DMFlow

Privacy Policy

Last updated: 2026-10-31

1. Who we are

DMFlow (“we”) operates DMFlow, a tool that lets businesses automate replies to comments, story replies and direct messages on their own Instagram professional accounts.

2. Information we process

  • Account information: username, email address and a password (stored only as a salted hash). If you signed up with a referral link, the referral code.
  • Instagram account information you authorize: the ID and username of your Instagram professional account and an access token (encrypted at rest). With the permissions instagram_business_basic, instagram_business_manage_comments and instagram_business_manage_messages we can read your account ID and username and your recent posts and active stories (so you can choose which one an automation applies to), receive notifications about comments on your posts and reply to them, and receive messages sent to your account (story replies and direct messages) and reply to them.
  • Information about people who interact with your account: when a comment, story reply or message triggers one of your automations we receive the person’s Instagram ID and, for comments, their username. The text of a comment or message is used only in memory to check whether it matches your keyword; we do not store it. We store the person’s ID, username (comments only), the time, which automation fired and the delivery status (the “event log”).
  • Content you create: automations, message texts, public reply variants, uploaded images, button titles and links, and a copy of the thumbnail of each post or story you select.
  • Taps and clicks: when someone taps a link button, an opener button or a quick reply we increase a counter. We do not store who tapped; standard server logs may contain an IP address and user agent. The follow-up message is sent to the person who tapped.
  • Payments: plan, amount, status and the reference returned by the payment provider. Card details are handled by the payment provider and never reach us. For card-to-card payments we store the reference note you type.
  • Technical data: IP address, browser and server logs, used for security and troubleshooting.

3. How we use it

To provide and secure the service, to enforce plan limits (we count automatic replies), to prevent abuse and follow Meta’s rules, to provide support, and to meet legal obligations. We do not sell personal data, we do not use Instagram data for advertising, and we do not use it to train AI or machine-learning models.

4. Who we share it with

Meta (Instagram), which is how the service works; infrastructure providers that host the service on our behalf; payment providers (purchase details only); and authorities when the law requires it. We do not sell or license Instagram data to anyone.

5. Retention

  • Access tokens: until you disconnect the account, the token expires, or you remove the app in Instagram.
  • Event logs: personal identifiers (IDs, usernames) are removed automatically after 180 days; only anonymous counters needed for plan limits remain.
  • Automations, images and thumbnails: until you delete them, disconnect the account or delete your account.
  • Payment records: as long as financial and tax rules require.

6. Your choices and deleting your data

  • Disconnect an Instagram account (Accounts page): deletes the token, its automations and images, and removes personal identifiers from its event logs.
  • Delete your account (Settings page): does the above for all accounts and removes your login details.
  • Remove the app in Instagram (Settings → Apps and websites): we receive Meta’s deauthorization or data-deletion request and delete the data automatically. See /data-deletion.
  • People who commented or messaged a business using DMFlow: email us with your Instagram username and we will delete or anonymize your entries within 30 days.

7. Security

Access tokens are encrypted at rest, passwords are hashed, traffic uses HTTPS and access to data is limited to what is needed to run the service.

8. International processing

Data may be processed on servers located outside your country.

9. Children

DMFlow is for businesses and is not directed at children. Instagram’s own minimum-age rules apply.

10. Changes

We will update this page and its date when something changes.

Instagram and Meta are trademarks of Meta Platforms, Inc. DMFlow is not affiliated with or endorsed by Meta.