Privacy policy

1. Who we are

DripDM is the service at dripdm.com. The operator of DripDM is the data controller for account data. Contact privacy@dripdm.com.

2. Roles

DripDM is the controller for your login, billing, and support data.

You are the controller for Instagram messages, comments, and contacts you collect through the service. DripDM processes that data for you so the product can run.

When DripDM reviews an account for a breach of the terms, DripDM is the controller for that review. That review is not processing done only on your instructions.

3. Data we process

For your customers and their Instagram contacts, we process:

• Instagram messages, comments, story replies, and related content
• Profile data that Meta sends with those events
• Contact details you capture, such as email or phone
• Click counts on short links

For you, the account holder, we process:

• Name, email, and password hash
• Workspace, plan, and seat data
• Billing data that Stripe holds
• Support messages you send us

We also store technical logs, error data, and sign-in cookies.

If we investigate a terms breach, we may keep the related automation rules, message content, account records, connected Instagram ids, and a hash of the email used to try to open a new account.

4. Why we process data

We process data to:

• Run the service you asked for
• Send invite and password-reset email
• Take payment and apply plan limits
• Show automation results, such as sends and clicks
• Keep the service secure and stop abuse
• Meet a legal duty

The legal bases are the contract with you, our legitimate interest in running a safe service, consent where a law requires it, and a legal duty.

You must have your own lawful basis before you message a person or store their contact data.

5. Artificial intelligence

Paid plans can send a reply draft to a chat model. We send the message text and the instructions on the rule.

We do not use that text to train a model. If no model key is set, the AI reply does not run.

6. Who receives data

We do not sell personal data.

These providers process data so the service can run:

• Meta, for Instagram login, webhooks, and message send
• Stripe, for checkout and the billing portal
• Google, when you connect Sheets
• Resend, when invite or reset email is turned on
• The chat-model host you configure for AI replies
• The host that runs the DripDM servers

If we believe use of the service breaks the terms or the law, we may share the relevant records with Meta, a payment provider, or a public authority. Those parties decide how they use that data.

7. International transfers

Some providers store data outside your country. Where the law requires a safeguard, we use a contract clause or another lawful transfer tool.

8. How long we keep data

We keep account data while the workspace is open.

After you close the workspace, we delete messages, contacts, and rules within 30 days. A backup copy can remain for a short time.

Security logs are kept for up to 90 days.

If we close an account for a terms breach, we can keep the records of that breach for up to 5 years.

We keep billing records for as long as tax law requires.

9. Deletion

You can ask us to delete your account. We delete the workspace data as described above.

A contact can ask you to delete their data. You can delete that contact in the product. If you need help with a bulk delete, email privacy@dripdm.com.

We can refuse a delete request when we must keep a record for a legal claim or a legal duty. That limit applies mainly to breach records.

10. Cookies

DripDM uses cookies only to keep you signed in. These cookies are required for the app. We do not use advertising cookies.

11. Security

We protect data in transit with HTTPS. We encrypt Instagram tokens at rest. Access to production systems is limited.

12. Your rights

You can ask for a copy of your data, a correction, deletion, or a limit on processing. You can also object to processing based on legitimate interest.

Account requests go to privacy@dripdm.com. Requests about a contact's Instagram data go to the workspace owner first, because that owner is the controller.

13. Children

DripDM is for business use by people who are at least 18. We do not aim the service at children under 13.

14. Changes

We can update this policy. The date at the top of the page shows the latest version. If a change is material, we will tell you in the app or by email.

15. Contact

Email privacy@dripdm.com for privacy questions.