Privacy Policy

1. Who this policy applies to

This policy applies to two categories of users:

• Creators — individuals or businesses who sign up for a DMDrop account to manage Instagram automations, create digital storefronts, and sell products.
• Customers / Fans — individuals who purchase digital products or interact with creator storefronts or lookbooks hosted on DMDrop.

2. Information we collect

2.1 Information you provide directly

• Account registration: Full name, email address, and profile picture when you create a DMDrop account (Google or email and password).
• Creator storefront profile: Display name, biography, storefront brand name, and public-facing Instagram handle.
• Instagram / Meta connection: When you connect Instagram with Instagram Login, we receive your Instagram username, Instagram User ID (a numeric scoped identifier assigned by Meta), profile picture URL, and a long-lived Instagram User access token. We encrypt that token at rest using AES-256-GCM. We never receive your Instagram password.
• Payment information: When you purchase a digital product, Dodo Payments (our Merchant of Record) processes your payment card, UPI, or other payment method details directly. DMDrop receives only the outcome of the transaction (success/failure), the amount paid, your email address, and a pseudonymous payment reference ID. We never store raw card numbers, CVV codes, or bank account credentials.
• Support communications: Any content you submit through our contact form or send to our support email.

2.2 Information collected automatically

• Instagram comment, story-reply, and message data: When a campaign is active, DMDrop receives webhook events from the Meta Graph API containing comment text, story-reply or inbound message text, the commenter or sender's Instagram username / Instagram-scoped ID, and the related media ID. This data is used only to decide whether an automated private reply should be sent and to log the automation outcome. Message and comment text in logs is deleted after 90 days.
• Link-click analytics: When a fan clicks an affiliate or lookbook link, we record a one-way hashed IP address (not the raw IP), country of origin, device type (mobile/desktop/tablet), and referring URL. We do not build individual profiles from this data.
• Usage and session data: Standard server logs including browser type, operating system, pages visited, and timestamps. These are retained for up to 30 days for security and performance monitoring via Better Stack.

2.3 Information from third parties

• Meta / Instagram: Basic professional profile information (username, name, profile picture URL) and real-time webhooks for comments and messages, using only the Instagram permissions approved in our Meta App Review submission (instagram_business_basic, instagram_business_manage_comments, and instagram_business_manage_messages). We do not require users to follow an account before receiving a private reply.
• Dodo Payments: Payment status, subscription state, and a Dodo customer identifier. See Dodo Payments' Privacy Policy.

3. How we use your information

• To provide the service: Executing Instagram comment-to-DM automations, delivering purchased digital products via secure pre-signed download links, and rendering creator storefronts and lookbooks.
• Account and billing management: Managing your subscription, sending transactional emails (purchase receipts, download links, billing notifications) via Brevo.
• Platform safety and rate-limit compliance: Tracking Meta API usage to ensure automations stay within the 750 DMs/hour limit mandated by Meta's platform policies.
• Analytics for creators: Aggregating click, view, and DM send counts so creators can evaluate campaign performance. This data is presented in aggregate and does not expose individual fan identifiers to creators.
• Security and fraud prevention: Rate limiting abusive requests. We store a one-way hash of your IP address, not the address itself.
• Legal compliance: Responding to lawful data requests and maintaining records as required by applicable law.

We do not sell, rent, or trade your personal information to third parties for advertising or marketing purposes.

4. Legal bases for processing (GDPR)

Where the General Data Protection Regulation ("GDPR") applies, we rely on the following legal bases:

• Contract performance: Processing necessary to provide the services you signed up for (account management, automation execution, product delivery).
• Legitimate interests: Security monitoring, fraud prevention, aggregated analytics.
• Consent: Where we ask for your permission before processing (e.g. connecting your Instagram account).
• Legal obligation: Compliance with applicable laws and regulatory requirements.

5. Data retention

6. Data sharing and third-party processors

We share your data only with the following categories of processors:

• Dodo Payments — Payment processing and subscription billing as Merchant of Record.
• Meta Platforms, Inc. — Instagram Graph API for automation execution (data flows from Meta to DMDrop via webhooks).
• Email delivery providers — Transactional email (purchase receipts, download links).
• Monitoring and error-tracking providers — Application logs, uptime alerts and error reports (PII is scrubbed where possible).
• Analytics providers — Product analytics (session events, page views; anonymized).

Data we receive from Instagram or Meta is used only to provide the automation features you set up. We do not sell it, use it for advertising, use it to train AI models, or share it with anyone other than the processors listed above.

All processors are bound by data processing agreements. We do not transfer your data outside regions where adequate protections are in place under applicable law.

7. Your rights

Depending on your jurisdiction you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data — see our Data Deletion page for instructions.
• Object to or restrict certain processing activities.
• Data portability (receive your data in a machine-readable format).
• Withdraw consent at any time where consent is the legal basis (e.g. revoking Instagram connection from your profile settings).

To exercise any of these rights, email us at [email protected] or use our contact form. We will respond within 30 days.

8. Data deletion

You can delete your DMDrop account and all associated personal data at any time. We provide two mechanisms:

1. Self-service: Log in, go to your Profile settings, and click "Delete my account" in the Account & Security tab.
2. Email request: Send a deletion request to [email protected].

Full instructions and what gets deleted are described on our Data Deletion page.

Instagram / Meta users: If you connected your Instagram account to DMDrop via Instagram Login or Facebook Login, Meta may send a signed data deletion callback to /api/meta/data-deletion. We honor these callbacks automatically and provide a confirmation URL with a tracking code.

9. Cookies and tracking technologies

DMDrop uses strictly necessary cookies for authentication and to remember your preferences. On our own website and app, we also use product analytics, Google Analytics, and the Meta Pixel to understand usage and measure our marketing. Where the law requires it, these stay off until you accept, and you can reject them at any time using the cookie settings link in the footer. We do not use them on creator storefronts, and we do not use advertising storage or ad personalization. The Meta Pixel shares visit data from our website with Meta Platforms, Inc. See our Cookie Policy for the full list. You can also block cookies in your browser settings; this may prevent you from signing in.

10. Children's privacy

DMDrop is not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has provided us with their information, contact us immediately at [email protected].

11. Security

We protect your data using industry-standard measures including TLS encryption in transit, AES-256-GCM encryption of Instagram access tokens at rest, hashed IP addresses in analytics, and strict role-based access controls on our internal systems. No transmission over the internet is 100% secure; we cannot guarantee absolute security but we promptly investigate and disclose any breach.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the effective date at the top of this page and, where required by law, by direct notification to registered users. Your continued use of DMDrop after a change constitutes acceptance of the revised policy.

13. Contact us

Questions about this Privacy Policy or your data should be directed to: