Privacy Policy

Effective 5 September 2026, updated 25 September 2026

DMPilot ("we", "us") provides Instagram DM automation at dmpilot.pro. This policy explains what personal data we process when you use the service, and what rights you have. It is written to be read, not skimmed; if anything is unclear, email hello@dmpilot.pro.

1. Data we collect from you (the account owner)

When you sign in with Google we receive your name, email address and Google account identifier from our authentication provider, Clerk. When you sign in with an emailed code, Clerk receives the email address you enter, sends the code to it, and passes the address to us once you have entered the code. When you connect Instagram we receive your Instagram professional account id, username, profile picture and an access token, via an approved Meta technology provider. We store the automations you create, the messages you write, tracked links you generate, and billing status from our payment provider, Dodo Payments. We do not store card numbers.

2. Data we process about your audience

To run an automation we receive webhook events from Instagram: comments, story replies and direct messages sent to your account, together with the sender's Instagram-scoped id and username. We store the minimum needed to send the reply you configured, enforce Instagram's messaging rules (for example the 24-hour window and one private reply per comment), and show you delivery statistics. If you use lead capture, we store the email address a person types into the DM thread together with the consent text they were shown. We never read or store DMs that are unrelated to an automation.

3. Tracked links

When someone clicks a DMPilot short link we record the time, a hashed IP address, the user agent and the referring app so we can count clicks and filter bots. We do not build advertising profiles and we do not sell click data.

4. Why we process it

To provide the service you asked for (contract), to keep the service secure and within Meta's platform rules (legitimate interest), and to bill you (contract). We do not use your data or your audience's data to train AI models.

5. Who we share it with

Sub-processors that host or operate the service: Vercel (hosting), Neon (database), Clerk (authentication), our Meta technology provider (Instagram API access), and Dodo Payments (billing). Each is bound by its own data processing terms. We do not sell personal data.

6. Retention and deletion

Audience events and messages are kept for as long as your account is active so that statistics and rule enforcement keep working, and are deleted within 30 days of you deleting your account. You can disconnect Instagram at any time from the dashboard, which stops all processing of new events. To delete your account and all data, email hello@dmpilot.pro from the address you signed up with; we complete deletion within 30 days and confirm by email. Instagram users can also request deletion of their data through Meta's data deletion mechanism, which we honour.

7. Your rights

Depending on where you live you may have the right to access, correct, export or erase your data, to object to processing, and to complain to a supervisory authority. Email hello@dmpilot.pro and we will respond within 30 days.

8. Security

Access tokens and secrets are encrypted at rest. Traffic is encrypted in transit. Webhooks are verified by signature before they are processed. Access to production systems is limited to the people who operate the service.

9. Changes

We will post changes on this page and update the effective date. Material changes will be announced in the dashboard.

DMPilot is not affiliated with Meta Platforms, Inc. Instagram is a trademark of Meta Platforms, Inc.