We Grow

Privacy Policy

Last updated: October 20, 2026

This policy explains how We Grow ("we", "us") collects, uses, shares, stores and deletes personal data through our website bywegrow.com and the We Grow Platform (the software we operate for ourselves and our clients at wegrow.bywegrow.com), including data we receive through Meta's APIs for Instagram. It follows the Brazilian General Data Protection Law (Lei 13.709/2018, "LGPD") and the other data protection laws that apply to us, such as the UAE Personal Data Protection Law and, where applicable, the EU GDPR.

Who is responsible

We Grow is operated by RAINER RUBINGER LTDA, CNPJ 67.691.280/0001-00, Brazil.

• We are the controller of the data of people who visit our website, contact us, book a call, or whom we contact about our own services.
• We act on behalf of our clients (as a processor, "operador" under the LGPD) for the data a client puts into or receives through the We Grow Platform, such as the comments and direct messages of the client's Instagram account and the client's leads. For that data the client is the controller and decides why it is used; we follow the client's instructions and this policy. If you talked to one of our clients, you can also contact that client directly.

Data protection contact (encarregado): contact@bywegrow.com.

What we collect

• Contact details you give us, such as your name, email, phone, company and message, when you fill a form, book a call or write to us.
• Professional contact data from public sources, such as a person's name, role, company and business email, when we or a client look for companies that may need business-to-business services.
• Data from connected Instagram professional accounts, only when the account owner connects it to the We Grow Platform and authorizes it: the account's basic profile (id, username, name, picture), the content the owner publishes through the platform, comments on the account's posts, and direct messages sent to and from the account.
• Data about people who interact with a connected account: when you comment on a post or send a direct message to an account connected to the platform, we receive your Instagram-scoped id, username, name and profile picture as provided by Meta, and the text of your comment or message. We may also receive whether you follow that account.
• Meeting content, such as the transcript of a sales or service call, when a client uses the platform's meeting features for a call you took part in.
• Technical data needed to run and secure the service, such as logs of requests and errors. Our website loads fonts from Google Fonts. Measurement and advertising tags (Google Tag Manager, Google Analytics, Microsoft Clarity, Meta Pixel, LinkedIn Insight Tag) load only after you accept cookies in the banner, and you can change that choice at any time through “Cookie settings”. When you send the contact form we keep the answers you gave, the consent you ticked (with its date and text) and the page and campaign you came from.

How we use it, and on what legal basis

• To publish content on behalf of the account owner, and to show the owner's team the comments and direct messages of that account so they can answer them (performance of the contract with the account owner).
• To run automations the account owner configures, such as answering a comment, sending a direct message with the material the person asked for, or checking whether the person follows the account before sending it (performance of that contract, and the legitimate interest of answering what the person asked for).
• To organize conversations and contacts in the owner's CRM, for example creating a contact or a lead from a direct message (legitimate interest of the owner in following up on the person's request).
• To draft or send replies with the help of AI models, when the account owner turns this on. The owner's team can review, change or stop these replies at any time, and the conversation is handed to a person when it goes beyond what the owner set (performance of the contract).
• To answer you, schedule calls and send you what you asked for (your request, or steps before a contract).
• To contact professionals about business services (legitimate interest). You can ask us to stop at any time by replying to the message or writing to us; we then add your address to a block list that is checked before every send, and keep only what is needed to respect that choice.
• To keep the service secure, prevent abuse and meet legal obligations (legitimate interest and legal obligation).

We do not sell personal data, and we do not use data received from Meta for advertising or for any purpose other than providing the service to the account owner. Automated replies do not make decisions with legal or similarly significant effects on anyone.

Who processes it for us

We use service providers that process data on our behalf and under our instructions: Cloudflare (hosting), Supabase (database), Anthropic and OpenAI (AI models used to draft replies and content), Apify (reading public pages: those of a client's own brand, to learn its style, and the public profiles a client chooses as references for formats), Google (calendar and meeting links, when a client connects a Google account), Telegram (alerts to our own team about our own conversations, never a client's), our email delivery provider (to send the emails we or a client send), and Meta (the Instagram APIs themselves). We do not share personal data with anyone else, except when the law requires it (see "Requests from public authorities").

International transfers

Our providers store and process data in the United States and other countries where they operate. We transfer data only to providers that commit, by contract, to protect it at a level compatible with the LGPD and the other laws that apply, including standard contractual clauses where required.

Data minimization

We ask Meta only for the permissions the features above need, and we keep only the fields those features use: we do not collect followers lists, other people's posts or any data from accounts that were not connected by their owner. Data from one client's workspace is never shared with another client.

How we protect and keep it

Access tokens are stored encrypted and are never shown to users. Each client's data is kept in a separate workspace enforced by the database itself, and access is limited to the people the client grants access to. We keep data while the client uses the service. When an Instagram account is disconnected we delete its access tokens at once; when it is removed from the platform, or when the owner removes our app on Instagram or asks for deletion, we delete the data received through that account. When a client ends the service, everything its workspace keeps is deleted 30 days later, except the records the law requires us to keep (billing and audit records). Conversations with the platform's assistant are deleted 12 months after the last message, and meeting transcripts 90 days after the meeting. Our own contact and prospecting records are kept while they are useful for the relationship and deleted when you ask or when they are no longer needed. Technical logs are kept only as long as needed to run and secure the service.

Requests from public authorities

If a government, court or other public authority asks us for personal data, we review whether the request is legitimate and legally valid before answering. We challenge requests that are unlawful or broader than necessary, disclose only the minimum data the request lawfully requires, and, where the law allows, tell the account owner about the request.

Your rights and deleting your data

Under the LGPD and other applicable laws you can ask us to: confirm whether we process your data; access it; correct incomplete or outdated data; anonymize, block or delete unnecessary or excessive data; receive it in a portable format; know with whom we shared it; delete data processed with your consent, or withdraw that consent; and object to processing based on legitimate interest. Write to contact@bywegrow.com. When the data belongs to one of our clients, we pass your request to that client and help them answer it.

If you connected an Instagram account, you can also remove our app at any time in Instagram (Settings → Apps and websites) or in your Meta account settings; Meta then tells us, and we remove the account's tokens and the data received through it. You can check the status of that request at the link Meta gives you.

We answer requests within 15 days. If you are not satisfied with our answer, you can complain to the Brazilian data protection authority (ANPD, gov.br/anpd) or to the authority of your country.

Children

Our services are for businesses and are not directed to children under 18. We do not knowingly collect data from children; if you believe we did, write to us and we will delete it.

Changes

We may update this policy. The date at the top shows the latest version, and we tell our clients about material changes before they take effect.