Privacy Policy

DM Now is a product operated by Engineering Buddies. This policy explains the personal data processed when creators, businesses, their Instagram audiences, storefront buyers, and support contacts interact with DM Now. It also explains the choices and request channels available to you.

Data we process

Account data includes your name, email, phone number, login/session records, referral relationship, plan and billing status. Google Sign-In supplies verified identity fields when you choose it. We also receive request context such as IP-derived country, device/user-agent, page URL, and security or error information.

When you authorize an Instagram professional account, Meta may provide account identifiers, username, name, profile image, follower/media counts, media metadata, comments, live comments, story replies, and direct messages. Automation activity may store the sender’s Instagram identifier and username, message/comment text, source identifiers, matching keyword, delivery result, and contact or lead details the sender provides. This includes data about Instagram users who do not have a DM Now account; the connected business controls the automation and must give any notices its audience requires.

Commerce and verification data may include products, storefront orders, buyer contact details, payment and refund identifiers, invoices, payout records, billing address/GSTIN, PAN, Aadhaar, date of birth, bank account and IFSC details, identity/bank documents, and a supplied document password. Support requests may include your email, phone, message, screenshot, page URL, and user agent. Sensitive KYC fields are encrypted or masked on the server and private documents use restricted storage; the web app does not persist unfinished KYC drafts in browser storage.

Why we use data

We use data to authenticate accounts; connect Instagram; receive, match, send, retry, and audit configured automations; enforce quotas and prevent duplicate sends; maintain contacts, leads and moderation records; provide AI replies when enabled; operate storefront checkout, delivery, refunds, invoices, KYC and payouts; answer support requests; detect abuse; secure and debug the service; meet legal/accounting obligations; and, only with analytics permission, understand marketing and product usage. We do not sell or broker personal data.

Processors and disclosures

Data is disclosed only as needed to operate the service, comply with law, or protect rights and safety. Provider categories currently include Meta/Instagram for account authorization and messaging; Google for optional sign-in; cloud hosting, PostgreSQL database and private object storage providers; Dodo Payments for checkout, payment, refund and dispute processing; MailBlastr for transactional email; OpenAI or Anthropic for enabled AI replies and AI-assisted flow generation; and Datadog plus optional Google Analytics for diagnostics/analytics. Those providers process data under their own terms and may process it outside your country. A seller also receives the buyer/order details needed to fulfil a storefront purchase.

Analytics and browser storage

Optional analytics is off until you allow it. If allowed, DM Now creates first-party visitor, campaign and session identifiers and may load Google Analytics when configured. Declining removes DM Now’s stored analytics identifiers and does not affect service access. Authenticated operational events may still be processed without a persistent analytics profile to provide, debug and secure the service. Global Privacy Control and browser Do Not Track signals are treated as a decline.

Retention, disconnect and deletion

We retain categories only for as long as needed for the purposes above, account operation, dispute resolution, security, and legal/accounting requirements. Exact periods vary by record. Payment, invoice, payout, fraud, dispute and audit records may be retained after account closure where law or legitimate claims require it; other records are deleted or de-identified when no longer required. Raw operational webhook/payment records are access-controlled but may remain while needed for recovery and audit.

Disconnecting Instagram asks Meta to unsubscribe the account, removes the local access token, disables affected automations and pending sends, and rejects later webhook entries for the inactive account. Meta may retry briefly while its unsubscribe propagates. Disconnecting does not itself delete existing contacts, activity, orders or legal records. To request account access, correction, export, deletion, restriction, or to object to a use, contact us. We verify requests and explain any data that must be retained. The product does not currently offer a self-service account-erasure button.

Security, children and changes

We use access controls, short-lived signed downloads, encrypted Instagram tokens, encrypted sensitive KYC identifiers/passwords, restricted object storage, request limits and audit logging. No security measure is perfect; report suspected misuse immediately. DM Now accounts and commerce/KYC features are intended for people aged 18 or older. We may update this policy as the service changes and will post a revised date here; material changes apply prospectively where required.

Contact and complaints

Engineering Buddies operates DM Now. For privacy questions, audience data-subject requests, deletion requests, complaints, or to ask for the relevant service-provider list, email hello@dmnow.app. Include the account email and enough detail to locate the relevant data; do not email identity documents or passwords. You may also contact the data-protection or consumer authority available in your jurisdiction.