The short version: We collect only what's needed to run DMFlow. We never sell your data. We store your Instagram connection securely using Meta's official API. You can delete everything at any time.
We collect information you provide directly and information generated by your use of the Service:
| Data Type | What We Collect | Why |
|---|---|---|
| Account | Name, email address, password (hashed) | To create and manage your account |
| Username, account ID, access token (encrypted) | To connect and run automations on your behalf | |
| Usage | DMs sent count, automation logs, feature usage | To provide analytics and improve the service |
| Leads | Email addresses collected via DM flows (Pro) | Stored in your Contacts dashboard for your use |
| Payment | Billing details (processed by Stripe — we never see card numbers) | To process subscription payments |
| Technical | IP address, browser type, device info | Security, fraud prevention, debugging |
We do not use your data for advertising, sell it to third parties, or share it with data brokers.
DMFlow connects to Instagram through Meta's official Graph API with your explicit authorization. We access:
We store your Instagram access token encrypted at rest. We only make API calls that are required to run your active automations. You can revoke access at any time from Instagram Settings → Apps and Websites → DMFlow → Remove.
DMFlow complies with Meta's Platform Terms and Data Use Policy. Your Instagram data is never shared with third parties outside of what Meta's policies permit.
Our infrastructure is hosted on AWS (EU region) with SOC 2 compliant providers. See our Security page for full details.
We share data only in these limited circumstances:
We never sell, rent, or trade your personal information.
We retain your data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we are required to retain it by law (e.g. billing records for 7 years). Automation logs are retained for 90 days.
Depending on your location, you may have the following rights:
To exercise any of these rights, email us at privacy@dmflow.app. We will respond within 30 days.
We use cookies for authentication (session management), security (CSRF protection), and basic analytics (page views, feature usage). We do not use advertising or tracking cookies. You can disable cookies in your browser settings, though this may affect Service functionality.
DMFlow is not intended for users under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us immediately and we will delete it.
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice in the app at least 14 days before changes take effect. Continued use of the Service after changes constitutes acceptance.
For privacy-related questions or to exercise your rights: