This policy explains how VibeKit, operated by GAROA SOLUCOES TECNOLOGICAS LTDA (CNPJ 32.212.172/0001-15), collects, uses and protects personal data, in line with Brazil's General Data Protection Law (LGPD) and applicable laws.
1. Data we collect
- Account: name, e-mail and password (stored hashed) of platform users.
- Brand content: colors, fonts, images, texts and posts you upload or create.
- Instagram (with your authorization): professional account ID and username, profile picture, account type, access token (encrypted), posts published through the platform and insights.
- Interactions on your posts: when you enable comment automations we receive the commenter's ID, public username and comment text, and log the replies and messages sent.
- Post approval: the name and comments entered by whoever reviews an approval link.
- Technical logs: IP address, access time and diagnostic data.
2. How we use it
- To provide the service: create, render, schedule and publish posts on the account you connected.
- To run the automations you configured (public reply and direct message to commenters).
- Security, abuse prevention, support and product improvement.
Legal bases: performance of contract, legitimate interest and consent where applicable. We do not sell personal data.
3. Sharing
We share data only with what is needed to run the service: Meta (Instagram APIs), infrastructure providers (database, storage and hosting) and, when you connect your own AI (MCP), the provider you chose, with the project data your AI requests.
4. Retention
- Access tokens: until you disconnect the account or remove the app on Instagram.
- Videos uploaded for Reels: deleted from our storage right after the publication is confirmed.
- Account data and content: while the account is active, or until you request deletion.
5. Your rights
You may request confirmation, access, correction, portability and deletion of your data, and withdraw consent, at emaildoalanqueiroz@gmail.com.
6. Deleting Instagram data
Disconnect the account in Project settings or remove the app in Instagram → Settings → Apps and websites. When Meta sends us the request we delete the token, the account data and the interactions obtained through it; follow the status at /data-deletion.
7. Security
We use encrypted connections (HTTPS), workspace-level access control and AES-256-GCM encryption for access tokens. No system is 100% secure: in case of a relevant incident we will notify affected users and authorities as required by law.
8. Contact
Data protection officer and questions: emaildoalanqueiroz@gmail.com. We may update this policy; the last revision date is shown at the top of the page.