Privacy policy

Who handles your data

Tocwise is a property showcase and management platform operated by Medusa Digital LTDA. The company is responsible for the account, authentication, security and platform operations described here.

Brokers and agencies decide which listings and contact details to publish and how to use data received during customer service. They are also responsible for their own privacy practices. Tocwise processes automation data according to their configuration and instructions.

Data and purposes

When you send an enquiry through a showcase, your name, reply contact, message and stay intention are delivered to the listing agent’s private inbox. These details support your enquiry, do not confirm a booking and are not displayed publicly. A short-lived identifier helps limit abuse and duplicates. Do not include documents or sensitive details.

We process registration and access information, including names, emails, account and session identifiers, for authentication, account recovery, permissions and support. Never send passwords to support.

Professional profile, contact and registration details, descriptions, locations and property media support your showcase. Published information is visible to visitors; the advertiser chooses what to publish and how much address detail to disclose.

Technical, operational, usage and audit records support security, abuse prevention and troubleshooting. When enabled, metrics record visits and contact clicks; a click does not prove a conversation, lead or sale.

Customer chat and translation

When chat is enabled on a showcase, we store the visitor’s stated name, the associated showcase or property, languages, original messages, delivered text, translations and timestamps to handle enquiries and maintain their history. Conversations are not displayed publicly. Visitor access depends on this browser; the stated name is not verified and does not create an account.

When needed, the text to translate and its languages are sent to the configured translation service. When the feature is enabled, automatic translations use the OpenAI or DeepL API, depending on the feature and account configuration, and may be reviewed by the real estate agent. The full conversation history is not sent to the translator. We preserve the original text and record the translation used during the enquiry.

Closing a chat or unpublishing a property does not automatically delete its history. You can request deletion of a conversation through the contact on this page, identifying the showcase and the approximate date of the enquiry. Do not send documents, sensitive information, passwords or browser security identifiers.

Instagram integration

Connecting is optional and uses Meta’s official authorization. We receive professional account identifiers, username, post information and comment events needed for configured rules. Access credentials are protected on the server and are not part of public pages.

Comment text is processed to match keywords. Comment, post and participant identifiers, timestamps and processing outcomes may be recorded for execution history and duplicate prevention. When enabled, automation sends the private reply and link configured by the professional, subject to Meta permissions and limits.

The integration is not intended to import your entire inbox into a CRM. Account owners can disable rules and disconnect Instagram in the dashboard. To remove previously recorded data, follow the deletion instructions below.

Subscriptions and payments

Stripe processes payments and receives information entered at checkout, such as name, email, billing details and payment method. Tocwise records customer, subscription and invoice identifiers, plan, amounts, payment status and Chat Global usage to activate benefits, renew balances, handle requests and reconcile charges. We do not store full card numbers or security codes. Billing records may be retained after cancellation for applicable obligations and dispute resolution.

Sharing and providers

We use infrastructure providers including Lovable and Supabase for hosting and operations, Resend for transactional emails, Cloudflare for video features and Meta for Instagram integration. AI tools, when used, may send necessary text or images to the configured provider, such as OpenAI. Avoid submitting personal information that the feature does not need.

Providers may process data in other countries under their terms and applicable data protection mechanisms. WhatsApp links and external services have their own policies. Data may also be shared to comply with legal obligations or requests from competent authorities.

Storage, security and retention

Access controls, account separation and credential protection help reduce risks. Data is retained as needed to provide the service, handle requests, protect operations and meet applicable obligations. We do not promise instant deletion from every record and backup.

Deletion requests are reviewed based on the data involved. Records retained for legal or security reasons are limited to the necessary purpose; support will explain applicable restrictions. Unpublishing a listing removes it from the showcase but does not automatically erase stored files and history.

Your choices and rights

You may request confirmation and access, correction, sharing information, deletion, anonymization or restriction where applicable, portability under applicable rules and withdrawal of consent. Requests are free through the contact on this page.

Processing may be based on the requested service, legal obligations, fraud prevention and assessed legitimate operational interests; specific consent is requested where necessary. Instagram authorization enables the technical connection and can be revoked at any time.

The platform uses session and language-preference storage. Metrics features, when enabled, may use short-lived identifiers. Material changes will appear on this page and, when needed, be communicated through platform channels.