Privacy Policy — VYRA

Last updated: November 1, 2026

This page is also available in Português (Brasil). In case of discrepancy, the Portuguese version prevails.

VYRA is a scheduling, publishing, engagement and performance platform for Instagram professional accounts (Business or Creator), operated by 43.926.284 Marcilio de Souza da Silveira (Brazilian company registration CNPJ 43.926.284/0001-54), based in Brazil. This policy describes which data we process, why, for how long, with whom we share it and how you exercise your rights. It applies to the VYRA dashboard (api.vyraflow.com.br) and to this website.

1. Who is who

• Customer: the business or person who creates a VYRA account (a "workspace") and connects to it one or more Instagram professional accounts they manage.
• Workspace users: the people the customer invites to operate the dashboard, each with a permission role.
• Third parties: people who comment on the posts of, or send direct messages to, the connected Instagram account. They are not VYRA customers; their data reaches us through Meta's platform, on behalf of the customer.

For third-party data, VYRA acts on behalf of the customer, who owns the Instagram account and decides how to serve them.

2. Data we process

2.1 VYRA account

• Name, e-mail and password (stored only as a hash), workspace role, login sessions.
• An audit log of actions taken in the dashboard (who did what and when), visible to the users of the same workspace.
• Subscription data: plan, billing status and the customer identifier at Stripe. Card data never passes through VYRA.

2.2 Instagram account connection

• The connection uses Meta's official login (Instagram API with Instagram Login). VYRA never receives or stores the Instagram password.
• We store the access token issued by Meta, encrypted, and its expiry. The token is used exclusively for API calls on behalf of the account that authorised it, and is renewed automatically while the account stays connected.
• Profile data of the connected account: identifier, username, name, profile picture, follower count and media count.

2.3 Media and posts

• The list of media already published on the account (identifiers, links, thumbnails, dates), imported for the history and for metrics.
• The videos, captions and times the customer sends to VYRA for publishing. The video file stays on VYRA's server until the publication is confirmed and is removed automatically 72 hours later; the publication record (title, link, metrics) remains.

2.4 Comments

• Comments received on the connected account's posts, delivered by Meta via webhook: identifier, text, username and identifier of the commenter, date.
• Public replies sent by VYRA (manual or automated) and the outcome of each send.

2.5 Direct messages

• Direct messages received by the connected account, delivered by Meta via webhook: identifier, text, date, direction (received or sent) and, when present, the attachment links. Attachments are not downloaded: VYRA stores only the temporary link provided by Meta, which expires.
• Information about the sender, when Meta provides it: the messaging identifier and, only for people who have already messaged the account, name, username and profile picture, obtained from Meta's API to identify the conversation in the dashboard.
• Replies sent by VYRA (manual, by automation or by flow) and the outcome of each send.

2.6 Metrics and insights

• Account metrics (for example reach, interactions, profile visits, followers) and per-post metrics, read from Meta's insights API and stored as historical series for the dashboard reports.
• When Meta does not provide a value, the dashboard shows "unavailable"; VYRA does not estimate values.

2.7 Webhooks

• Meta sends notifications (webhooks) for comments, messages and button clicks. Each notification is verified against Meta's signature and stored with its raw content for processing, reprocessing after a failure, and diagnostics.
• Notification types VYRA does not process (for example reactions and mentions) produce no records about people in the product screens, but are kept with their raw content, like the others.

2.7.1 Reads and clicks

• When a person reads in Direct a message sent by a flow and Meta notifies us, VYRA stores the date of that read. People who turn off read confirmations on Instagram do not generate this notification.
• Link buttons in flow messages pass through VYRA before opening the destination. VYRA stores which button was clicked and when, linked to the contact of that execution. That record does not store the IP address or browser of the person who clicked. The web server's technical logs, as with any visit to a website, may record them for security and diagnostics, without linking them to the contact.
• This data appears in the flow performance panel, lets the customer measure the campaign, and can decide the next step of a flow they configured (for example, sending a reminder to people who did not click).

2.8 Technical records

• Operational and failure records of calls to Meta's API: internal identifiers, error codes, timestamps and durations. These records contain no tokens, passwords, message text, names or photos of people.

2.9 Proxies configured by the customer

• The customer may configure their own HTTP proxy for the API calls made on behalf of an account. In that case we store the proxy address and credentials (encrypted), and calls to Meta go through the proxy provider chosen and contracted by the customer. The connection test queries a public IP lookup service with the proxy's egress address; no personal data is sent in that test.

3. Why we use the data

Every action on the Instagram account follows an instruction by the customer: a schedule, a reply they sent, an automation rule or a flow they activated. We do not use the data for advertising, we do not sell it, and we do not use it to train artificial-intelligence models.

4. Automations and flows

The customer can create keyword rules (publicly reply to a comment and/or send a direct message to the person who commented) and conversation flows (sequences of messages and buttons in Direct, which can include waits and reminders). They act only on the customer's own account, with texts written by the customer, and can be paused or deleted at any time. Every execution is recorded in the workspace history.

5. With whom we share

• Meta Platforms, Inc.: every call to the Instagram API required by the service (publish, reply, read metrics). Meta's use of that data is governed by Meta's own policy.
• Hosting: VYRA's servers, database and backups run on infrastructure of Hetzner Online GmbH, in the European Union. This is an international transfer of data, carried out with the safeguards required by the Brazilian data protection law (LGPD).
• Stripe: subscription and payment processing.
• Transactional e-mail provider: delivery of invitations and password resets.
• Proxy provider chosen by the customer (only when the customer configures one, section 2.9).

We do not sell data and we do not hand it to third parties for advertising.

6. Storage and security

• All traffic uses HTTPS. Access tokens and proxy credentials are stored encrypted.
• The dashboard requires authentication. Each user sees only the workspace they belong to, with the role they were given; isolation between workspaces is also enforced in the database.
• Actions in the dashboard are audit-logged. Backups are taken regularly.

7. How long we keep it

• VYRA account data: while the account exists, or until a deletion request.
• Data obtained from the Instagram account (profile, media, comments, messages, metrics): while the account is connected and, after it is disconnected or removed, until a deletion request (section 8) — the history remains available to the customer until then.
• Video files uploaded for publishing: removed 72 hours after the publication is confirmed.
• Revoked login sessions: 7 days.
• Content of webhook notifications: 30 days after receipt when processed, and 90 days in all other cases. After that only a technical record remains, with no text and no personal data. Those of an account are deleted on a deletion request. Database backups currently have no fixed expiry and may keep this content; they are not used in the product.
• Other technical records: for as long as needed for diagnostics.
• Data we must keep under legal or accounting obligations: for the required period.

8. Disconnection and deletion

You can disconnect the Instagram account at any time, in the dashboard (Accounts → Unlink or Remove) or on Instagram (Settings → Apps and websites). Disconnecting ends the access immediately: the token is discarded, future schedules are cancelled and the account stops receiving events. The history remains until a deletion request. A notification Meta still delivers after that is kept like the others, but is not processed.

For deletion there are two paths, described on the Data Deletion page:

• Through Instagram: when removing VYRA under Apps and websites, you can request deletion of your data. The request reaches us automatically, receives a confirmation code and is executed without manual intervention. It deletes the comments, messages, contacts, public replies, automation and flow history and metrics obtained through the account, deletes the account's webhook notifications, and removes the Instagram identifiers and links from the account and its publications. Progress can be followed with the code.
• By e-mail: for complete removal, including the content the customer uploaded and the VYRA account, write to marcilio1995a12@outlook.com. We complete it within 30 days.

9. Your rights

Under the Brazilian General Data Protection Law (Law 13.709/2018) you may request confirmation of processing, access, correction, portability, anonymisation or deletion of your data, and withdraw the consent given to the connection. Requests go to the contact e-mail. Third parties who commented on or messaged a connected account may also write to us; when the request concerns a specific customer, we will forward it to that customer.

10. Audience

VYRA is intended for businesses, creators and professionals who manage Instagram professional accounts. It is not directed at people under 18.

11. Changes

This policy may be updated. The date at the top indicates the current version. Relevant changes will be communicated to customers at their registered e-mail.

12. Contact

Questions and requests about data: marcilio1995a12@outlook.com.