This Privacy Policy explains how Createfy (“Createfy”, “we”), available at https://createfy.app, collects, uses, shares, stores, protects and deletes information when providing its platform for creating and publishing social media content. We process your personal data in compliance with Brazil’s General Data Protection Law (Law No. 13,709/2018 — “LGPD”) and, with respect to data received from Meta (Instagram and Facebook), with the Meta Platform Terms and the Developer Policies.
By creating an account or connecting a social account, you acknowledge that you have read and understood this Policy.
1. Who is the data controller
The controller responsible for processing personal data is Createfy [RAZÃO SOCIAL], registered under CNPJ (Brazilian company registration number) No. [CNPJ], located at [ENDEREÇO]. For any matter related to privacy, data protection or deletion of information, contact our Data Protection Officer (DPO) at privacidade@createfy.app.
2. Data we collect
a) Data you provide to us. When you sign up and use the platform: name, email, phone number (when provided), login credentials, workspace/brand data and the content you create or upload (texts, images, captions, schedules).
b) Data from the social accounts you connect (Instagram and Facebook, via Meta’s APIs). When you connect an Instagram (professional) account and/or a Facebook Page, we access, with your authorization and within the scope of the permissions granted:
- Instagram account profile information: account ID, username, name, profile picture, bio, website and follower/following/post counts.
- Account media and content: photos, videos, carousels, stories, captions, publication date and the permalink of the posts.
- Metrics and insights: reach, views, saves, shares and other performance indicators for the account and its posts.
- In the Facebook flow: the list of Pages you manage, the data and engagement of those Pages and the Instagram account linked to them, as well as the access tokens needed to publish and read metrics on your behalf.
c) Data collected automatically. Technical usage information (pages visited, actions on the platform), device/browser data and server records (logs, IP address), used for security, fraud prevention and operation of the service.
3. Meta permissions we request and why
We request only the permissions needed for the features you use. Each permission is used exclusively for the purpose described below:
- instagram_business_basic and instagram_basic: to authenticate you and to read/display your Instagram account’s profile and media within the platform.
- instagram_business_content_publish and instagram_content_publish: to publish and schedule photos, videos and carousels to your account’s feed and stories, at your request.
- instagram_business_manage_insights and instagram_manage_insights: to read your account’s and posts’ metrics in order to show performance analytics.
- pages_show_list: to list the Facebook Pages you manage so that you can choose which one to connect and to confirm ownership.
- pages_read_engagement and read_insights: to read the content and indicators of the linked Page in order to display them and generate reports.
- pages_manage_posts: to create and manage posts on your Page, when required by the publishing flow.
4. How and why we use data (purposes)
We use your data only to provide and operate the features you signed up for: authenticating access; displaying your profile and media; creating, scheduling and publishing content on your connected accounts at your request; presenting performance analytics; providing support; ensuring security; and complying with legal obligations. We do not use Instagram/Facebook data for unrelated purposes, such as building profiles for third-party advertising.
5. Legal basis for processing (LGPD)
We process personal data on the basis of the performance of a contract (art. 7, V), your consent for specific purposes, such as connecting social accounts (art. 7, I), compliance with a legal obligation (art. 7, II) and legitimate interest for the security and improvement of the service (art. 7, IX), always respecting your rights and freedoms.
6. Data sharing
We do not sell your data or the data received from Meta, and we do not transfer them except as described here. We share data only with processors/sub-processors strictly necessary to operate the platform — for example, hosting and database providers, email delivery providers and artificial intelligence providers that process the content you generate. We receive data from Meta through the Graph API and use it in accordance with Meta’s terms. We may also disclose data when required by law or by order of a competent authority.
7. Compliance with the Meta Platform Terms
The use, storage and any sharing of information received from Meta’s APIs (Instagram and Facebook) follow the Meta Platform Terms and the Developer Policies. Instagram and Facebook data are used exclusively to provide the features described in this Policy, limited to the permissions you granted, and are never sold or transferred to data brokers.
8. Data retention and deletion
We keep data only for as long as necessary for the purposes above or to comply with legal obligations. We delete Meta platform data as soon as possible when: you request deletion; you disconnect the social account or revoke the app’s access; you close your Createfy account; Meta requests deletion; or the data is no longer needed. You may request deletion at any time — see the full instructions on our Data Deletion page or write to privacidade@createfy.app.
9. How to revoke the app’s access
You can disconnect your accounts directly in Createfy, under “Social accounts”. You can also revoke access in the network’s own settings: on Instagram/Facebook, go to Settings → Apps and websites and remove Createfy. When you revoke access, we stop accessing new data and delete the account’s stored data as described in section 8.
10. Your rights as a data subject (LGPD)
You may, at any time: confirm the existence of processing; access your data; correct incomplete or outdated data; request anonymization, blocking or deletion of unnecessary data or data processed in non-compliance; request portability; revoke consent; and obtain information about data sharing. To exercise these rights, write to privacidade@createfy.app. You may also file a petition with Brazil’s National Data Protection Authority (ANPD).
11. Data security
We adopt technical and organizational measures to protect your data, including encryption of stored access tokens, access control and transmission over HTTPS. In the event of a security incident that may pose a relevant risk, we will notify the data subjects and the ANPD under the terms of the LGPD.
12. International transfer
Part of the infrastructure and services we use may process data outside Brazil. In such cases, we adopt the safeguards required by the LGPD for international data transfers.
13. Cookies
We use strictly necessary cookies for authentication and for the operation of the platform (for example, to keep your session and your language).
14. Changes to this Policy
We may update this Policy periodically. Material changes will be communicated by email or by a notice on the platform. The date of the last update is shown at the top of this page.
Questions about this Policy? Contact our Data Protection Officer (DPO) at privacidade@createfy.app.