Privacy Policy

DM Automata (“DM Automata”, “we”, “us”) provides Instagram DM automation, a link-in-bio page, an app opener, a creator store and related tools at dmautomata.com and app.dmautomata.com (the “Service”). Our address is A-266, Triveni Nagar, Jaipur, Rajasthan 302018, India.

This policy applies to:

• Our customers — people and businesses who create a DM Automata account. For your account data, DM Automata is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).
• Our customers' audiences — people who comment, reply to a story, mention or message an Instagram account that uses DM Automata, or who visit a customer's bio page or buy from their store. For this data our customer is the Data Fiduciary and DM Automata acts as a Data Processor on their behalf (see section 14).
• Visitors to our website.

We process personal data in accordance with:

• the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025;
• the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;
• the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, to the extent they apply to content our customers publish through the Service;
• the Consumer Protection Act, 2019;
• the Meta Platform Terms and Developer Policies for Instagram data, and the Google API Services User Data Policy for Google sign-in.

If you are in the European Economic Area or the UK, our GDPR notice explains the additional rights you have.

Account and profile

• Name, email address and password (stored only as an Argon2id hash), or the name, email and profile picture shared by Google or Instagram when you sign in with them.
• Workspace name, team members you invite and their roles.

Instagram data (via Meta's official Instagram API)

When you connect an Instagram professional account, and only with the permissions you grant, we access:

• your Instagram account ID, username, name, profile picture and follower count;
• your posts, Reels and stories (captions, media links, like and comment counts);
• comments on your media, replies and mentions on your stories, and direct messages sent to your account, including the sender's Instagram-scoped ID and username;
• an access token that lets the Service act for your account, stored encrypted (AES-256-GCM).

Your audience and contacts

• For people who interact with your account: their Instagram username and ID, the messages exchanged, tags, status, and any email address they choose to share in a conversation.
• For bio page visitors: page views and link clicks (counts). For store buyers: name or Instagram handle, email if provided, and order details.

Payments

• If you sell through the creator store, payments are processed by your own Razorpay account. We store your Razorpay API keys encrypted and receive order status from Razorpay; we do not store card, UPI or bank details.

Technical and usage data

• IP address and browser (user agent) for each login session, used to keep your account secure.
• Service logs and error reports needed to operate and secure the Service.

Content you create

• Automations, messages, broadcasts, bio pages, app opener links, products, scheduled posts and media you upload.
• If you use “Generate with AI”, the keyword and short context you type are sent to an AI model provider to draft message suggestions.

Support

• Messages you send us by email or through our contact form.

We do not intentionally collect sensitive personal data such as health, biometric or financial account data. Please don't send it to us.

We process personal data on the basis of your consent (given when you create an account and connect Instagram, which you can withdraw at any time) and for legitimate uses permitted by Section 7 of the DPDP Act, such as complying with law. We use it to:

• create and secure your account, and authenticate you;
• run the automations you configure — reading comments, story replies, mentions and messages and sending the replies you set up;
• show your inbox, contacts, analytics, bio page and store;
• schedule and publish content you ask us to publish;
• process store orders through your payment provider and confirm payments;
• send service emails (verification, password reset, security and billing notices) and respond to support requests;
• prevent fraud, abuse and spam, and enforce our Terms of Service;
• comply with legal obligations and lawful requests from authorities.

We do not sell personal data, use Instagram data for advertising or profiling, or use your or your audience's data to train AI models.

• We access Instagram data only through Meta's official APIs, only with the permissions you grant, and only to provide the features you use.
• We never ask for or store your Instagram password.
• We don't sell, license or share Instagram data with data brokers or advertisers, and we don't combine it with data from other sources to build profiles.
• When you disconnect an Instagram account or delete your DM Automata account, we stop accessing it immediately and delete the related data as described in section 9.
• You can also remove DM Automata's access at any time in Instagram: Settings → Apps and websites.

Instructions for requesting deletion are on our Data Deletion page.

If you sign in with Google, we receive your name, email address and profile picture only, and use them solely to create and sign you in to your account. DM Automata's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We share personal data only as needed to run the Service, with processors bound by contract to protect it and use it only on our instructions:

• Meta Platforms — to read and send Instagram messages and comments and publish content through the Instagram API.
• Cloud hosting and database providers — to host the Service and store data.
• Object storage provider — to store media you upload for scheduling.
• Email delivery provider — to send service emails.
• Google — to sign you in, if you choose Google sign-in.
• Razorpay — your own payment account, when you sell through the store.
• AI model providers — only the text you enter when you use “Generate with AI”.
• Integrations you connect — only the data needed for the integration you enable.

We may also disclose data to government agencies or courts where required by Indian law (including under the IT Act, 2000 and its rules), to protect the rights and safety of our users or the public, or to a successor if DM Automata is merged or acquired, subject to this policy.

Our servers and service providers may be located in India or in other countries. Where personal data is transferred outside India, we do so in accordance with Section 16 of the DPDP Act and any restrictions notified by the Government of India, and we require our providers to protect it to the standard described in this policy.

We may keep limited data longer where required by law or to resolve disputes. Once data is no longer needed for its purpose, we erase it, in line with Section 8(7) of the DPDP Act.

We maintain reasonable security practices and procedures as required by Section 43A of the IT Act, 2000, the SPDI Rules, 2011 and Section 8(5) of the DPDP Act, including:

• encryption in transit (HTTPS/TLS) and encryption of Instagram access tokens and payment keys at rest (AES-256-GCM);
• passwords stored only as Argon2id hashes;
• signed webhooks, rate limiting and role-based access controls;
• access to production data limited to people who need it.

No system is completely secure. If a personal data breach occurs, we will inform affected users and the Data Protection Board of India as required by the DPDP Act and Rules, and CERT-In where required.

Under the DPDP Act you have the right to:

• Access a summary of your personal data and how it's processed — use Settings → Data & account → Export data, or email us;
• Correct, complete or update your data — edit it in the app or ask us;
• Erase your data — delete your account in Settings → Data & account, or follow our Data Deletion steps;
• Withdraw consent at any time, as easily as you gave it — disconnect Instagram or delete your account (this doesn't affect processing already done);
• Nominate another person to exercise your rights in the event of death or incapacity;
• Grievance redressal — complain to our Grievance Officer (section 15), and if not satisfied, to the Data Protection Board of India.

To exercise a right, email [email protected] from your account email. We may verify your identity before acting and will respond within the time required by law.

The Service is for people aged 18 and over. We do not knowingly process personal data of children (anyone under 18, as defined by the DPDP Act) or track or target advertising at them. If you believe a child has created an account, contact us and we will delete it.

We use cookies and browser storage that are strictly necessary — to keep you signed in securely, remember that you're signed in across our sites, and remember your cookie choices — and preference storage, such as your chosen brand colour.

We do not currently use advertising or third-party analytics cookies. If we add analytics or marketing cookies in future, we will only set them after you allow them in the cookie banner, which you can reopen any time from “Cookie settings” in the footer.

If you commented on, replied to, mentioned or messaged an Instagram account that uses DM Automata, or visited its bio page or bought from its store, that account owner decides how your data is used and is responsible for it. DM Automata processes it only to provide the Service to them.

To access, correct or delete that data, please contact the account owner first. If you can't reach them, email us at [email protected] with the Instagram account and your username and we will help. You can stop automated messages at any time by not engaging further or by blocking the account on Instagram.

In accordance with the IT Act, 2000 and its rules, and the DPDP Act, our Grievance Officer is:

Grievance Officer, DM Automata
A-266, Triveni Nagar, Jaipur, Rajasthan 302018, India
Email: [email protected] (subject: “Grievance”)

We acknowledge complaints within 24 hours and aim to resolve them within 15 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

We may update this policy as the Service or the law changes. We'll post the new version here with a new effective date and, for significant changes, notify you by email or in the app before they take effect.

Questions about this policy or your data: [email protected] · A-266, Triveni Nagar, Jaipur, Rajasthan 302018, India