Privacy policy
This policy explains what data DM Flow collects, why, where we store it, how long we keep it and how you can delete it. In short: we use your data only to run DM Flow for you. We do not sell it, use it for advertising or use it to train AI models.
Last updated
Who we are
DM Flow (dmflow.app) is operated by MudBloom Studio, India (“we”, “us”). For privacy questions, requests and complaints, email hello@dmflow.app.
Under India’s Digital Personal Data Protection Act, 2023 (the DPDP Act), we are the data fiduciary for the data about your DM Flow account. For the messages and contacts of the Instagram account you connect, you, the business, decide why that data is processed, and we process it for you to provide DM Flow.
What we collect
Your DM Flow account
You sign in with Google. Google shares your name, email address, Google account ID and profile picture link with us. We never see your Google password, and we do not keep Google access tokens.
Your Instagram account
When you connect an Instagram Business or Creator account through Instagram’s official login, we receive the account’s IDs, username, name and profile picture link, and an access token that lets DM Flow act for the account. We store the token encrypted, with its expiry date. We never see your Instagram password.
We ask Instagram for three permissions only:
- instagram_business_basic: to read the account’s profile and list its posts and reels, so you can choose where an automation listens.
- instagram_business_manage_comments: to receive comments on your posts and reels and to answer a comment with a private reply.
- instagram_business_manage_messages: to receive the DMs people send your account and to send the replies you set up or write.
Messages, comments and contacts
To show your inbox and run your automations, we receive and store:
- the comments and DMs people send your account, with their time;
- the replies your automations or you send, with their delivery status;
- for each person who comments or writes (a “contact”): their Instagram-scoped ID, and their username, name and profile picture link when Instagram provides them; when they first wrote; whether the 24-hour reply window is open; the tags you add; and whether they asked not to get messages.
We also store the notifications (webhooks) Instagram sends us about new comments and messages, for 30 days.
Your automations
Their names, keywords, match settings, reply texts and the posts they listen on.
Feedback
The feedback you send in the app, with the page you sent it from.
Technical data
Our servers log each request with its time, IP address and path, to keep DM Flow secure and to fix problems. The app keeps a sign-in token in your browser’s local storage, so you stay signed in for up to 7 days. We do not use advertising or tracking cookies.
Website visits
dmflow.app uses Cloudflare Web Analytics to count page visits. It does not use cookies.
How we use data
We use data only to:
- run DM Flow: receive comments and messages, send the replies you set up, and show your inbox, contacts and analytics;
- check every message against Instagram’s rules before it goes out;
- keep accounts and DM Flow secure, and prevent abuse such as spam;
- answer your support requests and feedback, and tell you about important changes;
- meet our legal obligations.
We do not sell or rent personal data. We do not use Instagram data for advertising or profiling, we do not give it to data brokers, and we do not use it to train AI models.
Legal bases. Under the DPDP Act, we process your data with the consent you give when you sign up and connect your account, or for the legitimate uses the Act allows. If you are in the EU or the UK, our legal bases are: the contract with you (to provide the service you asked for), our legitimate interests (security, preventing abuse and improving DM Flow), legal obligations, and your consent where we ask for it.
Who we share data with
Only with the providers that help us run DM Flow, and only the data they need for that:
| Provider | What it does for us | Where |
|---|---|---|
| Render | Runs our servers and website | United States |
| Supabase | Hosts our database | United States |
| Sign-in | Global | |
| Meta (Instagram) | Delivers your Instagram comments and messages, and sends your replies, through its official API | Global |
| Cloudflare | Delivers our website and counts visits | Global |
We may also share data when the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of our business. In that last case, we tell you first.
Where data is stored
Our servers and our database are in the United States. If you use DM Flow from India, the EU or anywhere else, your data is transferred there. We transfer data only as the law allows, under our providers’ data protection terms.
How long we keep data
| Data | How long we keep it |
|---|---|
| Your DM Flow account | Until you delete your account |
| Instagram access token | Until you disconnect the account in DM Flow or remove DM Flow from it on Instagram |
| Messages, comments and contacts | Until you ask us to delete them, ask Instagram to have them deleted, or delete your account |
| Instagram notifications (webhooks) | 30 days |
| Server logs | A limited time, kept by our hosting provider |
| Feedback | As long as we need it to improve DM Flow |
When you delete your account, we delete your data within 30 days, except data the law requires us to keep. See how to delete your data.
How we protect data
- All traffic to DM Flow uses HTTPS.
- We encrypt Instagram access tokens (AES-256-GCM) before we store them.
- Our database’s public API is locked, so only DM Flow’s servers can read the data.
- We ask Instagram only for the permissions DM Flow needs.
No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.
Your rights
You can ask us to:
- tell you what data we hold about you and how we use it;
- correct, complete or update it;
- delete it;
- give you a copy of it;
- stop using it for a purpose, or withdraw your consent (we may then be unable to provide DM Flow);
- accept a person you nominate to use these rights for you if you die or cannot act yourself (India).
To use a right, email hello@dmflow.app from the email address you sign in with. We answer within 30 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India or, in the EU or the UK, to your data protection authority.
If you message a business that uses DM Flow, we process your data for that business. Ask the business first. You can also email us, and we will help.
To delete the data from an Instagram account, follow these steps.
Children
DM Flow is for businesses and creators. It is not meant for anyone under 18, and we do not knowingly collect data about children.
Changes to this policy
When we change this policy, we update this page and the date at the top. For important changes, we tell signed-in users in the app or by email before the changes take effect.
Contact
MudBloom Studio, India. Email: hello@dmflow.app. See also our terms of service.