Privacy Policy

Last updated: September 2, 2026

DMComments is an Instagram DM automation tool for creators and businesses. This policy describes what data we access, how we use it, and how you can have it deleted.

Data we access from Instagram

When you connect an Instagram professional account through Instagram Business Login, we access — with your explicit authorization and only within the permissions you grant:

• Basic profile (instagram_business_basic): your username, name, profile picture, follower and media counts, and your media metadata (captions, thumbnails, counts). Used to show your account in the dashboard and let you pick posts for automations.
• Comments (instagram_business_manage_comments): comments on your media, so automations you configure can reply publicly, and so comment moderation you enable can flag or hide comments on your account.
• Messages (instagram_business_manage_messages): direct messages sent to your account, so automations you configure can respond, deliver links you set up, and capture leads into your CRM.

We never post to your account, follow or unfollow anyone, or send messages except as an automation you explicitly configured.

Other data we collect

• Your account details (email, name, optional phone) and settings.
• Contacts and leads generated by your automations (the Instagram usernames of people who interacted with your account).
• If you sell products: your product listings and buyer order details (buyer name, email, phone) needed to deliver purchases; payment card details are handled entirely by our payment providers and never touch our servers.
• If you request seller payouts: KYC details (PAN, Aadhaar, bank account), stored encrypted, used only to verify payout eligibility.

How we use data

Solely to operate DMComments for you: running the automations you set up, showing activity in your dashboard, maintaining your contact list, processing purchases, and sending transactional email (verification codes, receipts). We do not sell your data. We do not share it with third parties except the service providers required to run DMComments (hosting, database, email delivery, payment processing, and — only if you enable AI Replies — an AI provider), each bound to use it only on our behalf.

AI features

If you enable AI Replies, the text of incoming direct messages to your connected account, together with the business description you wrote in your AI settings, is sent to our AI provider (OpenAI) solely to generate the reply you configured. No Instagram profile information, usernames, follower data, media, or access tokens are sent to any AI provider, and per the provider's API terms this data is not used to train their models. Disable AI Replies at any time to stop this processing.

Cookies and local storage

DMComments does not use advertising or third-party tracking cookies. The app stores a login token in your browser's local storage to keep you signed in, and an anonymous per-session identifier used only for measuring product performance. Payment providers may set their own cookies on their checkout pages under their own policies.

Storage and security

Data is stored in a managed PostgreSQL database. Instagram access tokens and KYC identifiers are encrypted at rest (AES-256-GCM). Transport is HTTPS everywhere. Access is limited to the operator of the service.

Retention and deletion

Data is retained while your account is active. Disconnecting an Instagram account immediately stops all collection for it and deletes its stored access token. You can permanently delete your entire account and data at any time — see Data Deletion for exactly what happens. Financial records we are legally required to keep (invoices, order records) are retained in anonymized form for the statutory period.

Your rights

You may request a copy of your data, correction, or deletion at any time via the in-app tools or by emailing us. We respond within 30 days.