Effective date: 2026-08-16 (supersedes the 2026-05-31 version)
Controller: BrunoRozendo LTDA ("we", "us")
Contact: [email protected]
This notice describes how the cbb-inbox Meta App receives, uses and stores information when people interact with the profiles operated by BrunoRozendo LTDA on Meta's platforms: @anotadissimo.app, @notebookbaratoonline and @u10x.dev on Instagram and Threads, and the corresponding Facebook Pages.
1. What we receive, and from where
We receive data exclusively through Meta's official APIs, and only when you start the interaction.
| Source | What arrives |
|---|---|
| Direct message on Instagram or Messenger | App-scoped user ID, public username and profile picture, message content (text, image, audio, shared attachment), timestamp, delivery and read receipts |
| Comment on a post | App-scoped user ID, username, comment text, ID of the post commented on |
| Mention of one of our profiles | ID of the person mentioning, the text containing the mention, ID of the originating post |
| Reply on Threads | Username, reply text, public permalink, ID of the originating post |
The identifier Meta sends us is specific to this application. It is not your login, it does not reveal your email or phone number, and it cannot be used to find you outside this context.
We do not collect browsing data, we do not use tracking cookies, and we do not buy data from third parties.
2. What we use it for
- Displaying the conversation to authorised agents on our team.
- Letting a human agent reply on behalf of the brand.
- Classifying comments by intent and, when a comment expresses explicit purchase interest, sending one single automated direct message with the information requested.
- Tracking conversation status and producing aggregate operational metrics.
We do not sell, rent or licence message content. We do not use this data for targeted advertising, we do not build behavioural profiles, and we do not combine it with any other dataset.
3. Automated decisions and use of AI
When someone comments on one of our posts, the comment text and the public username are sent to Google Gemini to classify intent and draft a reply. The model receives only those two fields — never conversation history, never the content of direct messages.
The generated reply is delivered as one single direct message. Meta's platforms enforce that limit technically: one private reply per comment, within 7 days. There is no automated follow-up sequence.
You can ask for a human at any point by replying to the message; from then on a person handles the conversation.
4. Sub-processors
| Who | What they receive | Why |
|---|---|---|
| Google (Gemini API) | Comment text and public username | Classify intent and draft the reply |
| Cloudflare | Request metadata (source IP, headers) | Network tunnel and infrastructure protection |
| Meta Platforms | Origin of the data and destination of replies | Operation of the platforms themselves |
There is no other processor. The application is self-hosted on our own server in Brazil; we do not use a third-party cloud provider to store conversations.
5. Where the data lives
On our own infrastructure in Brazil, on PostgreSQL with encryption at rest. Traffic is protected with TLS. Encrypted backups are kept for 30 days and then destroyed. Dashboard access requires a password and two-factor authentication.
6. How long we keep it
| Data | Retention |
|---|---|
| Conversations (direct messages) | 12 months after the conversation is closed |
| Record of comments and automated replies | 12 months |
| Backups | 30 days, rotating |
| After you revoke access or request deletion | Erased within 30 days |
7. Your rights
Under the LGPD you may request confirmation of processing, access, correction, anonymisation, portability and deletion of your data, as well as information about who it was shared with. Write to [email protected]; we respond within 30 days.
Detailed deletion instructions: Data deletion
8. Incidents
In the event of unauthorised access affecting personal data, we notify Meta, the ANPD and the affected people within 72 hours of becoming aware.
9. Children
The application is not directed at anyone under 13. Data identified as belonging to a minor is deleted as soon as we become aware of it.
10. Changes to this policy
Material changes take effect on the effective date shown at the top of this page. The previous version is available on request by email.
11. Controller
BrunoRozendo LTDA — Brazil
Data officer: Bruno Rozendo
[email protected]