Privacy Policy
Last updated: September 2026
This policy describes the information Comment2DM collects and how it is used to operate comment-to-DM automation. We do not sell your personal information.
Information we collect
- Account data: email, optional name, password hash, and the times you accepted the Terms of Service and Privacy Policy.
- Connected Instagram professional account identifiers and profile metadata (for example Instagram user id, username, account type, profile picture URL, and related connection status).
- Encrypted Instagram access token storage used to call Meta APIs on your behalf.
- Keyword rules you create (keyword, message, and media scope).
- DM and activity records (comment identifiers, commenter identifiers, media identifiers, send outcomes, and related error summaries).
- Billing data if Stripe is enabled (customer and subscription identifiers, plan status, and invoice history stored for your account).
- Support and contact messages you submit through the contact form (name, email, subject, and message), which are emailed to our support inbox when email delivery is configured.
How we use information
We use this information to authenticate you, connect Instagram, match comments to keyword rules, send private replies, show your dashboard and activity, process billing when enabled, and respond to support requests. Access tokens are stored encrypted and are not exposed in client-side application code.
Processors and third parties
- Meta APIs for Instagram professional login, webhooks, media, and private replies.
- Hosting and infrastructure providers that run the application and database.
- An email provider (Resend) when transactional email is configured, for password-reset and contact-form messages.
- Stripe when billing is enabled, for checkout and subscription processing.
Retention
We keep account and automation data while your account is active. After a verified deletion request, we delete or anonymize personal data we control, except where we must retain records for law, fraud prevention, or dispute resolution. Exact timing can vary; we do not publish a guaranteed deletion SLA beyond processing verified requests in good faith.
Your choices
You may request access, correction, or deletion of your personal data through the contact form. Follow the data deletion instructions for account and Instagram-related data held by Comment2DM. Removing data here does not delete your Instagram or Facebook account.
Contact
Privacy questions can be sent through the contact form.