Skip to content
IAChatbot

Privacy Policy

Last updated: October 26, 2026

This Privacy Policy describes how IAChatbot ("we", "us" or "our") collects, uses, stores and protects personal information when you use our AI chatbot software-as-a-service (SaaS) platform, website, APIs and related services, including interactions through WhatsApp, Instagram and other channels connected via the official Meta APIs. This policy also covers reading public comments, publishing public replies and publishing posts on the company's own Facebook Pages connected to the platform (IACHATBOT, VIDEOCOMIA and BLOGPOST), as described in section 2.1. This policy also covers, as described in section 2.2, publishing posts, reading and replying to comments and reactions, and reading aggregate statistics on LinkedIn Company Pages whose admin authorizes IACHATBOT.

1. Who we are

IAChatbot provides custom AI chatbot solutions for businesses. We act as a data processor on behalf of our business customers when handling end-user conversations, and as a data controller for account, billing and website-related information.

2. Information we collect

Depending on how you interact with our services, we may collect:

  • Account and business information: company name, contact name, email address, phone number, billing details and service configuration data provided when signing up or requesting a demo.
  • End-user conversation data: names, phone numbers, usernames, message content, media files (audio, images, documents), metadata and other information exchanged through connected channels such as WhatsApp and Instagram.
  • Technical and usage data: IP address, browser type, device information, log files, cookies and analytics related to website and platform usage.
  • Integration data: information retrieved from or sent to third-party systems you connect (such as CRM, ERP or scheduling tools), as authorized by you or your organization.

2.1. Connected Facebook Pages: comments, replies and posts

On the IaChatbot platform, authorized team members (administrator or operator) can connect the company's own Facebook Pages through Facebook Login for Business. Connected Pages include IACHATBOT, VIDEOCOMIA and BLOGPOST. Comments on these Pages are public Facebook content.

In this experience, authorized team members can:

  • Read comments delivered by Meta webhooks, for support, triage and operations;
  • Write and send a public reply to a comment, as the Page, always typed and sent by a person, never automatically (permission pages_manage_engagement);
  • Write, approve and publish a post (text and, when included, an image) on the selected Page, once per approval, with no scheduling and no automatic publishing (permission pages_manage_posts).

The reply and the post are sent to Meta for publication on the Page and become public Facebook content. Page access tokens are stored encrypted on the server and are never exposed.

When Meta delivers the comment through webhooks, and when the team sends the reply or publishes the post, we may process:

  • Comment text or content
  • The author identifier, when Meta provides it
  • Page ID
  • Post ID
  • Comment ID
  • Dates and timestamps
  • Permalink
  • Text of replies sent by the team, the reply ID and who sent them
  • Post text, image URL (when there is one) and post ID
  • An approval record (who approved it and when)

We do not request Business Asset User Profile Access for names or photos beyond identifiers the webhook may provide.

Retention: we keep this data only for as long as needed for operations, legal obligations and dispute resolution, consistent with section 7: only as long as necessary to provide the service, fulfill contractual obligations, resolve disputes, enforce agreements and comply with legal requirements.

The text and the author of received comments are kept for at most 12 months from receipt and then deleted automatically, leaving only technical identifiers. When the person deletes the comment on Facebook, the text and the author are deleted automatically from our records. Edits on Facebook update the stored text. We also keep the text of replies sent by the team and who sent them.

You may request deletion, access or correction at developer@iachatbot.com.br. See our Data Deletion Instructions.

Access can be revoked in Facebook settings (Business Integrations) or by contacting us at the email above.

2.2. LinkedIn Company Pages: posts, comments, reactions and statistics

In the IACHATBOT Hub, the team of a LinkedIn Company Page can publish posts, read and reply to comments and reactions on those posts, and view Page and post statistics. Access happens only after an admin of that Page authorizes IACHATBOT through LinkedIn OAuth. Authorization is granted in the IACHATBOT developer app linked to the IACHATBOT Company Page, for use of the Community Management API. Without that authorization, we do not access the Page.

With that authorization, we may process:

  • Information about the authorized Company Page
  • Posts on that Page
  • Comments on those posts, including the commenter's public name and public profile reference
  • Reactions on those posts
  • Aggregate Page and post statistics (followers, impressions and engagement)

The purpose is to let the Page's team manage posts and comments from the IACHATBOT Hub. We do not sell this LinkedIn data or use it for advertising.

Retention: we keep this data only for as long as needed for operations, legal obligations and dispute resolution, consistent with section 7. The comment text, the commenter's public name and the public profile reference are kept for at most 12 months from receipt and then deleted automatically, leaving only technical identifiers, on the same 12-month schedule already described for Facebook comments in section 2.1. We also keep the text of replies sent by the team.

You may request deletion, access or correction at developer@iachatbot.com.br. See our Data Deletion Instructions.

The Page admin can revoke access in LinkedIn settings (Settings & Privacy, Data privacy, Other applications, Permitted services) or by contacting us at the email above.

3. How we use information

We use collected information to:

  • Provide, operate, maintain and improve our AI chatbot SaaS platform;
  • Configure, train and optimize chatbot responses for your business;
  • Respond to support requests, demos and commercial inquiries;
  • Process payments, manage subscriptions and send service-related communications;
  • Monitor performance, prevent fraud, abuse and security incidents;
  • Comply with legal, regulatory and contractual obligations.
  • Read comments and publish, by an authorized person, public replies and posts on the company's own Facebook Pages.
  • Publish posts, read and reply to comments and reactions, and view aggregate statistics on LinkedIn Company Pages authorized by the Page admin, from the IACHATBOT Hub.

We do not use end-user conversation content to train general-purpose AI models for unrelated third parties without appropriate authorization.

4. Legal bases for processing

Where applicable under GDPR and similar laws, we process personal data based on contract performance, legitimate interests (such as platform security and service improvement), consent and legal obligation. Under LGPD, processing may rely on consent, contract execution, legitimate interest or compliance with legal obligations, as applicable.

5. Sharing of information

We do not sell or rent your personal information. We may share data only with:

  • Service providers: cloud hosting, messaging infrastructure, payment processors, analytics and support tools that help us deliver the service, under contractual confidentiality and security obligations;
  • Meta and messaging partners: when required to operate WhatsApp, Instagram, the company's connected Facebook Pages or other official Meta integrations;
  • LinkedIn: when required to publish posts, read and reply to comments and reactions, and read aggregate statistics on Company Pages whose admins authorized IACHATBOT, as described in section 2.2;
  • Your authorized integrations: CRM, ERP, email or other systems you connect to the platform;
  • Legal authorities: when required by law, court order or to protect rights, safety and security.

6. International transfers

Your information may be processed in countries other than your own. When we transfer data internationally, we apply appropriate safeguards such as standard contractual clauses and security measures consistent with applicable data protection laws.

7. Data retention

We retain personal data only for as long as necessary to provide the service, fulfill contractual obligations, resolve disputes, enforce agreements and comply with legal requirements. Retention periods may vary depending on the type of data and your account settings.

Comments, public replies and posts on our own connected Facebook Pages are kept only for as long as needed for operations, legal obligations and dispute resolution, and then deleted or de-identified. The text and the author of received comments are kept for at most 12 months from receipt and then deleted automatically, as described in section 2.1.

Comments on authorized LinkedIn Company Pages, including the commenter's public name and public profile reference, are kept for at most 12 months from receipt and then deleted automatically, on the same schedule described in section 2.2.

8. Security

We implement technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure or destruction, including encryption in transit and at rest, access controls, monitoring and regular security reviews.

9. Your rights

Depending on your location, you may have the right to access, correct, update, delete, restrict or object to processing of your personal data, request portability and withdraw consent where processing is consent-based. You may also lodge a complaint with a data protection authority.

To exercise your rights, contact us at: developer@iachatbot.com.br. Step-by-step instructions are on our Data Deletion Instructions page.

10. Cookies and Google Analytics 4

Our website iachatbot.com.br uses cookies and similar technologies:

  • Strictly necessary cookie (cookie_consent): stores whether you accepted or declined analytics cookies.
  • Analytics cookies (Google Analytics 4), only after explicit consent via our cookie banner: we measure visits, page views, traffic sources and interactions (WhatsApp clicks, contact form submissions, etc.). Provider: Google Ireland Limited / Google LLC, measurement property G-6V9Q8L64G2. We use Google Consent Mode v2. Google privacy policy: policies.google.com/privacy.
  • Heatmaps and session recording (Microsoft Clarity), aggregated, anonymous capture of clicks, scrolling and navigation to improve usability; form fields and sensitive text are masked. Before consent it runs cookieless; after consent it may use cookies. Provider: Microsoft Corporation. Microsoft privacy statement.

Analytics cookies are not activated until you click Accept. You may refuse, accept or change your choice via the banner or the Manage cookies link in the site footer.

Legal basis (LGPD/GDPR): consent for analytics cookies; legitimate interest for aggregated, anonymous usage analysis (heatmaps) with data masking.

10.1. Ad conversion measurement (OpenAI Ads)

When you submit the demo contact form (company, email and phone), we may send a lead_created conversion event to the OpenAI Ads (ChatGPT Ads) platform via the server-side Conversions API. This measures and optimizes ad campaigns and does not depend on accepting the analytics cookie banner.

We transmit SHA-256 hashed identifiers (email and phone), plus technical metadata (page URL, IP address, user-agent and, when available, the ad click identifier). We do not send your message body in clear text for this purpose.

The browser Measurement Pixel only sends additional events after analytics cookie consent; when both channels fire, we reuse the same event ID to deduplicate.

Legal basis: legitimate interest in measuring advertising performance tied to a commercial request you initiated by submitting the form. Provider: OpenAI. OpenAI Privacy Policy.

11. Children's privacy

Our services are intended for businesses and are not directed at children under 13 (or the minimum age required by applicable law). We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated revision date. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

13. Contact

If you have questions about this Privacy Policy or our data practices, contact us at: developer@iachatbot.com.br.