Privacy Policy

1. Overview & Scope

Welcome to DM Flow ("the Service", "Application", "we", "our", or "us"), owned and operated by Satnam Web Services, 209 second floor, Shoolin Complex, Visnagar Rd, Jai Ambe Nagar, Unjha, Gujarat 384170, India (contact: info@thedmflow.com).

DM Flow provides automated workflow software for Instagram Business and Creator accounts, including instant comment-to-DM triggers, follow-gate checks, and conversation performance analytics.

This Privacy Policy explains how we collect, receive, process, store, and safeguard data when:

• Subscribers / Merchants: You register an account, subscribe to our software, and connect your Instagram Professional account via Meta's Graph API.
• End Users / Commenters: You interact with an Instagram post, reel, or direct message hosted on an account powered by DM Flow automations.

2. Information We Collect

We categorize the information we collect into three operational categories:

A. Account & Billing Information (Provided by You)

• Identity Data: Full name, business email address, and authentication credentials (passwords stored strictly as salted, one-way cryptographic hashes).
• Sign in with Google (optional): If you choose "Continue with Google", Google shares your name, email address and a Google account ID with us. We use them only to create and sign in to your DM Flow account. We do not access your Gmail, contacts, Drive or any other Google data.
• Workspace Configuration: Campaign triggers, keyword filters, reply templates, spintax variations, and notification preferences.
• Payment Information: Transaction ID, plan tier, invoice amount, and subscription timestamps processed securely through Razorpay. DM Flow never touches, collects, or stores raw payment card numbers or banking PINs.

B. Meta Platform Data (Collected via Official APIs)

When an account connects through Meta OAuth or token exchange, we receive API tokens and public interaction data authorized by you:

• Instagram Account Profile: Professional username, Instagram Scoped ID (IGSID), linked Facebook Page ID, and profile follower count.
• Public Comment Events: Comment ID, media (reel/post) ID, public comment timestamp, and comment body text used strictly to evaluate keyword matches.
• Direct Messaging Interactions: Scoped recipient ID, message payload text, quick-reply selections, and delivery status events.
• Follow Status (Gate Checks): The tri-state response (follows, not_following, unknown) returned by Meta's Graph API to determine whether to deliver protected links.

C. Operational & Technical Logs

• Browser user agent, IP address for authentication and rate-limiting security, timestamp of access, and webhook delivery verification signatures (X-Hub-Signature-256).

3. Meta Platform Policy & API Disclosures

DM Flow is built in strict compliance with the Meta Platform Terms and Developer Policies. We access Instagram data exclusively through Meta's official Graph API and Webhooks.

4. How We Use Your Information

We process data solely for the following explicit business purposes:

1. Automating Inbound Interactions: Matching keywords in incoming comments and delivering the corresponding direct message requested by the user within seconds.
2. Follow-Gate Verification: Checking whether a commenter is an active follower of the merchant before releasing links, preventing bot abuse and honoring merchant rules.
3. Performance & Analytics: Aggregating flow performance metrics (e.g., number of comments received, DMs dispatched, delivery rates) for the account owner.
4. Workspace Maintenance & Security: Preventing denial-of-service, webhook replay attacks, and unauthorized session hijacking.
5. Customer Support: Assisting you with troubleshooting connection diagnostics, Meta app setup, or billing inquiries.

5. Strict No-Sale & Third-Party Disclosure Policy

We DO NOT sell, rent, license, or barter personal information or Meta Platform Data to any third party for financial or other valuable consideration.

We only share data with vetted service providers that are contractually bound to process data solely on our instructions:

• Meta Platforms, Inc.: Communication over official Graph API endpoints (graph.instagram.com and graph.facebook.com) to deliver automations.
• Cloud Infrastructure: Secure cloud application hosting with automated firewall and DDoS protection (Railway / AWS).
• Payment Processing: Razorpay Software Private Limited (PCI-DSS compliant) processes payments. We receive only the payment ID, amount, method type and status, never your full card number, CVV or UPI PIN.
• Email Delivery: Our email provider (Hostinger) delivers account emails such as verification links, receipts and security alerts.

6. Data Security & Multi-Workspace Isolation

We maintain comprehensive technical and organizational measures to safeguard data against accidental loss, unauthorized access, or tampering:

• Encryption in Transit: All data transmissions are encrypted using Transport Layer Security (TLS 1.3 / HTTPS) with modern cipher suites.
• Multi-Workspace Isolation: Each merchant workspace is strictly sandboxed. Flow rules, contact entries, and access tokens belonging to one workspace can never be accessed or viewed by another merchant.
• Access Token Safeguards: Instagram access tokens and webhook verification secrets are stored securely and never exposed in client-side HTML or marketing scripts.
• Encryption at Rest: Passwords are stored only as salted one-way hashes, and API keys and access tokens are encrypted in our database.
• Session Integrity: Authentication uses HttpOnly, SameSite=Lax secure cookies to prevent cross-site scripting (XSS) attacks.

7. Data Retention & Automatic Pruning

We hold data only for as long as necessary to fulfill the services:

• Webhook Event Payloads: Transient webhook event payloads are processed in memory and pruned immediately after execution.
• Interaction Logs: Delivery timestamps and aggregated metrics are retained while the merchant account remains active.
• Account Closure: If you terminate your DM Flow subscription or delete your workspace, all associated tokens, rules, contacts, and logs are permanently purged within 30 days.

8. Your Legal Rights

Depending on your jurisdiction (including the European Union under GDPR, California under CCPA, and India under the Digital Personal Data Protection Act, 2023), you possess the following rights:

• Right to Access: You can request a complete export of the data we hold regarding your account.
• Right to Rectification: You can update inaccurate account or profile data directly within Settings.
• Right to Erasure ("Right to be Forgotten"): You have the right to request the permanent deletion of your personal data from our systems.
• Right to Revoke Consent: You may disconnect your Instagram account or revoke permissions at any moment directly from Meta settings.

9. How to Delete Your Data (Data Deletion Instructions)

We provide clear, frictionless mechanisms for any user, merchant, or commenter to request permanent deletion of their data:

10. Children's Privacy

DM Flow is a business automation tool intended solely for businesses, professionals, and adults over the age of 18 (or the legal age of majority in your jurisdiction). We do not knowingly collect, solicit, or maintain personal data from minors under the age of 13 (or under 16 in the European Union). If we become aware that personal information of a child has been collected, we will take immediate steps to delete that information.

11. International Regulatory Compliance

We design our systems to comply with leading global privacy standards:

• India DPDP Act (2023): Data is collected only for lawful, specified purposes with clear consent mechanisms and grievance redressal.
• EU/UK GDPR: We operate as a Data Controller for merchant account info and as a Data Processor for end-user interactions executed on behalf of the merchant.
• California Consumer Privacy Act (CCPA/CPRA): We do not sell or share personal information for cross-context behavioral advertising.

12. Cookies

We use one essential cookie to keep you logged in. It is HttpOnly and is not readable by scripts. We do not use advertising or cross-site tracking cookies. Razorpay may set its own cookies inside its checkout window to process and protect your payment.

13. Contact & Grievance Redressal

If you have questions, feedback, or grievance requests concerning this Privacy Policy or your personal data, please contact our Data Protection & Grievance Officer: