Privacy Policy

DMpop is operated by Satak Technologies (proprietor: Syed Asif Sultan) ("we", "us"). DMpop lets the owner of an Instagram Business or Creator account send an automatic direct message when someone comments a chosen keyword on their post or reel, or sends that keyword in a message or Story reply.

Two groups of people are covered here. Customers are the people who sign up for DMpop and connect an Instagram account. Recipients are the people who comment on or message a customer's Instagram account and receive a reply through DMpop.

• Account details: your email address, your name if you provide one, and sign-in session records. We sign you in with an emailed link and do not store a password.
• Workspace details: the workspace name, its members, their roles, and the email addresses you invite.
• Instagram account details: the username, account ID and profile information of the account you connect, its recent posts and reels, and a daily follower count.
• Instagram access token: the token Meta issues when you approve access. It is encrypted before it is stored (AES-256-GCM).
• Campaigns: the keywords, messages, links and settings you create.
• Technical records: error and diagnostic logs needed to keep the service running.

We never ask for, receive or store your Instagram password. You connect on Meta's own login screen. DMpop does not scrape Instagram or automate a browser.

We process this on the customer's behalf, only for the Instagram account they connected:

• Comments: the text of comments on the customer's posts, with the commenter's Instagram username and ID, as delivered by Meta. We use them to check for a keyword and to avoid replying twice.
• Messages: direct messages and Story replies sent to the customer's account, so keywords in them can trigger a reply and so the customer can read and answer conversations in the DMpop inbox.
• Follow status: where the customer turns on the follow gate, whether the recipient follows the customer's account, as reported by Meta.
• Delivery log: a record of each message sent, skipped or failed, with the reason.
• Link clicks: when a recipient opens a tracked link we record the time, the browser's user agent, the referring page, and one-way hashes of the IP address and recipient ID. The hashes let us count unique clicks without storing the IP address itself.

• To sign customers in and run their workspaces.
• To match comments and messages against campaign keywords and send the replies the customer configured, through Meta's official Instagram API.
• To stay within Instagram's sending limits, retry failed sends and prevent duplicates.
• To show customers their logs, click counts and inbox.
• To secure the service, investigate abuse and fix faults.
• To email customers about their account and the service.

We do not sell personal data. We do not use data received from Meta for advertising, for building profiles of recipients, or for any purpose other than providing DMpop to the customer who connected the account.

Only the service providers needed to run DMpop, each acting on our instructions:

• Meta Platforms: Instagram data is read from and messages are sent through Meta's API.
• Railway: hosting for the app, its database and its message queue.
• Vercel: hosting for the marketing website.
• Resend: delivery of sign-in and account emails.
• Zernio: only for customers who choose to connect Instagram through Zernio instead of directly.

We may also disclose data where the law requires it, or to protect the rights and safety of our users and the service. If DMpop is sold or merged, data may pass to the new operator under the same commitments.

Our providers may store and process data on servers outside India. By using DMpop you agree to that transfer. We require our providers to protect the data they handle for us.

• Account, workspace and campaign data is kept while the account is open.
• Disconnecting an Instagram account in Settings deletes the stored connection and its access token straight away.
• Delivery logs, comment records and click records are kept while the workspace exists, so customers can see their history, and are deleted when the workspace is deleted.
• After a deletion request we remove the data within 30 days, except where we must keep a record to meet a legal obligation or to prevent fraud and abuse.

You can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct or update it;
• delete it, as described on the Data Deletion page;
• stop processing it by withdrawing your consent, which for customers means closing the account;
• name another person to exercise these rights if you die or become unable to.

Recipients can also stop messages at any time by blocking or restricting the customer's account on Instagram, and can send requests about their data to us or to the customer whose account they interacted with.

The app sets only the cookies it needs to work: one that keeps you signed in, one that protects forms from forgery, and one that remembers your language. We do not use advertising or cross-site tracking cookies.

Connections to DMpop are encrypted in transit. Instagram access tokens are encrypted at rest, incoming Meta notifications are checked against a signature before they are accepted, and access to production systems is restricted. No system is perfectly secure, and we will tell affected customers and the authorities about a breach where the law requires it.

DMpop is for people aged 18 and over. We do not knowingly open accounts for anyone younger.

We will post any change here and update the date at the top. If a change materially affects how we use your data, we will email account holders before it takes effect.

Email hello@dmpop.com. We acknowledge complaints within 48 hours and aim to resolve them within 30 days.