Privacy Policy

Dm4Links ("we", "us") is an Instagram direct-message automation tool operated by the account holder who connects it to their own Instagram Business or Creator account. This policy explains what data Dm4Links handles, why, and how to contact us about it. If you are a follower or visitor messaging an Instagram account that uses Dm4Links, the operator of that account is the data controller; Dm4Links acts as the software they use to respond.

Information we process

• Instagram identifiers — the Instagram-scoped user ID and (where provided by Meta) username of people who message, comment on, or reply to stories from the connected account.
• Message content — the text of direct messages, comments, and story replies sent to the connected account, plus the automated responses Dm4Links sends back.
• Contact attributes — tags and custom fields the operator assigns to a contact through flows (for example, a tag like "interested" set by a keyword trigger).
• Operator data — the name and optional email of the person running Dm4Links, the Instagram account credentials and access token issued by Meta, and the flows/triggers they create.
• Operational metadata — timestamps, webhook delivery IDs, and logs used to ensure messages are not processed twice and to diagnose errors.

Why we process it

• To receive Instagram webhooks and deliver automated replies on the operator's behalf.
• To route incoming messages to the correct flow based on the operator's triggers.
• To maintain per-contact state (such as which step of a flow a conversation is on).
• To respect Meta's 24-hour messaging window and other platform policies.
• To secure the service (signature verification on every webhook, deduplication of retried deliveries).

Third parties

Dm4Links exchanges data with the following parties only as needed to deliver the service:

• Meta Platforms (Instagram Graph API) — to receive webhooks and send replies. Meta's own privacy policy governs the data it holds.
• The operator's own infrastructure — Dm4Links runs on servers and databases controlled by the operator who deployed it. We do not sell data and do not share it with advertisers.

Retention

Contact records, message history, and flow state are retained for as long as the operator keeps Dm4Links connected to their Instagram account, or until the operator deletes them. Access tokens are stored only on the operator's server and are removed if the Instagram connection is revoked.

Cookies and local storage

Dm4Links does not use cookies for session identity. The dashboard stores two values in your browser's local storage (cb_user_id and cb_account_id) to remember which operator is signed in and which account they are viewing. These values stay on your device and are sent to our server only as a request header when you use the dashboard. No third-party tracking or advertising cookies are used.

Your rights

If you have messaged an Instagram account that uses Dm4Links and want to access, correct, or delete the data Dm4Links holds about you, contact the operator of that account first, since they control the data. You may also contact us directly using the address below and we will forward the request. For the step-by-step deletion procedure, see our Data Deletion Instructions.

Contact

Questions about this policy: [email protected].