1. Roles
For the data of people who comment, message or become contacts on the accounts you connect, you are the controller and Murify is the processor, under the LGPD (and under the GDPR where it applies). For the data of your own Murify account, we are the controller and the Privacy policy applies.
2. What we process and why
The text of comments and messages, the username and identifier of whoever wrote them, email and phone typed into one of your flows, consents (opt-ins) and the record of what was sent. We process this data only to run what you set up: publishing, replying, moderating, running automations and broadcasts, and measuring results.
3. Your instructions
We process data according to your instructions, which are the product settings and this agreement. We do not use this data for our own purposes, do not sell it and do not use it to train AI models. If an instruction looks unlawful to us, we tell you before acting on it.
4. Confidentiality and security
Access is limited to those who need it to operate the service, under a duty of confidentiality. Data is encrypted in transit, network tokens are encrypted at rest, each workspace reaches only its own data, and content sent to AI stays out of our diagnostic logs.
5. Sub-processors
You authorize the use of sub-processors to deliver the service: Meta and the other networks you connect (publishing, comments and messages), Google (Gemini, to generate and moderate), Resend (email) and the cloud providers that host the database and files. Each receives only what is necessary and is bound by obligations equivalent to this agreement. Changes to the list are published on this page 15 days in advance; if you object, you can close your account at no cost.
6. International transfers
Some sub-processors process data outside Brazil. In those cases the transfer relies on the safeguards provided by the LGPD, such as standard contractual clauses, and on the GDPR equivalents where it applies.
7. Data subject requests
If someone who interacted with your accounts asks us for access, correction or deletion, we forward the request to you and help you respond. The product already has what it takes: a full workspace export, removal of contacts and conversations, and turning moderation off per brand.
8. Incidents
If a security incident affects data processed on your behalf, we notify you without undue delay, within 72 hours of confirming it, with what we know: what happened, which data, what we have done and what we recommend. Notifying the authority and the data subjects is your decision, and we help with the information.
9. Retention and return
Third-party comments and messages are deleted automatically after 90 days. When you delete the workspace or the account, we delete the rest immediately, files included, and you get a receipt of what was removed. Before that, the export returns everything as JSON. Only tax-related credit entries remain, with no link to a person or to content.
10. Audit and term
We answer reasonable security and privacy questionnaires and provide the information you need to demonstrate compliance. This agreement applies for as long as we process data on your behalf and prevails over the Terms of use on data protection matters.
Need a signed copy or have questions about this agreement? Get in touch