DMBud ("we", "us") provides a service that lets a business ("workspace owner") connect their own Instagram Business account and their own Shopify or WooCommerce store, so that when someone comments a trigger keyword on the workspace owner's post, we automatically send that commenter a private reply (DM) with product details and post a public reply to their comment. This policy explains what data we collect to provide that service and how it is handled.
Data is used exclusively to operate the automation the workspace owner configured: matching a comment's keyword, extracting a product code from the post caption, looking up that product in the workspace's own connected store, and sending the reply/DM on the workspace owner's behalf. We do not use Instagram data for advertising, and we do not sell or rent personal data to third parties.
We share data only with the service providers strictly necessary to run the product: Meta/Instagram (to send the reply/DM you configured), the workspace's own Shopify or WooCommerce store (to look up product details), Razorpay (to process payments), and an email delivery provider (to send account and billing notifications). None of these providers may use the data for their own purposes beyond delivering that service to us.
Instagram access tokens are stored only while a workspace keeps the connection active, and are deleted immediately on disconnect. Comment-processing records (used for the workspace owner's activity log and troubleshooting) are retained for a limited period and can be deleted on request. Account data is retained for as long as the workspace is active, and deleted or anonymized after account closure except where we are required to retain billing records by law.
All access tokens and store credentials are encrypted at rest (AES-256). Passwords are one-way hashed and never stored in plain text. All traffic to and from DMBud is encrypted in transit (HTTPS/TLS). Every Instagram webhook we receive is verified against Meta's signature before being processed.
A workspace owner can disconnect their Instagram account or store at any time from the Connections page, which immediately deletes the stored credentials. Anyone whose data was processed by this service (including commenters) can request deletion of that data — see our Data Deletion page for instructions.
DMBud is a business tool and is not directed at children. We do not knowingly collect data from children.
We may update this policy from time to time. Material changes will be reflected by updating the date at the top of this page.
Questions about this policy or your data can be sent to privacy@dmbud.app.