Privacy Policy

Data We Collect

We collect account email addresses for authentication, workspace and billing metadata, connected Instagram account identifiers, encrypted Instagram access tokens, campaign settings, webhook payloads, comments needed to process campaigns, delivery logs, and operational diagnostics.

How We Use Data

We use this data to authenticate users, connect Instagram integrations, match comment keywords, send private replies through the official Meta APIs, prevent duplicate sends, troubleshoot failures, and protect the service.

Instagram And Meta Data

DM Link does not ask for Instagram passwords, scrape Instagram, or use browser automation. Instagram tokens are encrypted at rest and are used only to perform actions authorized by the connected business account.

When you connect an Instagram professional account through Instagram business login, you grant four permissions, and we receive only the data each one covers:

• instagram_business_basic — your account ID, username, name, profile picture and follower count, so we can identify the connected account and show which account each campaign belongs to.
• instagram_business_manage_comments — comments published on your own posts and reels (author ID, username and text), so we can detect the keywords you configured and, when you enable it, post a public reply under the comment.
• instagram_business_manage_messages — sending the private reply you configured to the person who commented, and the messages exchanged in those conversations, shown back to you in your Inbox.
• instagram_business_manage_insights — metrics for your own account and media (daily follower count, views, reach, likes, saves and shares), displayed on your Overview page.

We request no other permission. We access only the connected account’s own data and media, never another account’s. We do not sell this data, use it for advertising, build profiles from it, or combine it across customers.

Automated Experiences

Replies sent through DM Link are automated messages configured by the owner of the connected Instagram account. When someone comments a campaign keyword or interacts with a connected account’s story, they may receive an automated private reply on behalf of that account. These automated experiences follow Meta’s messaging policies, including its messaging windows and rate limits.

Subprocessors

The production service uses infrastructure providers to operate: Hetzner (hosting), Supabase (PostgreSQL database), Redis (queue), Resend (transactional email), and Stripe (payment processing). These providers process data only as needed to run the service.

Retention And Deletion

Customers can disconnect Instagram from settings, which immediately stops all campaigns and processing for that account. The account’s stored data is kept for 30 days so that reconnecting restores it, and is permanently deleted after that period. For immediate account or data deletion, follow the Data Deletion page linked from the footer.

Contact

For privacy questions, contact us at [email protected].