Who we are
falatu.ai is operated by Nuno Labs Pty Ltd, an Australian company based in Sydney, NSW, Australia (“falatu”, “we”).
Contact and data protection officer (LGPD): Paulo Cauhi, hello@falatu.ai.
Two roles, depending on who you are
- You are a falatu customer (you have an account and connect your business's Instagram): we are the controller of your account data.
- You talked to a business that uses falatu (you commented on a post or sent a DM): the business is the controller of your data, and falatu is the processor, handling it only to provide the service to that business and on its instructions. To exercise your rights, contact the business. If you prefer, contact us and we'll help.
Customer data
- Account: name, email, password (stored only as a hash) or, if you sign in with Google, your Google profile name, email and photo.
- Connected Instagram: the professional account's ID and username, profile picture, the access token Meta gives us (stored encrypted), your posts and captions, and post metrics when you turn on statistics.
- Settings: automations, keywords, reply texts, links and preferences.
- Payment: plan, billing history and status. Card and Pix details are handled by Stripe and EBANX; we never receive your full card number.
- Usage and security: IP address, browser, access times and account actions, to keep the service secure and working.
- Waitlist: email, Instagram handle, language and where you came from, if you signed up before launch.
Data about people who talk to our customers
When someone comments on a post or messages a business that uses falatu, we receive from Meta and store:
- the person's Instagram ID (specific to the app), their username and, when Meta provides them, their name and profile picture;
- the text of the comment or message, with date and time;
- the replies and messages falatu sent on the business's behalf;
- whether the person follows the business's account, when the business turns on the follower check;
- the date and time of the click, when the person opens a link sent by falatu.
When WhatsApp becomes available, we will also handle the phone number and the messages exchanged with the business.
Why we use the data (and the legal basis)
- Providing the service: creating your account, connecting Instagram, answering comments and messages according to the automations you set up, showing the inbox and statistics (performance of a contract).
- Billing and meeting tax and accounting obligations (contract and legal obligation).
- Security: preventing fraud, abuse and unwanted messaging, and investigating failures (legitimate interest).
- Improving the product with aggregated usage data (legitimate interest).
- Communication: service emails (confirmation, password, notices about your account) and, if you agreed, falatu news. You can unsubscribe from news at any time (consent).
Data received from Meta (Instagram and WhatsApp)
We use data obtained through Meta's official APIs only to provide the service to the business that connected the account. We don't sell this data, don't use it for advertising, don't build profiles of people outside the service and don't use it to train artificial intelligence models. We follow Meta's Platform Terms and Instagram's and WhatsApp's policies.
AI replies
If a business turns on AI replies, the text of the incoming message and the information the business has entered are sent to an AI provider (Anthropic) only to generate the reply. The provider does not use this data to train its models. Without this feature turned on, no message is sent to AI providers.
International transfers
falatu is an Australian company and uses providers in the United States and the European Union, so your data is processed outside Brazil. We make these transfers under our providers' contracts and data protection safeguards, as article 33 of the LGPD allows.
How long we keep data
- Customer accounts: while the account exists. After it is closed, we delete it within 30 days, except billing records the law requires us to keep for the legal period.
- Data about people who talk to our customers: while the customer uses falatu. The customer can delete conversations and contacts at any time. When they close their account or disconnect the channel, we delete this data within 30 days.
- Raw events received from Meta and technical logs: up to 30 days.
- Backups: expire within 30 days.
- Waitlist: until launch or until you ask to leave.
Security
All traffic is encrypted (HTTPS). Instagram access tokens are encrypted in the database, passwords are stored only as hashes, and internal access to data is limited to the people who need it to run the service.
Your rights
You can ask for: confirmation that we process your data, access, correction, anonymisation or deletion, portability, information about who we share it with, and to withdraw consent. You can also object to processing based on legitimate interest.
Customers can do most of this in the app or by writing to hello@falatu.ai. We reply within 15 days. If you talked to a business that uses falatu, see the Data deletion page.
If you're not satisfied, you can complain to the ANPD (Brazil's National Data Protection Authority) or to the OAIC (Office of the Australian Information Commissioner).
Children
falatu is built for businesses. Accounts can only be created by people aged 18 or over.
Changes to this policy
If we change something important, we tell customers by email or in the app before the change takes effect. The date of the current version is at the top of this page.