Privacy Policy

MultiDM (“MultiDM”, “we”, “us”) operates the service at multidm.com, an Instagram DM automation and audience-engagement platform. MultiDM is the data controller for the personal data described in this policy. For any privacy matter, contact support@multidm.com.

We collect only what is needed to run the service:

• Account data — your email address (used for one-time login codes) and workspace details you provide.
• Instagram data — when you connect an Instagram professional account: your username, profile information, access tokens, and — to power the features you configure — direct messages, comments, and media metadata delivered to us by Meta's API.
• Subscriber data — Instagram users who interact with your automations (their username, ID, and the interactions they have with your account).
• Usage data — flow configurations, automation run logs, and aggregate analytics events.
• Technical data — server logs including IP address and user agent, kept for security and debugging.

We use your information solely to operate and improve the service: sending and receiving Instagram DMs and comment replies on your behalf as configured in your automation flows, showing you your inbox and analytics, and sending transactional emails (login codes, service notices). We do not sell or rent your personal data, and we do not use your data for third-party advertising.

Where the GDPR or similar laws apply, we process personal data on these bases:

• Contract — operating the service you signed up for (account, flows, inbox, analytics).
• Legitimate interests — securing the platform, preventing abuse, and debugging.
• Consent — connecting your Instagram account via Meta's OAuth flow; you may withdraw it at any time by disconnecting.
• Legal obligation — where retention is required by applicable law.

MultiDM accesses your Instagram account exclusively through Meta's official API, with the permissions you grant during connection, and complies with the Meta Platform Terms. Specifically for Platform Data (data received from Meta):

• We use it only to provide the features you configure — automated replies, inbox, comment moderation, and analytics — never for any other purpose.
• Access tokens are stored encrypted server-side and are never exposed to your browser or third parties.
• Platform Data is retained only while your Instagram account remains connected. When you disconnect (from Settings, or by removing MultiDM from your Instagram/Meta settings), we stop all API access and delete associated Platform Data within 30 days.
• If you remove the app from your Meta account settings, Meta notifies our deauthorization endpoint and the same deletion process runs automatically. You can also trigger deletion via Meta's Data Deletion Request flow.

We share data only with the vendors required to run MultiDM:

• Meta Platforms, Inc. — Instagram API calls needed to deliver your automations.
• Vercel, Inc. — hosts the web application frontend.
• Hosting provider (EU/US data-center VPS) — hosts our API and database.
• Brevo (Sendinblue SAS) — delivers transactional emails such as login codes.

Each processes data only on our instructions. We may also disclose data if required by law, or as part of a merger or acquisition (in which case this policy continues to apply to previously collected data).

MultiDM does not use advertising or third-party tracking cookies. We use browser local storage for a single purpose: keeping you signed in (your session token). Clearing your browser storage signs you out. Public bio pages served by MultiDM record aggregate, non-identifying view and click counts.

Data is stored on secured servers with encryption in transit (TLS) and at rest. Access tokens are encrypted and access to production systems is restricted to authorized personnel via key-based authentication. No method of transmission or storage is 100% secure, but we follow industry-standard practices and will notify affected users of any breach as required by applicable law.

We retain personal data while your account is active. If you delete your account, we delete your personal data within 30 days, except minimal records we must keep for legal, security, or compliance purposes. Instagram Platform Data follows the shorter retention rules in Section 5. Server logs rotate automatically and are kept no longer than 90 days.

Depending on your location (including under the GDPR and India's DPDP Act), you have the right to:

• Access the personal data we hold about you and receive a copy in a portable format.
• Correct inaccurate data, or restrict / object to specific processing.
• Delete your data (disconnect Instagram in Settings, or request full account deletion).
• Withdraw consent at any time, without affecting prior lawful processing.
• Lodge a complaint with your local data-protection supervisory authority.

Exercise any of these by using the in-app Settings page or emailing support@multidm.com. We respond within 30 days.

MultiDM is not directed at children and may not be used by anyone under 13 (or the higher minimum age required by Instagram in your country). We do not knowingly collect data from children; if we learn we have, we delete it promptly.

Our infrastructure and sub-processors may store data outside your country, including in the EU and United States. Where required, transfers rely on appropriate safeguards such as standard contractual clauses maintained by our sub-processors.

We may update this policy as the service evolves. Material changes will be announced by email or in-app notice before they take effect, and the version and date above will always reflect the current revision.

Questions about this policy or your data: support@multidm.com.