Privacy Policy: Instagram comments and private messages

Last updated: September 28, 2026.

1. Who we are and what this policy covers

The controller of the personal data described here is Ponto Direto Tech LTDA (Brazil), owner of NeoFast. Contact: contato@pontodiretotech.com.br.

This policy applies only to the automatic private message service of the Instagram accounts @neofastapp (English) and @neofastapp.br (Portuguese), which works through the official Meta APIs. The NeoFast app and website have their own policy at https://neofastapp.com/privacy-terms/.

2. How the service works

When you comment on one of our posts, Instagram (Meta) notifies our service. The service then sends you a private message (DM) with the content promised in the post, usually a short text with a link. You receive at most one message per post, even if you comment more than once.

The message is sent through Instagram’s Private Replies feature, which allows a business account to reply privately to a comment. We only reply to comments on our own posts, and we do not send any other messages unless you write to us.

3. Data we process

• Your Instagram user ID (the app scoped ID provided by Meta) and your @username;
• The ID of your comment and the ID of the post you commented on;
• The date and time of the comment and of the message;
• The delivery status of the message (sent or failed, with the error code returned by Meta, if any).

We do not store the text of your comment, your profile photo, your followers, your location or any other information from your account. We do not use cookies or tracking in this service.

4. Why we use this data and legal basis

We use the data only to (a) send you the content you asked for by commenting, (b) make sure you receive one message per post and never duplicates, and (c) keep the service secure and fix delivery errors. We do not use it for advertising, profiling or any automated decision about you.

Legal basis under the Brazilian General Data Protection Law (LGPD, Law 13,709/2018): steps taken at the request of the data subject (art. 7, V), since you commented to receive the content, and legitimate interest (art. 7, IX) for preventing duplicates and keeping the service secure. For users in the European Economic Area and the UK (GDPR): performance of a request made by you (art. 6(1)(b)) and legitimate interests (art. 6(1)(f)).

5. Sharing and international transfer

We do not sell, rent or share your data. The only providers involved are:

• Meta Platforms (Instagram Graph API), which delivers the notifications and the messages, under Instagram's Privacy Policy;
• Amazon Web Services (AWS), which hosts the service in the us-east-1 region (United States).

Because the service is hosted in the United States, your data is transferred internationally. This transfer relies on the contractual safeguards offered by the provider and on the security measures described below, as allowed by art. 33 of the LGPD and by the GDPR.

6. How long we keep the data

• Comment record (IDs, date and delivery status): 90 days;
• Record that you already received the message for a given post (to avoid duplicates): 365 days;
• Technical logs: 14 days.

After these periods the data is deleted automatically. The private message itself stays in your Instagram inbox and in ours, managed by Meta; you can delete the conversation in the Instagram app at any time.

7. Security

Access to the data is restricted to the service itself and to the account administrator. Notifications from Meta are verified by digital signature, access credentials are stored encrypted, and the logs do not record message content.

8. Your rights

Under the LGPD (art. 18) and, when applicable, the GDPR, you can ask for: confirmation that we process your data; access to the data; correction; anonymization, blocking or deletion; information about the entities we share data with; and you can object to the processing. You can also file a complaint with the Brazilian data protection authority (ANPD) or with the authority in your country.

To exercise any of these rights, email contato@pontodiretotech.com.br. We reply within 15 days.

9. How to request deletion of your data

You can ask us to delete all data related to you in this service at any time, without needing to give a reason:

1. Send an email to contato@pontodiretotech.com.br with the subject “Data deletion – Instagram”.
2. Include your Instagram @username and which account you interacted with (@neofastapp or @neofastapp.br).
3. We delete the records linked to your user ID within 15 days and confirm by email. If we need to confirm that the account is yours, we may ask you to send a message from that Instagram account.

You can also delete your comment and the conversation directly in the Instagram app. Please note that if you comment on one of our posts again after deletion, the service will send the message again, since that is how it works.

10. Minors

Instagram is not intended for people under 13. This service is aimed at healthcare professionals and students, and we do not knowingly process data of children.

11. Changes and contact

We may update this policy if the service changes; the date at the top shows the latest version. This policy is governed by the laws of Brazil. Questions: Ponto Direto Tech LTDA, contato@pontodiretotech.com.br.