On this page
- We collect what we need to run your automations, and nothing for ads.
- We never sell data, and we don’t train AI models on your account or your followers’ messages.
- Your Instagram password never reaches us. You connect through Instagram’s own login.
- For your followers’ data, you’re in charge and we work on your instructions.
- Delete your account any time from Settings. Your data is erased straight away, with no grace period.
1.Who we are and what this covers
DMChat is run by DMChat, Navi Mumbai, Maharashtra, India (“DMChat”, “we”, “us”). This policy covers dmchat.io, the DMChat app, and our emails.
We handle two kinds of personal data, and our role is different for each:
| Whose data | Examples | Who decides how it’s used |
|---|---|---|
| Yours, as a DMChat user | Your name, email, plan, settings | We do. Under India’s DPDP Act we are the Data Fiduciary, and under GDPR the controller. |
| Your audience’s: people who comment on or message your account | Their username, the comment that matched, an email they gave you | You do. We process it only to run the automations you set up, as a processor. |
2.What we collect
| What | Details | Where it comes from |
|---|---|---|
| Account | Name, email address, Google account ID, profile photo link | Google sign-in |
| Instagram account | Username, Instagram user ID, account type, access token, and the IDs, captions and thumbnails of posts you pick | Instagram login |
| Your setup | Keywords, messages, links, lead forms, Comment Guard rules, notification settings | You |
| Your audience | Instagram username and ID of people who trigger an automation, what they triggered, what we sent, whether they tapped the link, whether they follow you (when you use followers-only links), and their answers to your lead forms, such as an email or phone number | Instagram, and the people themselves |
| Billing | Plan, amount, currency, country, Razorpay customer and payment IDs. We never receive your full card number. | Razorpay |
| Support | Your messages and any files you attach | You |
| Technical | IP address and the approximate city it maps to, browser and device type, sign-in and security events, error reports. The city is shown next to your sign-ins so you can spot one that is not yours. | Your browser |
3.Instagram permissions we ask for
When you connect Instagram, we ask for three permissions and nothing more:
- instagram_business_basic: your username, ID and posts, so you can pick which posts an automation runs on.
- instagram_business_manage_messages: to send the DMs you set up and receive replies to them.
- instagram_business_manage_comments: to see comments on your posts, reply to them, and hide the ones Comment Guard catches.
We don’t ask to publish posts or read your insights. You can remove our access at any time in Instagram, under Settings → Apps and websites.
4.How we use it
| Purpose | Legal basis |
|---|---|
| Signing you in and running the automations you set up | Our contract with you |
| Showing your analytics, contacts and leads | Our contract with you |
| Billing, invoices and tax records | Contract and legal obligation |
| Service and security emails (sign-in alerts, failed payments, plan limits) | Contract and legitimate interest |
| Alert emails, like a new brand deal or lead | Your consent. Turn them off in Settings. |
| Stopping spam, fraud and abuse, and keeping Instagram accounts safe | Legitimate interest |
| Fixing bugs and improving DMChat | Legitimate interest |
We don’t sell personal data, show ads, use Instagram data for advertising, or use your content or your audience’s messages to train AI models.
Data we get through Google sign-in is used only to sign you in, and follows the Google API Services User Data Policy, including its Limited Use requirements.
5.Comments and messages
Most comments and messages are checked against your rules and then discarded. We keep text in only three cases:
- Comment Guard keeps up to 280 characters of a comment it hid, so you can see why and put it back.
- Brand deal alerts keep up to 500 characters of a DM that looks like a collaboration offer, so you can read it.
- Lead forms keep the answers people type in, because that’s the point of the form.
For every automation run we also keep a record of who triggered it, which automation, when, and what happened. Section 8 says for how long.
6.Who we share it with
We share data only with the companies that help us run DMChat, and only what each one needs:
| Company | What they do for us | Location |
|---|---|---|
| Supabase | Database | Japan (Tokyo) |
| Vercel | Hosting the app and website | Japan (Tokyo), plus a global network |
| Meta | Instagram messages and comments | Global |
| Sign-in | Global | |
| Razorpay | Payments | India |
| Brevo | Sending emails | European Union |
| Sentry | Error reports | United States |
| Cloudflare Turnstile | Bot checks on forms | Global |
We may also share data when the law requires it, to protect people from harm, or as part of a merger or sale, in which case this policy keeps applying to your data.
7.Where it’s stored
Our database and servers are in Tokyo, Japan. Some of the companies above work from other countries. When data leaves India or the EU, we rely on the safeguards the law allows, such as the European Commission’s standard contractual clauses.
8.How long we keep it
| Data | How long |
|---|---|
| Your account, automations and settings | While your account is open. Deleted permanently the moment you delete your account, with no grace period. |
| Instagram access token | Until you disconnect Instagram or delete your account |
| Automation run records | About 100 days. After that we keep only daily totals, with no names. All of it is deleted with your account. |
| Raw events from Instagram | 45 days |
| Comment Guard and brand deal excerpts | 180 days |
| Contacts and lead form answers | Until you delete them or your account |
| Support conversations | 2 years after the last message |
| Security logs | 90 days |
| Invoices and payment records | 8 years, as Indian tax law requires |
9.Security
All traffic is encrypted in transit. Our database is encrypted at rest by our host. Instagram tokens stay on our servers and are never sent to your browser. Only the people who run DMChat can reach your data. No system is perfect: if a breach affects your data, we’ll tell you and the authorities as the law requires.
10.Your rights
Wherever you live, you can ask us to:
- See the data we hold about you, and get a copy
- Correct anything that’s wrong
- Delete your data. You can do this yourself in Settings → Delete account.
- Withdraw consent for alert emails, or remove our Instagram access
- Object to how we use it, or ask us to limit it
- Nominate someone to act for you if you die or can’t act (India’s DPDP Act)
Email support@dmchat.io from your account email. We reply within 30 days. If you’re not happy with our answer, you can complain to the Data Protection Board of India, or to your local data protection authority if you’re in the EU or UK. California residents have the same rights under the CCPA, and we don’t sell or share personal information as that law defines it.
11.If you messaged a creator who uses DMChat
The creator decides what their automations do, so they’re the first person to ask about your data. You can also email support@dmchat.io with your Instagram username and we’ll help, or pass your request on. Blocking the account also stops any further DMs.
12.Cookies
We use only the cookies the site needs to work: keeping you signed in, protecting forms, remembering which Instagram account you’re viewing, and Cloudflare’s bot check. No advertising or cross-site tracking cookies, so there’s no cookie banner.
13.Children
DMChat is for people 18 and over. We don’t knowingly collect data from children. If you think a child has signed up, tell us and we’ll delete the account.
14.Changes to this policy
If we change something important, we’ll email you at least 14 days before it takes effect. The date at the top always shows the latest version.
15.Contact and grievances
Grievance Officer: DMChat, Navi Mumbai, Maharashtra, India · support@dmchat.io. We acknowledge complaints within 48 hours and resolve them within 30 days.
Everything else: support@dmchat.io.