This Privacy Policy describes how ToMessage collects, uses, stores, shares and protects information related to the use of the platform, including data processed through integrations with Instagram, Meta, artificial intelligence services, payment providers and other suppliers required for the operation of the service.
This Policy also explains how certain information relating to individuals who interact with Instagram accounts connected by ToMessage customers may be processed in order to execute the automations configured by those customers.
By using ToMessage, the user acknowledges the practices described in this Policy, without prejudice to any rights guaranteed by applicable law.
Privacy Policy Index
Quickly access a section of this Privacy Policy.
1. About ToMessage
ToMessage is a Software as a Service (SaaS) platform designed to automate certain interactions carried out through Instagram.
Among its features, the platform allows users to connect professional Instagram accounts and configure automations related to posts, comments, keywords, private messages, Story replies and other features made available through Meta's official APIs.
ToMessage is operated by RPM ESTRATEGIA DIGITAL LTDA , registered in Brazil under CNPJ number 63.973.829/0001-90 .
RPM ESTRATEGIA DIGITAL LTDA is responsible for operating the ToMessage platform and the domain tomessage.com.br .
For privacy and personal data processing matters, contact: contato@tomessage.com.br .
2. Roles in personal data processing
Depending on the operation performed, ToMessage may process personal data for its own purposes or process information on behalf of its customers.
Regarding information required for account creation, subscription management, payments, security, support, fraud prevention, platform operation and compliance with legal obligations, RPM ESTRATEGIA DIGITAL LTDA may determine the purposes and means of processing in accordance with applicable law.
With respect to certain data relating to followers, contacts, customers or other individuals interacting with an Instagram account connected to the platform, ToMessage may process information according to the settings and instructions of the customer responsible for that account.
In such cases, the ToMessage customer determines, for example, which automations will be created, which keywords will trigger them, which messages will be sent and under which circumstances interactions will be processed.
3. ToMessage user data
When an individual creates an account or uses ToMessage, we may process information such as:
- name;
- email address;
- information required for authentication and account management;
- subscribed plan and usage limits;
- subscription and validity period information;
- payment history and transaction status;
- preferences and settings configured on the platform;
- support request content;
- technical records relating to use of the platform;
- security, session and access information.
4. Data from Instagram and Meta
When a user connects an Instagram account to ToMessage, we may process information made available through Meta's official APIs according to permissions granted by the user and the features actually used.
This information may include:
- Instagram account identifier;
- username;
- profile name;
- profile picture, when available;
- authorization tokens provided by Meta;
- post identifiers and information;
- captions, links and information relating to synchronized posts;
- comments relevant to configured automations;
- Direct message information or events when required by enabled features;
- Story replies and events when made available by Meta;
- identifiers required to execute private replies;
- records relating to automation execution.
5. Followers, contacts and interacting individuals
When an individual comments, sends a message, replies to a Story or performs another interaction compatible with an automation configured by a ToMessage customer, certain information relating to that interaction may be processed in order to provide the contracted functionality.
Depending on the information made available by Meta and the type of automation, the following may be processed:
- Instagram user identifiers;
- username, when available;
- comment or message content required to identify whether an automation should be triggered;
- comment, message, post or event identifiers;
- date and time of the interaction;
- identified keywords;
- information required to prevent duplicate sends;
- technical records relating to automation execution.
This information is primarily used to execute instructions and automations configured by the ToMessage customer and to maintain technical records required for operation, security and service control.
6. Customer responsibility for third-party data
Customers who connect an Instagram account to ToMessage are responsible for using the platform in accordance with applicable law and Meta policies.
When customers use personal data relating to followers, contacts, consumers or other individuals through automations, they are responsible for assessing and ensuring that an appropriate legal basis exists for such processing, as well as providing any notices required by applicable law.
Customers are also responsible for the content of messages, replies, keywords, links and other materials entered into their automations.
As a general rule, ToMessage does not maintain a direct contractual relationship with followers or contacts belonging to the audiences of customers using the platform.
7. How we use information
Information processed by ToMessage may be used to:
- create, authenticate and maintain user accounts;
- allow Instagram accounts to be connected;
- synchronize authorized posts;
- identify comments, messages and other interactions relating to automations;
- execute messages and other actions configured by users;
- enforce subscribed plan limits;
- process and record payments;
- provide artificial intelligence features when requested;
- provide user support;
- maintain automation and activity history;
- send administrative, operational and security notices;
- prevent abuse, fraud and misuse;
- identify and correct technical failures;
- produce operational metrics and statistics relating to platform functionality;
- improve the security, stability and operation of ToMessage;
- exercise rights in administrative, judicial or arbitration proceedings;
- comply with applicable legal and regulatory obligations.
8. Legal bases for processing
Where applicable, personal data processing by ToMessage will be carried out in accordance with the Brazilian General Data Protection Law — LGPD (Law No. 13,709/2018).
Depending on the operation, processing may rely on one or more legal bases provided by applicable law, including:
- performance of a contract or preliminary procedures relating to a contract;
- compliance with a legal or regulatory obligation;
- regular exercise of rights;
- legitimate interests, subject to applicable legal requirements;
- consent, where applicable;
- other legal bases permitted by applicable legislation.
9. Instagram and Meta integration
ToMessage uses official APIs made available by Meta to access only those resources required for features authorized by the owner of the connected account.
Connection is performed using authorization mechanisms provided by Meta.
ToMessage does not request or store an Instagram account password in order to establish this integration.
Users may revoke authorizations or disconnect their account through mechanisms provided by ToMessage and Meta.
Instagram-related functionality is subject to Meta's policies, permissions, limitations, availability, technical rules and API changes.
10. Access tokens and credentials
Access tokens provided by Meta are used to perform functionality authorized by the user.
These tokens are treated as confidential authentication information and stored using safeguards designed to reduce the risk of unauthorized access.
When necessary, ToMessage may renew these tokens using mechanisms provided by Meta.
Users should not share passwords, tokens, API keys or other confidential credentials through fields that are not specifically intended for that purpose.
11. Artificial intelligence features
ToMessage may offer features that use artificial intelligence, including text improvement or generation, user assistance and support-related resources.
When users access these features, the content submitted may be processed by ToMessage and specialized artificial intelligence technology providers to the extent necessary to provide the requested functionality, as well as for applicable technical and security purposes.
Depending on the feature, such content may include text, questions, instructions or other information provided by the user.
Users should avoid entering passwords, tokens, full payment card numbers, unnecessary identification documents, sensitive personal information or other confidential information that is not required for the intended purpose.
Processing performed by artificial intelligence providers may also be subject to the applicable terms, policies and security practices of those providers.
12. Payments
For paid subscriptions, certain transaction-related information may be processed by ToMessage and specialized payment service providers.
Payment processing may currently use, depending on the selected payment method, services provided by Efí and Mercado Pago .
ToMessage may store information such as transaction identifiers, payment method, amount, subscribed plan, status, confirmation date, identifiers returned by the provider and other information necessary for payment and subscription management.
Depending on the payment method, financial information may be entered or processed directly through mechanisms provided by the relevant payment provider.
ToMessage seeks to limit storage of financial information to data necessary for confirmation, reconciliation, support, fraud prevention and subscription management.
13. Communications and support
When users contact ToMessage by email, forms, chat or other support channels, we may store and process information provided in those communications.
This may include name, email address, subject, problem description, conversation history, attachments and technical information necessary to diagnose and resolve the request.
This information may be used to provide support, document service interactions, improve the platform, prevent abuse and protect legal rights.
15. Information sharing
ToMessage does not sell personal data.
Information may be shared, transferred or processed by third parties when necessary to provide, protect and maintain the platform or where another applicable legal basis exists.
These third parties may include:
- Meta and Instagram for integration functionality;
- infrastructure, hosting, storage and cloud computing providers;
- artificial intelligence providers when users access features dependent on those services;
- communication and email delivery providers;
- payment service providers, including Efí and Mercado Pago;
- security, monitoring, fraud prevention and error diagnostics providers;
- professional service providers where necessary and legally permitted;
- public authorities, regulatory authorities or courts when required by law, a valid order or another legally permitted circumstance.
ToMessage seeks to limit such sharing to information necessary for the relevant purpose.
16. Service providers and processors
To provide the platform, ToMessage may engage third parties specializing in infrastructure, payments, artificial intelligence, communications, monitoring, security and other technology services.
Depending on the functionality used, services participating in the operation of the platform may include providers such as Meta/Instagram, Amazon Web Services, artificial intelligence providers, Resend, Efí and Mercado Pago.
These providers may change over time due to technical, commercial, regulatory or security requirements.
Where applicable, ToMessage seeks to establish contractual obligations and safeguards intended to protect data processed by these providers.
17. International data transfers
Some technology providers used by ToMessage maintain infrastructure, affiliated companies or operations located outside Brazil.
As a result, certain personal data may be stored, accessed or processed internationally, including in countries where servers, teams or providers required for the service are located.
Such transfers may involve, among other destinations, the United States and other countries used by the infrastructure of the relevant providers.
Where the LGPD applies, ToMessage will seek to conduct international data transfers in accordance with mechanisms permitted under Brazilian law and regulations issued by the Brazilian National Data Protection Authority — ANPD.
Transfers will, whenever possible, be limited to the data necessary for the purposes described in this Policy and will be subject to applicable security measures and safeguards.
Additional information about specific international transfer operations may be requested at contato@tomessage.com.br .
18. Logs and technical information
For security, diagnostics and platform operation, technical information relating to requests, access, automation execution, failures, events and service usage may be recorded.
Such records may include, as applicable:
- IP address;
- access date and time;
- browser and device information;
- technical identifiers;
- routes or features used;
- error records;
- authentication events;
- records relating to automation execution.
These records assist with troubleshooting, abuse prevention, incident investigation and maintenance of ToMessage's stability and security.
Application access records will be retained for the period required by applicable Brazilian law, including the minimum period provided by the Brazilian Internet Civil Rights Framework where applicable to ToMessage, without prejudice to additional periods legally authorized or required by a competent authority.
19. Storage and security
ToMessage adopts technical and administrative measures intended to protect information against unauthorized access, loss, alteration, disclosure or improper destruction.
Measures employed may include access controls, authentication, protected connections, restrictions on credential access, technical monitoring, backups and other mechanisms appropriate to the nature of the services.
Internal access to personal information should be limited to individuals and systems requiring such information to perform functions relating to operation of the service.
No internet-connected system can guarantee absolute security. Nevertheless, we seek to apply practices appropriate to the nature, purpose and risks of the information processed.
20. Security incidents
If a security incident involving personal data is identified, ToMessage will take reasonable measures to investigate, contain and mitigate its effects.
Where required by applicable law or regulation, ToMessage will provide the appropriate notices to affected data subjects and the Brazilian National Data Protection Authority — ANPD.
The necessity, form and timing of such communications will be assessed according to the nature of the incident, the data involved, risks to data subjects and applicable legal requirements.
21. Data retention
Personal data will be retained for the period necessary to provide the services, comply with legal and regulatory obligations, preserve transaction records, prevent fraud, exercise rights and fulfill the other purposes described in this Policy.
Retention periods may vary according to the category of data, purpose of processing, subscribed plan, contractual relationship and applicable legal obligations.
Some ToMessage plans may provide different periods of history availability within the platform. The end of visible history availability does not necessarily mean that all underlying records are immediately deleted where retention remains necessary or permitted by law.
Once processing is no longer necessary and there is no legal basis for continued retention, information may be deleted, anonymized or otherwise retained in a manner permitted by law.
22. Instagram disconnection
Users may disconnect their Instagram account through features made available by ToMessage.
Disconnection prevents ToMessage from using the account for new automations that depend on that integration and may cause related functionality to be paused.
Disconnecting an account does not necessarily result in the immediate deletion of historical records, logs or information that must be retained for legal obligations, security, fraud prevention, exercise of rights or other legally permitted purposes.
Users may also use mechanisms provided by Meta to manage or revoke permissions granted to connected applications.
23. Account and data deletion
Users may request deletion of their account and personal data associated with ToMessage, subject to circumstances in which retention of certain information is necessary or permitted by law.
Certain information may be retained following a deletion request for compliance with legal, tax or regulatory obligations, fraud prevention, defense in proceedings, exercise of rights, compliance with authority orders or other legally permitted purposes.
Data deletion requests may be sent to:
contato@tomessage.com.br24. Data subject rights
Under applicable law, particularly the LGPD, a data subject may request, where applicable:
- confirmation that processing exists;
- access to personal data;
- correction of incomplete, inaccurate or outdated information;
- anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data, where applicable;
- data portability, subject to applicable legal and regulatory requirements;
- information about public and private entities with which data has been shared;
- information about the possibility of refusing consent and the consequences of such refusal, where applicable;
- deletion of data processed based on consent, subject to legally permitted retention;
- withdrawal of consent where consent is the applicable legal basis;
- objection to processing carried out under certain legal bases where the requirements provided by law are met;
- review of decisions made solely on the basis of automated processing of personal data that affect the individual's interests, where applicable;
- filing petitions with the Brazilian National Data Protection Authority where permitted by law;
- other rights provided under the LGPD and applicable law.
In order to protect data subjects and prevent unauthorized access, ToMessage may request reasonable information to verify identity before fulfilling certain requests.
25. Requests from followers and other third parties
Where an individual's data has been processed as a result of an automation configured by a ToMessage customer, that customer may be primarily responsible for decisions relating to the processing of such information.
In such circumstances, the data subject may contact directly the company, professional or person responsible for the Instagram account with which they interacted.
If a request relating to data processed on behalf of a customer is submitted directly to ToMessage, we may request additional information, forward the request to the responsible customer or assist that customer to the extent necessary to comply with applicable law.
Requests may also be sent to contato@tomessage.com.br .
26. Sensitive personal data
ToMessage is not designed for the purpose of receiving sensitive personal data through ordinary platform automations.
Users should avoid entering or requesting, without necessity and an appropriate legal basis, information relating, for example, to racial or ethnic origin, religious beliefs, political opinions, trade union membership, health, sex life, genetic or biometric data and other categories classified as sensitive under applicable law.
If a customer uses the platform in a manner involving special categories of personal data, the customer is responsible for assessing in advance the legality, necessity and appropriateness of such use.
27. Children and adolescents
ToMessage is not specifically directed at children.
Customers must not use the platform in a manner that conflicts with legal requirements applicable to the processing of personal data of children and adolescents.
If circumstances requiring specific treatment under applicable law are identified, appropriate measures will be taken.
28. Third-party links and services
The platform may contain links to or integrations with services operated by third parties.
Processing performed directly by such third parties may be subject to their own privacy policies, terms of service and practices.
We recommend that users review the relevant documents before using external services or providing information directly to third parties.
29. Changes to this Policy
This Privacy Policy may be updated to reflect changes to the platform, legislation, functionality, providers, integrations or personal data processing practices.
Where a change is material, ToMessage may notify users through the platform, email or another appropriate communication channel.
The most recent version will remain available on this page together with the applicable update date.
30. Contact
For questions, privacy requests, exercise of data protection rights, deletion requests or other matters relating to the processing of personal information, contact:
Please also review the ToMessage Terms of Use .