Privacy policy
Last updated: 21 October 2026
In short: Dmbotics uses data only to run the automations you set up. We don't sell data, we don't use it for advertising, and our team can't read your followers' messages. Followers' message text isn't stored unless you choose to keep it, and you can export or delete your data at any time.
1. Who we are
Dmbotics ("Dmbotics", "we", "us") is a web app that lets Instagram creators and brands automatically reply to comments, direct messages (DMs) and story interactions on their own Instagram professional account, using rules they set up. You can reach us at dmbotics@gmail.com.
This policy covers two groups of people:
- Users: creators and brands who sign up for Dmbotics and connect their Instagram account.
- Followers: people who comment on, message or mention a user's Instagram account, and who may receive an automatic reply.
2. What we collect
From users
- Account details: your name, email address and password (stored only as a secure hash, never readable).
- Connected Instagram account: your Instagram account ID and username, and an access token from Instagram (stored encrypted). We connect through Meta's official Instagram API with your permission.
- Your rules and messages: keywords, public replies, DMs and link buttons you write (stored encrypted), and files you upload for followers to download (kept in private storage).
- Security information: sign-ins and account changes (such as logins, failed attempts and password changes), with time and IP address, to protect your account. If you turn on two-factor authentication, its secret is stored encrypted.
- Notification devices: if you turn on phone or desktop notifications, the device's push address (encrypted) and a label such as "Chrome on Android".
- Payments: if you buy a paid plan, the plan, amount, status and payment reference. Payments are handled by Razorpay; we never see or store your card, UPI or bank details.
About followers
- Comments and messages: when a follower comments on or messages a user's account, Instagram sends it to Dmbotics so we can check it against the user's rules. Comments and messages that match no rule are only counted, never stored.
- Matched comments and messages: we record which rule fired, the keyword, the time and whether the reply was sent. The message text and the follower's Instagram ID are kept only if the user chooses to (not at all, 7 days or 30 days), encrypted.
- Usernames: a follower's username may be used to personalise a reply at the moment it is sent. It is not stored.
- "Already answered": to avoid answering the same person twice, we keep a one-way fingerprint that cannot be turned back into an Instagram ID.
- Leads (only if a user turns this on): if an automatic DM asks a follower for their email or phone number, the message always says who may contact them and how to undo it. If the follower replies with it, it is stored encrypted for that user, together with the permission wording and time. Replying DELETE in the same chat deletes it immediately.
3. How we use data
- To run the automations you set up: posting public replies and sending DMs on your behalf.
- To show you your activity, delivery status and usage.
- To send you alerts you've turned on (for example, when replies pause or your connection needs attention).
- To keep accounts secure, prevent abuse and provide support.
- To process payments for paid plans.
We do not sell data, share it for advertising, or use followers' messages to train AI models.
4. How long we keep it
| Data | How long |
|---|---|
| Comments/DMs that match no rule | Not stored (daily counts only) |
| Activity entries (which rule fired, status, time) | 90 days |
| Follower message text and Instagram ID | User's choice: not stored, 7 days or 30 days (default 7) |
| "Already answered" fingerprints | 90 days |
| Replies waiting to be sent | Recipient wiped once sent; record deleted after 24 hours |
| Leads | User's choice: 90, 180 or 365 days, or until the follower replies DELETE |
| Alert history (which alert, when) | 30 days |
| Sign-in and security events | 1 year |
| Rules, messages, uploaded files, notification devices, Instagram connection | Until you delete them, disconnect, or delete your account |
| Daily totals (counts only, no content) | As long as your account exists |
| Payment records | Kept for accounting, without your name or email, after account deletion |
5. Who can see your data
- Our team can see account details (name, email, plan, payments, Instagram username) and usage counts, only to provide support. Our team cannot see followers' comments or messages, leads, your rule messages, passwords or Instagram access tokens. Every staff action is recorded in an audit log.
- Service providers that run Dmbotics for us, only as needed to provide the service: Meta (Instagram API), Render (app hosting), Neon (database), Vercel (website hosting), Brevo (email delivery) and Razorpay (payments). Some of them may store data on servers outside India.
- The law: we may disclose data if required by law or a valid legal request.
6. How we protect data
Private content is encrypted, passwords are hashed, connections use HTTPS, and repeated wrong logins are blocked for a while. Users can turn on two-factor authentication. No system is perfectly secure, but we work to keep your data safe and will tell affected users if a breach puts their data at risk.
7. Your choices and rights
- Export: Profile & settings → Your data & privacy → Export my data.
- Delete: Profile & settings → Delete my account. See Data deletion for all options, including for followers.
- Message text: choose whether followers' message text is kept (Profile & settings → Keep your followers' message text).
- Correct your account details in Profile & settings, or ask us.
- Disconnect Instagram at any time from the Instagram accounts page, or from Instagram's own settings.
Under India's Digital Personal Data Protection Act, 2023, you may also ask us about the data we hold about you, ask us to correct or erase it, or withdraw consent. Email us and we'll reply within 30 days.
8. Children
Dmbotics is for people aged 18 and over. We don't knowingly collect data from children through user accounts.
9. Changes to this policy
If we make important changes, we'll update the date above and tell users by email or in the app.
10. Contact and grievances
For questions, requests or complaints about privacy, contact the Grievance Officer, Dmbotics, at dmbotics@gmail.com.