Privacy Policy

1. Who we are

This Privacy Policy describes how MDP Consultoria ("MDP", "we"), based in Curitiba, Paraná, Brazil, collects, uses, stores and protects personal data of customers, prospects and users who interact with our service channels, including WhatsApp, Instagram, Facebook (Messenger and Pages), email, our digital diagnostic platform and MDP Omni, our customer service platform.

This policy complies with the Brazilian General Data Protection Law (Law No. 13,709/2018, "LGPD") and with the Meta platform policies that apply to the WhatsApp Business Platform, the Instagram Platform and the Messenger Platform.

2. MDP Omni: connected accounts and MDP's role

MDP Omni is MDP's customer service platform. It lets business customers ("Customers") connect their Instagram and Facebook accounts (Pages and Messenger) to receive, in one place, the direct messages and comments sent to those accounts, and to reply to them.

• Authorization: the Customer connects each account through Meta's own authorization window and chooses what to share. MDP does not request or store Instagram or Facebook passwords.
• What we access: only what the Customer authorizes: basic profile data of the professional Instagram account; direct messages received and sent; comments on posts; the list of Facebook Pages the user manages; and the Messenger messages and comments of the connected Page.
• What we use it for: exclusively to show these messages and comments to the Customer, let the Customer reply, and keep the conversation history. We do not sell this data or use it for advertising.
• Revocation: the Customer can disconnect an account at any time, with the Disconnect button in MDP Omni or in the "Apps and websites" settings of Instagram or Facebook. When an account is disconnected, we stop receiving new messages and delete the access token.

Roles under the LGPD. For data of people who contact MDP directly, MDP is the controller. For messages and comments that people send to a Customer's accounts and that reach MDP Omni, the Customer is the controller and MDP acts as the processor, handling the data on the Customer's behalf and under the Customer's instructions, only to provide the service.

3. What data we collect

We collect personal data that you provide directly, or that is generated by your interaction with our service channels:

Category	Examples
Identification data	Name, phone number, Instagram username, name displayed on Facebook/Messenger
Contact data	Email, company, city/state, company tax ID (when provided in the form)
Message content	Messages sent via WhatsApp (Cloud API), Instagram and Messenger direct messages, public comments on Instagram posts and Facebook Page posts, and emails exchanged with our team
Business data	Information provided in the contact form and in the Free Initial Diagnostic
Technical data	Account identifiers (WABA ID, Instagram-scoped ID, Facebook Page ID), message delivery and read status
Connected accounts (MDP Omni)	Name and @username of the connected professional Instagram account or Facebook Page, permissions granted, connection date, and access token (stored encrypted)

4. How we use your data

We use the data we collect exclusively for the following purposes:

• Replying to and managing conversations started by you via WhatsApp, Instagram Direct, Messenger, comments or email;
• Allowing our Customers to receive, view and reply, through MDP Omni, to the messages and comments sent to their connected accounts;
• Validating company data and sending access to the Free Initial Diagnostic, when requested;
• Sending confirmations, updates and communications related to requested services;
• Preparing digital maturity diagnostics and commercial proposals;
• Complying with legal and regulatory obligations;
• Improving the quality of our service and our internal processes.

We do not use your data for third-party targeted advertising, and we do not sell it or share it for commercial purposes unrelated to providing our service.

5. Sharing data with third parties

To operate our service channels, we use the following platforms as data processors, under their respective terms of use and privacy policies:

• Meta Platforms, Inc.: WhatsApp Business Platform (Cloud API), Instagram Platform and Messenger Platform (Facebook), to send, receive and manage messages and comments;
• Microsoft and Google: where applicable, to integrate with corporate email accounts (Outlook/Gmail);
• Hosting infrastructure providers, exclusively to store securely the data needed to operate the MDP platform.

These third parties process data on our behalf, under MDP's instructions, and are not authorized to use it for their own purposes.

6. Data retention

We keep personal data for as long as necessary to fulfill the purposes described in this policy, or as required by applicable legal, contractual or regulatory obligations. After that period, data is securely deleted or anonymized. Access tokens for accounts connected to MDP Omni are deleted when the channel is disconnected.

7. Your rights as a data subject (LGPD)

Under the LGPD, you have the right to:

• Confirm that we process your data;
• Access the data we hold about you;
• Correct incomplete, inaccurate or outdated data;
• Request anonymization, blocking or deletion of unnecessary data or data processed in violation of the law;
• Request portability of your data to another service provider;
• Withdraw consent and request deletion of data processed based on consent;
• Obtain information about who we share your data with.

You can exercise any of these rights through our contact form, stating which right you want to exercise, for example: "I request the removal of my data", or through the channels listed below.

8. How to request deletion of your data

You can request deletion of your personal data at any time, in a simple way:

• Send an email to contato@mdpconsultoria.com.br with the subject "Data deletion request", stating your name and the channel you used (WhatsApp, Instagram, Facebook or email);
• Or send a message directly through the channel where you already talked to MDP (WhatsApp, Instagram or Messenger), saying: "I request the deletion of my data".

If you wrote to the account of a business that uses MDP Omni (and not to MDP), ask that business to delete your data, or write to the email above stating the business name and the account you used. We will forward the request to the responsible Customer, who decides on the data as controller, and we will support the response.

If you are a Customer who connected an account to MDP Omni, you can disconnect it at any time: use the Disconnect button in MDP Omni and, if you wish, remove the "MDP Omni" app in the "Apps and websites" settings of Instagram or Facebook. To request deletion of your MDP Omni account data, write to the email above.

After your identity is confirmed, your personal data will be deleted from our systems within 15 business days, except where retention is required by law or regulation.

9. Information security

We adopt reasonable technical and organizational measures to protect personal data against unauthorized access, loss, alteration or improper disclosure, including permission-based access control, multi-factor authentication on the platform's administrative accounts, separation of each Customer's data, encrypted storage of access tokens for connected accounts, and encryption of data in transit.

10. Changes to this policy

This policy may be updated from time to time to reflect changes in our practices or in legal and platform requirements. The date of the latest update is always shown at the top of this page.