Privacy Policy
Last updated October 14, 2026
Summary
- Dconnect connects a company's WhatsApp and Instagram to its Bitrix24. The company decides how its contacts' data is used; Dresultado operates Dconnect on the company's behalf.
- We do not sell data, we do not use contacts' data for advertising, and we do not use conversations to train AI models.
- Messages travel through Meta (WhatsApp and Instagram) and are recorded in the company's own Bitrix24.
- You can request access, correction, deletion and the other rights granted by law. If you are a contact of a company, reach out to that company first.
1. About this policy
Dconnect is a Bitrix24 application that brings a company's WhatsApp Business and Instagram conversations into an inbox inside its own Bitrix24, linked to CRM records (deals, contacts, companies and leads). This policy explains what data we process, why, who we share it with, how long we keep it and how you can exercise your rights.
Dconnect is provided by Dresultado Data Solutions Ltda, Brazilian taxpayer ID (CNPJ) 36.233.896/0001-04, Av. Deputado Leoberto Leal, 604, Sala 201, Barreiros, São José, SC, Brazil.
2. Who is responsible for the data
Data about the company's contacts (customers and prospects who message the company on WhatsApp or Instagram). The company that installed Dconnect is the controller: it decides why and how this data is used. Dresultado is the processor: it processes this data only to provide the service, following the company's instructions and the agreement.
Data about Dconnect users (the company's team in Bitrix24) and security and operational logs. Dresultado is the controller.
3. What data we process
From the company's Bitrix24: portal address, the access credentials granted when the app is installed, the ID, name and language of users who open Dconnect, and the IDs of the CRM records linked to each conversation. When the company configures it, also the CRM fields it authorizes Dconnect to fill in.
About the company's contacts, on the company's behalf:
- channel identity: display name and phone number on WhatsApp; username and ID on Instagram;
- conversation content: text, audio, images, videos, documents and reactions sent and received;
- service information: assignee, transfers, internal team notes, conversation status;
- technical delivery and read receipts.
About the accounts the company connects: IDs of the WhatsApp Business account, the phone number and the Instagram professional account, and the access tokens to those accounts. Tokens are stored encrypted and kept separate per company.
Dconnect does not ask for sensitive data. If a contact shares such information in a message, it receives the same protection as the rest of the conversation, under the responsibility of the controlling company.
4. Purposes and legal bases
Where Dresultado is the controller:
| Purpose | Legal basis (Brazilian LGPD) |
|---|---|
| Installing the app, identifying the Bitrix24 user, providing the contracted service and support | Performance of a contract (art. 7, V) |
| Service security, fraud and unauthorized access prevention | Legitimate interest (art. 7, IX), limited to what is necessary |
| Keeping application access logs | Legal obligation (art. 7, II; Brazilian Internet Civil Framework, art. 15) |
| Issuing invoices and meeting accounting obligations | Legal obligation (art. 7, II) |
Where Dresultado is the processor (contacts' data): the legal basis is defined by the company, which is responsible for it. To send outbound messages, such as WhatsApp message templates outside a conversation started by the contact, the company must have the contact's permission to receive messages on that channel.
What we do not do: we do not sell data; we do not use contacts' data for advertising; we do not use one company's data for the benefit of another; we do not use conversations to train artificial intelligence models.
5. WhatsApp, Instagram and Meta permissions
WhatsApp: messages travel through Meta's WhatsApp Business Platform. According to Meta's documentation, Meta acts as a service provider for this API and may store messages for up to 30 days for the API to work. The company owns the WhatsApp Business account, the phone number and the Meta billing. Dconnect uses the whatsapp_business_messaging permission (receive and send messages) and the whatsapp_business_management permission (read the connected account and phone number and sync approved message templates).
Instagram: the company connects its professional account through Instagram Login. With the company's authorization, Dconnect uses instagram_business_basic (username, ID and account type) and instagram_business_manage_messages (receive and reply to direct messages).
Data received through these permissions is used only to display, reply to and record the company's own conversations in its Bitrix24. The company can disconnect a channel at any time in Dconnect settings. To remove Dconnect's access to the account, it uses the account's own settings (on Instagram, in Apps and websites; on WhatsApp, in the Meta business portfolio). Without access, Dconnect stops receiving and sending messages on that channel.
6. The company's integrations and automations
The company may connect its own systems to Dconnect, such as an automated service agent, through Dconnect's API and webhooks. In that case, Dconnect sends those systems the messages and conversation data needed for the integration, to the addresses the company itself registered. Those systems follow the privacy policy of whoever operates them. Dconnect does not use artificial intelligence on its own to read or reply to conversations.
If the company uses an automation to classify contacts or fill in CRM fields, it is responsible for that automation and for handling requests to review automated decisions. Dresultado helps the company handle them.
7. Who we share data with
- Meta (WhatsApp and Instagram), to carry messages on the connected channels.
- Bitrix24, in the company's own portal, where conversations are linked to the CRM and, if the company turns it on, mirrored in the Contact Center.
- Providers that run the service on our behalf, in the categories listed on the subprocessors page, under contracts with data protection obligations equivalent to ours.
- Systems the company itself connects through the API and webhooks, as described in section 6.
- Public authorities, when required by law or court order.
8. International transfers
The infrastructure that runs Dconnect is located in the United States, and Meta and Bitrix24 may process data outside Brazil. These transfers follow article 33 of the LGPD and the regulations of the Brazilian Data Protection Authority (ANPD), through contractual clauses or another valid mechanism.
9. How long we keep data
- During the agreement: for as long as the company uses the service.
- After termination or uninstallation: the company may request an export of its data in an open format within 15 days, and Dresultado deletes its own copies within 60 days, except where the law requires retention. Conversations already recorded in Bitrix24 remain in the company's portal, under its control.
- Media files (audio, images and documents): kept for the same period as conversations; access links expire after 7 days.
- Application access logs: 6 months, as required by the Brazilian Internet Civil Framework.
- Technical operation logs, without message content: up to 90 days.
- Backups: deleted in their expiry cycle, within 30 days.
- Tax and accounting records: for the period required by tax law.
10. Security
We apply technical and organizational measures to protect data: separation of data per company, conversation visibility defined by the company's administrator, encryption of credentials at rest and of connections in transit, signed and verified webhooks, and technical logs without message content.
Incidents. If a security incident may cause relevant risk or harm to data subjects, Dresultado notifies the company within 72 hours of becoming aware of it and helps with the response. Where the company is the controller, it notifies the authority and data subjects within the regulatory deadlines. Where Dresultado is the controller, it does so itself.
11. Your rights
You may request: confirmation that we process your data and access to it; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data or data processed unlawfully; portability; deletion of data processed based on your consent; information about who we share your data with; information about the possibility of not consenting and its consequences; withdrawal of consent; and review of decisions made solely by automated means. If you are in a jurisdiction that grants you additional rights, we will honor them as required.
How to request. If you are a contact of a company that uses Dconnect, send your request to that company, which is the controller; if you cannot reach it, write to privacidade@dresultado.com and we will forward the request. In all other cases, write to the same address. We may ask for information to confirm your identity before acting. Full access requests are answered within 15 days. You may also file a complaint with the Brazilian Data Protection Authority (ANPD) or with your local data protection authority.
To request data deletion, see the data deletion page.
12. Children
Dconnect is a business tool and is not directed at children. If a company talks to minors, it must process their data in the best interest of the child or adolescent, as required by law.
13. Data protection officer and contact
Data protection officer: Eduardo da Silva Dutra, privacidade@dresultado.com. Dconnect support: suporte@dresultado.com.
14. Changes
We may update this policy. The version date is shown at the top of the page. Relevant changes are communicated to companies in advance.
This English version is provided for convenience. If there is any conflict, the Portuguese version prevails.