At a glance
- For your account data, DM Automata is the controller. For your audience's data, you are the controller and we are your processor.
- You have the rights of access, rectification, erasure, restriction, portability and objection.
- A Data Processing Agreement (DPA) with Standard Contractual Clauses is available to customers on request.
1. Controller and processor roles
- Controller: DM Automata, A-266, Triveni Nagar, Jaipur, Rajasthan 302018, India, is the controller of personal data about our customers and website visitors. Contact: [email protected].
- Processor: for personal data of people who interact with a customer's Instagram account, bio page or store, the customer is the controller and DM Automata processes the data on their documented instructions.
2. Lawful bases
| Purpose | Lawful basis (Art. 6 GDPR) |
|---|---|
| Providing the Service, account and billing | Performance of a contract — Art. 6(1)(b) |
| Security, fraud and abuse prevention, service improvement | Legitimate interests — Art. 6(1)(f) |
| Tax, accounting and responding to lawful requests | Legal obligation — Art. 6(1)(c) |
| Non-essential cookies and optional communications | Consent — Art. 6(1)(a), withdrawable at any time |
3. Your rights
Under the GDPR you have the right to:
- access your personal data (Art. 15) — Settings → Data & account → Export data;
- rectify inaccurate data (Art. 16);
- erasure (Art. 17) — see Data Deletion;
- restrict processing (Art. 18);
- data portability (Art. 20) — the export is in a machine-readable JSON format;
- object to processing based on legitimate interests (Art. 21);
- withdraw consent at any time, without affecting earlier processing;
- lodge a complaint with your local data protection supervisory authority.
Email [email protected] to exercise any right. We respond within one month, extendable by two further months for complex requests as the GDPR allows.
4. International transfers
DM Automata is based in India and our providers may process data in other countries. Where personal data from the EEA or UK is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant) together with supplementary safeguards such as encryption.
5. Sub-processors
We use sub-processors for cloud hosting and databases, object storage, email delivery, sign-in (Google), the Instagram API (Meta), payments (your own Razorpay account when you sell) and, only when you use it, AI text generation. Each is bound by a written agreement to protect personal data. Customers can request the current list and a Data Processing Agreement by emailing [email protected].
6. Retention and security
Retention periods and security measures are described in our Privacy Policy. In short: account data is kept while your account is active and erased within 7 days of deletion; Instagram tokens and payment keys are encrypted at rest (AES-256-GCM); passwords are hashed with Argon2id; all traffic is encrypted in transit.
7. Automated decision-making
The automations you create send messages based on rules you set (such as a keyword). DM Automata does not make decisions that produce legal or similarly significant effects on individuals within the meaning of Art. 22 GDPR.
8. Contact
DM Automata · A-266, Triveni Nagar, Jaipur, Rajasthan 302018, India · [email protected]
Grievance Officer
Grievance Officer, DM Automata
Email [email protected] with the subject “Grievance”. We acknowledge within 24 hours and resolve within 15 days.
Related policies