← Back to CreatuAgente

Privacy Policy

Last updated: 3 September 2026

1. General information

CreatuAgente (creatuagente.io) is a platform for creating and deploying artificial intelligence agents. The data controller is CONSULTIA LLC (CreatuAgente), a limited liability company organised in New Mexico (United States), with registered address at 1209 Mountain Road Place NE, STE N, Albuquerque, NM 87110, United States, and contact email info@creatuagente.io.

2. Data we collect

  • Registration data: name, email address and encrypted password.
  • Phone number: used to verify your identity via a one-time passcode (OTP) sent by SMS when creating your account and, where applicable, when changing the number.
  • Usage data: conversations generated by deployed agents, usage statistics and credits consumed.
  • Payment data: managed by Stripe. We do not store credit card data.
  • Integration data: access tokens for third-party services (Instagram, WhatsApp, Gmail, etc.) needed for the agents to work. These tokens are stored encrypted.
  • End-user messages: messages sent to deployed agents (and, on Instagram, the comments the agent replies to) are stored to maintain conversation history and give the agent context in subsequent turns.

3. Use of data

We use the collected data to:

  • Provide and improve the platform's services.
  • Process payments and manage subscriptions.
  • Send service-related communications (no advertising without consent).
  • Comply with legal obligations.

4. Integrations with Meta (Instagram / Facebook)

CreatuAgente lets you connect AI agents with Instagram and Facebook accounts through the Meta API. When you enable this integration:

  • We store your page access token in encrypted form so we can reply to messages automatically.
  • Direct messages received through Instagram/Facebook and, if the business enables comment replies, comments posted on the connected account's own posts are processed by the configured AI models and stored in our database.
  • We do not share your end users' data with third parties, except with the providers needed to generate the responses, detailed in section 4.2 and section 5.
  • You can revoke access at any time from your account settings.
  • The Meta applications through which this integration works are published by IA CONSULTING (30 N Gould St, Sheridan, Wyoming 82801-6317, United States), a business verified by Meta that acts as the registered developer of the applications. CONSULTIA LLC operates the CreatuAgente platform and processes the data as IA CONSULTING's service provider, under a written agreement consistent with the Meta Platform Terms, and as data processor for the connected business.

4.1 Which Instagram and Facebook data we process, and on whose behalf

The business that connects its account is the data controller of its customers' data; CreatuAgente acts as a data processor on its behalf and under its instructions. With the permissions the business grants through Instagram/Facebook login we process:

  • Direct messages (DMs): the content of received and sent messages (text, attachments, and voice notes, which are transcribed to text), their timestamps, and the Instagram-scoped (IGSID) or page-scoped identifiers of sender and recipient, together with the username and profile identifier when the API provides them.
  • Comments: only on the connected account's own posts and only if the business enables comment replies: the comment text, the identifiers of the comment and of the post, and the identifier and username of the author. The private reply the agent sends to the author is stored as part of their conversation.
  • Connected account: the identifier and username of the Instagram professional account or Facebook page, and its encrypted access token.
  • Conversation origin: the reference of the ad, post or link from which the customer started the chat, so the business can measure where its conversations come from.
  • Follow relationship: if the business enables the option to reply only to accounts it follows, we ask Meta whether the connected account follows the user who writes and store that information with the contact.

4.2 Who this content is sent to

To generate each response, the conversation content (messages or comments, together with the agent's configuration) is sent to the AI model providers acting as sub-processors: Google Cloud Vertex AI, which serves the Claude models by Anthropic, Gemini by Google and Grok by xAI depending on the model the business has chosen, and which also transcribes voice notes. Only if we enable the alternative contingency transport is that content sent through OpenRouter, Inc. to the provider of the selected model. None of these providers uses the content to train their models or for advertising purposes under the contracts we have in place. The content is not shared with any other third party.

4.3 Retention and how to request deletion

  • Retention: conversations, comments and contact data are kept while the connected business's account is active and its channel remains connected, to maintain the agent's history and context. When the business deletes its account they are removed within a maximum of 30 days.
  • If the business revokes access from Instagram or Facebook (or disconnects the channel from the dashboard), Meta notifies us and we immediately delete the access token and deactivate the channel, which stops receiving and processing messages. If the channel is disconnected from the CreatuAgente dashboard, the conversation history is kept for the business until it deletes its account or requests deletion.
  • If the business requests deletion of its data through Meta (app data deletion request), we delete the conversations, messages, contacts and appointments associated with that account, remove the token and return to Meta a confirmation code with which to check the status of the request.
  • If you are an end user who has messaged an agent on Instagram or Facebook, you can ask us to delete your data by following the instructions on our data deletion page or by writing to info@creatuagente.io; we will handle the request within a maximum of one month.

5. Sharing data with third parties

CreatuAgente uses the following third-party services to operate:

  • Google Cloud Vertex AI: processing of conversation content to generate AI responses with the Claude (Anthropic), Gemini (Google) and Grok (xAI) models, served from Google Cloud infrastructure; and transcription of incoming voice notes. OpenRouter, Inc. only as an alternative transport for the same models if we enable that contingency path, in which case the content is routed to the provider of the selected model.
  • Stripe: payment processing.
  • Twilio: sending verification codes (OTP) by SMS to verify your phone number.
  • Google Cloud Platform: hosting of the infrastructure, database and storage (Cloud Run, Cloud SQL / PostgreSQL, Memorystore, Cloud Storage).
  • Meta (Facebook/Instagram): sending and receiving messages through their APIs.
  • PostHog: product analytics (heatmaps and session recording) for the dashboard and website, with data hosted in the European Union and a signed data processing agreement. Only enabled with your prior consent.
  • Composio: connectors to the third-party tools the business chooses to link to its agent (Google Calendar, Google Sheets, Gmail, HubSpot, etc.). It only receives the data the agent sends to those tools; it has no access of its own to conversations.
  • Resend: transactional e-mail to the platform's customers (verifications, service notices and, if the business enables it, new-lead notifications with an excerpt of the conversation).
  • ElevenLabs: voice synthesis of the agent's replies, only when the business enables voice-note replies; it receives only the text of the reply to be voiced.

We do not sell personal data to third parties.

6. Data retention

Data is kept while the account is active. When you delete your account, your personal data and that of your agents —including the conversations, messages, contacts and appointments of all your channels— are deleted within a maximum of 30 days, unless there is a legal obligation to retain them. The phone number is kept while the account is active and is deleted when you request account deletion, together with its verification status. Instagram and Facebook data additionally have the specific deletion mechanisms described in section 4.3.

7. User rights

You have the right to access, rectify, erase and port your data, as well as to object to its processing. To exercise these rights, contact info@creatuagente.io. Learn how to delete your data on our data deletion page.

8. Cookies

We use necessary technical cookies to keep your session working and, only if you consent, product analytics cookies (PostHog) for heatmaps and session recording of the dashboard. The legal basis for analytics is your consent, which you can withdraw at any time; recordings are kept for a maximum of 30 days. Form fields and areas holding sensitive data (conversations, prompts, knowledge base, tokens and payment details) are masked or blocked in recordings. We do not record or measure the conversations of our clients' end users: the portal, public demos and custom domains are excluded entirely. We do not use advertising cookies. See our cookie policy for details.

9. Security

We implement technical and organizational measures to protect data: token encryption, HTTPS communications, restricted database access and periodic audits.

10. Contact

For any questions about this policy, you can contact us at info@creatuagente.io.