InstaDM

Privacy Policy

Effective date: May 9, 2026

This Privacy Policy explains how InstaDM (“we”, “our”, “the Service”), operated at aipatnam.com, collects, uses, stores and shares information when you use the Service. By using InstaDM you agree to the practices described here.

1. Who we are

InstaDM is a self-serve tool that lets the account owner manage Instagram comments and direct messages on Instagram Business / Creator accounts they themselves connect to the Service. The Service is operated by the owner of aipatnam.com for use by their own business and authorized users.

2. Information we collect

We collect only the information needed to operate the Service:

  • Account information: name, email, hashed password (when you register with email/password), or the basic profile (name, email, avatar URL) returned by Google, Facebook or Instagram if you sign in with one of those providers.
  • Instagram account data: when you connect an Instagram Business / Creator account, we receive and store the Instagram user ID, username, the linked Facebook Page ID and name, and a long-lived Page access token issued by Meta. These are used only to call the Instagram Graph API on your behalf.
  • Content from your Instagram account: public post metadata, comments on your posts, and direct messages received in inboxes you have connected. We store this content so you can manage replies, run keyword campaigns, and audit message history.
  • Outbound messages: the comment replies and DMs you send through the Service, including delivery status returned by Meta.
  • Profile picture: if you upload an avatar, the cropped image is stored on our server and served from /uploads/avatars/.
  • Operational logs: request timestamps, error codes, and IP addresses for abuse prevention and debugging. Logs are retained for up to 30 days.

We do not collect payment information, advertising identifiers, location data, biometric data, or browsing activity outside InstaDM.

3. How we use information

  • To authenticate you and keep you signed in.
  • To execute the actions you initiate against the Instagram Graph API (fetch posts, fetch comments, send replies, send DMs, run keyword campaigns).
  • To process incoming Meta webhooks for the accounts you have connected.
  • To detect and prevent abuse, fraud, and rate-limit violations.
  • To respond to support requests and legal obligations.

We do not sell your data. We do not use your data to train AI models.

4. Sharing of information

We share data only with:

  • Meta (Facebook / Instagram): when we call the Graph API on your behalf using the access token you authorized.
  • Authentication providers you choose to use (Google, Facebook, Instagram), only during sign-in.
  • Hosting and database providers that store our application and database (currently Hostinger). These vendors process data only to provide infrastructure to us.
  • Law enforcement or regulators where we are legally required to disclose information.

5. Data retention

  • Account and Instagram-account records are kept while your account is active.
  • Cached comments and DMs are kept until you remove the connected account or your account.
  • Operational logs are kept for up to 30 days.
  • When you delete your account or disconnect an Instagram account, the associated tokens and cached content are deleted within 30 days.

6. Your rights

You can, at any time:

  • Disconnect any Instagram account from the dashboard.
  • Delete your profile picture from the Profile page.
  • Request deletion of your account and all associated data — see Section 7.
  • Request a copy of the data we hold about you.

Depending on where you live (e.g. EEA, UK, California), you may also have the right to object to or restrict processing, lodge a complaint with a data protection authority, or withdraw consent.

7. Data deletion requests

To delete your data, email support@aipatnam.com from the email address associated with your account, with the subject line “Data deletion request”. We will confirm receipt within 7 days and complete deletion within 30 days. You will receive a confirmation email when the deletion is complete.

Meta data deletion callback: if you remove the InstaDM app from your Facebook / Instagram account, Meta sends us a deletion signal and we will delete the associated Instagram account record, tokens, cached comments and DMs within 30 days.

8. Security

Passwords are stored as bcrypt hashes. Tokens are stored in our database and never exposed in URLs or client-side code. All traffic is served over HTTPS with HSTS. Access to the production database is restricted to the Service operator.

9. Children

InstaDM is not directed to children under 13 (or under 16 in the EEA / UK). We do not knowingly collect personal data from children.

10. International transfers

Our infrastructure may process data in countries other than your country of residence. By using the Service you consent to such transfers, subject to applicable safeguards.

11. Changes to this policy

We may update this Privacy Policy from time to time. The “Effective date” at the top of the page reflects the latest revision. Material changes will be communicated by email to active users.

12. Contact

Questions, complaints, or data requests: support@aipatnam.com