type.

We do not receive the Instagram or Facebook password or the contact list, nor messages from accounts that are not connected to Estúdio.

Other Estúdio data

• Team members who use Estúdio: name, email, access profile, the brands they are authorized for, and the password, stored only as a cryptographic hash (scrypt), never in plain text. We log when each person signs in and out (date, time, IP address and browser) and who approved, published or edited each piece of content, for security and auditing.
• Material provided by the brand: videos, photos, audio, text and references used to create content. This material may show people; the brand is responsible for holding authorization to use the image of anyone who appears in it.
• Cookies: only the session cookie, which is required to sign in, and the view preference for the content list. No advertising and no third-party measurement.

What we use it for

Purpose	Legal basis (LGPD)
Creating, approving, scheduling and publishing the brand's content on Instagram	Performance of the contract with the brand (Art. 7, V)
Measuring post performance and suggesting topics and posting times based on the figures	Performance of the contract (Art. 7, V) and the brand's legitimate interest (Art. 7, IX)
When turned on: organizing messages and comments and suggesting replies, which a person from the brand approves before they are sent	Performance of the contract with the brand (Art. 7, V) and legitimate interest (Art. 7, IX)
Security, access logging and auditing of who performed each action	Compliance with a legal obligation (Art. 7, II; Art. 15 of the Marco Civil da Internet, the Brazilian Internet Act) and legitimate interest (Art. 7, IX)

Health-related matters in messages (sensitive personal data, LGPD Art. 11) never receive an automatic reply: they are routed to a person at the brand. We do not make automated decisions that affect anyone's rights; whatever the artificial intelligence suggests is reviewed by a person.

Who we share it with

Only with the providers needed for the service to work, and only what each of them needs to do its part:

Provider	Purpose	Location
Meta Platforms (Instagram and Facebook)	Publishing and scheduling posts, reading post and account figures and, when customer messaging is turned on, receiving and replying to messages and comments	Outside Brazil
Anthropic (Claude)	Writing topics, scripts, captions and the design of content pieces; when customer messaging is turned on, suggesting replies to messages and comments	Outside Brazil
Google (Gemini)	Generating images and voice-over narration for content	Outside Brazil
Groq	Transcribing speech in uploaded videos, for cuts and captions	Outside Brazil
ElevenLabs	Voice-over narration for content, when chosen instead of Google's	Outside Brazil
Server hosting	Storing Estúdio's database and files	Hostinger, with servers in Brazil

Artificial intelligence providers receive the text and files of each request in order to return the result, under their commercial terms for business use. International data transfers follow LGPD Art. 33, based on standard contractual clauses (Resolução CD/ANPD nº 19/2024, issued by the ANPD — Autoridade Nacional de Proteção de Dados, the Brazilian data protection authority) and on the other safeguards set out in each provider's terms for business use. We may also disclose data to authorities when required by law or by a court order.

Where we store it and how we protect it

Data is kept in the database and in the file storage of Estúdio's server. The Meta token is stored encrypted (AES-256-GCM), passwords only as cryptographic hashes, and each team member signs in with their own email and can only open the modules and brands they are authorized for. The connection to Estúdio is always encrypted (HTTPS).

How long we keep it

Data	Retention period
Connected account and Meta token	While the account remains connected. Disconnecting it in Estúdio deletes the token immediately.
Post media and metrics	For the duration of the contract with the brand, or until the brand requests deletion
Messages and comments (when customer messaging is turned on)	5 years, to handle requests and for the possible defense of rights (the period set in Art. 27 of the Código de Defesa do Consumidor, the Brazilian Consumer Protection Code), or until the person or the brand requests deletion. The raw technical log sent by Meta is deleted within 14 days.
Images, videos or audio received in messages	Not stored
Estúdio access logs	12 months (the Marco Civil da Internet requires at least 6 months)
Team registration	While the person has access. After that, the registration is deactivated and kept only to account for the history of who approved or published content; on request, it is anonymized.

How to remove Estúdio's access to your account

In your Facebook settings, under Business integrations (or Apps and websites), select the Estúdio app and remove it. Access to the Instagram account comes through that same Facebook login: once access is removed there, Estúdio can no longer reach the account. The brand can also disconnect the account in Estúdio, on the Instagram screen. To delete what has already been stored, see Data deletion.

Children and adolescents

Estúdio is a tool for businesses and is not intended for anyone under 18. If a message or comment from a child or adolescent reaches a client brand, it is handled in the child's or adolescent's best interest (LGPD Art. 14) and may be deleted at the request of their parents or legal guardians.

Part 3

Other Datapex applications

Datapex also operates business intelligence applications contracted by companies, such as BRI and Radar, which are used by the client company's team with an individual username and password for each person.

• Who decides: the business data the client company brings into the application belongs to the client; Datapex processes it on the client's behalf, under the terms of the contract: in this role, Datapex acts as the processor and the client company as the controller.
• Data about users: name, email, access profile, the password stored only as a cryptographic hash, and the log of sign-ins and sign-outs (date, time and IP address), for security.
• Business data processed in each application: the business intelligence applications organize the client company's management data (for example, finance, sales, operations, hours and staff) into dashboards and reports to support its decisions; Radar tracks the use of these applications (logins, screens opened and time of use), for service management and security. We keep this data for the duration of the contract and for the period agreed with each client to preserve the history of its analyses.
• Providers: hosting by Hostinger, with servers in Brazil, and, depending on the project, the technology providers set out in the contract with each client. The same rules of this policy apply: no sale of data and no third-party advertising.

Part 4

Your rights, deletion and contact

Under the LGPD (Art. 18), you may request at any time: confirmation that we process your data and access to it; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary data or of data processed in breach of the law; portability; deletion of data processed on the basis of your consent and withdrawal of that consent; information about whom we share your data with; objection to processing; and review of decisions made solely by automated means (Art. 20).

To make a request, write to contato@datapexbi.com.br. We reply within 15 days (LGPD Art. 19). If your message or comment was sent to a client brand, you may also make the request directly to that brand. You may also file a complaint with the ANPD (Autoridade Nacional de Proteção de Dados, the Brazilian data protection authority).

Step-by-step instructions for requesting deletion are available at Data deletion.

Data Protection Officer

Data Protection Officer (encarregado, under the LGPD): contato@datapexbi.com.br, the communication channel with data subjects and with the ANPD

Controller: DATAPEX BI LTDA, CNPJ 63.533.838/0001-60, São Paulo/SP, Brazil.

Changes to this policy

When this policy changes, the date below changes with it. Material changes affecting the applications are communicated to client companies before they take effect.