Privacy Policy

1. Introduction

DMFlow is an Instagram direct messaging automation service that helps businesses respond to comments, story replies, and direct messages in a timely and structured way. We process personal information only to provide, secure, and improve our service.

We may update this policy from time to time. Continued use of DMFlow after a change is posted means you accept the revised policy.

2. Personal Information

Personal information refers to data that identifies or reasonably identifies an individual, including name, email address, business details, Instagram account data, and other information associated with your account. Sensitive personal information may include account credentials, payment information, and data that is subject to stronger legal treatment.

DMFlow only collects personal information that is reasonably necessary to manage the service, provide account support, and uphold legal and security obligations.

3. Information We Collect

Account information (Google sign-in)

You sign in to DMFlow with Google. We receive your Google account ID, name, email address and profile photo. We use them only to create your account, sign you in and contact you about the service. We do not receive your Google password or access to any other Google data.

Instagram information

When you connect an Instagram professional (Business or Creator) account through Meta's official login, and only for the permissions you approve, we process:

• your Instagram account ID, username, name, profile picture, biography, website, and follower, following and post counts;
• basic details of your posts and reels (ID, thumbnail, caption, link), so you can choose which post an automation applies to;
• comments on the posts you select for an automation (comment text, commenter ID and username);
• direct messages and story replies sent to or from your account (text, attachments, timestamps), to run automations and to show your inbox;
• an access token issued by Meta, which is stored on our servers and never exposed in the browser.

We never ask for or store your Instagram or Facebook password.

Content you create

Automation settings, keywords, message text, links and images you upload for automated replies.

Communications

If you contact us, the details you provide (such as your email address and the content of your message).

Technical information

Server logs (such as IP address, browser type and request time) used for security and troubleshooting, and the cookies described in section 6.

4. Information About People Who Interact With Your Account

To run automations and the inbox, DMFlow processes information about people who comment on your selected posts, reply to your stories or message your account: their Instagram-scoped ID, username, name and profile picture (when Instagram provides them), the text of their comment or message, the reply DMFlow sent, and the time and outcome of each automated reply.

This information is used only to send the replies you configured, to show your inbox, and to show you delivery statistics. For this data, you (the business) decide what is sent and to whom, and DMFlow processes it on your behalf.

DMFlow does not track link clicks, does not collect location data from message recipients, does not sell this information, and does not use it to build profiles, for advertising, or for any purpose unrelated to the service.

5. How We Use and Share Information

We use personal information to operate and improve DMFlow, deliver support, maintain account access, monitor service quality, secure our systems, and communicate with customers about product updates or support matters.

Service providers

We use the following providers to run DMFlow. Each one processes data only to provide its service to us:

• Meta Platforms (Instagram API): account connection, comments and messaging
• Google: sign-in
• Vercel: application hosting
• MongoDB Atlas: database
• Cloudinary: storage of images you upload for automated replies

Meta Platform Data

Information we receive from Instagram is used only to provide the DMFlow features you use. We do not sell it, license it, or share it with data brokers or advertising networks. We do not use it for advertising, and we do not use it to make decisions about eligibility for housing, employment, insurance, credit or similar purposes. We do not use it for surveillance.

Google user data

DMFlow's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Legal and safety

We may disclose information if required by law, legal process, or to protect the safety, rights, or property of DMFlow, users, or the public. We may also share aggregated, non-identifying performance data for operational analytics.

6. Cookies and Your Choices

You can request access to the personal information we hold about you, ask for corrections, or request deletion where applicable. You may also choose to stop receiving non-essential communications by contacting us using the details in this policy.

DMFlow uses only essential cookies: one sign-in session cookie (expires after 30 days or when you log out) and short-lived security cookies (10 minutes) that protect the Google and Instagram login flows. We do not use advertising or third-party analytics cookies.

7. Your Rights

Depending on your location, you may have rights to access, correct, delete, restrict, or object to the processing of your personal information. Where processing is based on consent, you may withdraw that consent at any time.

To exercise your rights, contact us at contact@craftoantech.com with the details of your request and the account or message data involved. We will review your request in line with applicable law and the requirements of the service.

8. Data Security

We implement reasonable administrative, technical, and organizational safeguards to protect personal information from unauthorized access, alteration, disclosure, or destruction. These include encrypted connections (HTTPS), access tokens that are kept on our servers and never sent to the browser, verification of every message Meta sends us, and service monitoring.

No system can be guaranteed to be completely secure, and you understand that any data transmission or storage carries some risk. You should keep your account details secure and promptly notify us if you suspect unauthorized access.

9. Data Retention

We keep your data while your account is active and you keep Instagram connected:

• Sign-in sessions: 30 days, or until you log out.
• Instagram data (connection and token, automations, uploaded images, delivery activity, inbox conversations and messages): until you disconnect Instagram or delete your account. Both delete this data immediately.
• Deleted automations: the automation and its image are deleted immediately.
• Images uploaded but never saved to an automation: deleted automatically within 24 hours.

Copies in encrypted infrastructure backups may persist for a limited period before being overwritten.

10. Meta and Instagram Integration

DMFlow integrates with Instagram via Meta's official login and platform permissions framework. This allows the platform to act on behalf of the user for the purposes of account connection, message automation, and related integrations only where the user has expressly granted access.

These integrations may involve access to account profile details, message activity, and related business or content data required for automations. DMFlow does not request or store your Instagram password. We process this information only as needed to provide the requested service and in accordance with Meta's platform rules and our own privacy obligations.

DMFlow is an independent third-party service and is not affiliated with, endorsed by, or sponsored by Meta or Instagram.

11. Account and Data Deletion

You can delete your data at any time:

• Disconnect Instagram (Dashboard → your Instagram account → Disconnect account): immediately deletes your Instagram connection and access token, automations, uploaded images, delivery activity and inbox messages.
• Delete your account (Dashboard → Delete account): immediately deletes your DMFlow account and all data listed above.
• Remove DMFlow from Instagram or Facebook (Settings → Apps and websites): Meta notifies us and we automatically delete all data linked to that connection. You receive a confirmation code and a status link.
• Email us at contact@craftoantech.com from your account email. We complete requests within 30 days.

Full instructions: dmflow.craftoantech.com/data-deletion

12. Children

DMFlow is intended for businesses and is not directed at anyone under 18. We do not knowingly collect personal information from children.

13. International Transfers

Our service providers may store and process data on servers outside your country, including in the United States and the European Union. We rely on their contractual and security commitments to protect it.

14. Changes to This Policy

We may update this Privacy Policy to reflect product changes, legal requirements, or new security practices. Any material changes will be posted on this page and, where appropriate, communicated through the platform or email.

Your continued use of DMFlow after changes are posted constitutes your acceptance of the updated policy.

15. Contact

DMFlow is operated by Craftoantech, India. If you have any questions, concerns, or requests related to this Privacy Policy, contact us at contact@craftoantech.com.