Last updated October 5, 2026
Privacy Policy
DMflare sends an automatic Instagram DM to people who comment a keyword on your post. This page explains what information that involves, why we need it, how long we keep it and how you can have it deleted.
Who we are
DMflare ("we", "us") is the service at dmflare.in and app.dmflare.in. For anything about your data, write to support@dmflare.in.
What we collect
From you, when you sign up
- Your email address, which is how you sign in. We email you a one-time sign-in link; there is no password.
- Your workspace name and the email addresses of teammates you invite.
- A session cookie that keeps you signed in. We set no advertising or tracking cookies.
From Instagram, when you connect an account
You connect an Instagram professional account through Instagram's own permission screen. With the permissions you grant, we receive:
- The account's Instagram ID, username and display name.
- An access token, which we store encrypted. It lets DMflare act for that account only within the permissions you granted.
- Your recent posts and reels (captions, thumbnails, links), shown so you can pick one for a campaign. These are read when needed and not stored.
- Comments on your posts, and messages sent to your account, delivered to us by Instagram as they happen.
About people who interact with your account
When a comment or message matches one of your campaigns, we keep a delivery record:
- The person's Instagram ID and username.
- The text of the matching comment or message, and which keyword matched.
- Whether the DM and any public reply were sent, and when.
Comments and messages that match no campaign are not kept. We count them and discard the content. The one exception is a notification we failed to process: it is kept for up to 7 days so the failure can be investigated, then deleted.
Link clicks
Links in your DMs pass through DMflare so clicks can be counted. We keep a daily count per link. We do not store the visitor's IP address, browser or any identifier.
How we use it
- To send the DMs and public replies you configured, on behalf of the account you connected.
- To show you what was sent, to whom, and how your campaigns are doing.
- To keep the service running: preventing duplicate messages, staying inside Instagram's sending limits and investigating failures.
- To email you sign-in links and invitations.
We do not sell personal information. We do not use it for advertising. We do not use information received from Instagram for anything other than providing DMflare to you.
Who else handles it
- Meta (Instagram). Messages and replies are sent through Instagram's official API, so Instagram processes them under its own terms.
- Cloudflare. DMflare runs on Cloudflare, which hosts the application and its database and delivers our emails.
- Zernio. If your Instagram account is connected through Zernio rather than directly, comments, messages and replies for that account also pass through Zernio.
We share information with nobody else, unless the law requires it.
How long we keep it
- Delivery records: 90 days. After that only daily totals remain, with no names or message text.
- Notifications we failed to process: 7 days.
- System logs: 30 days.
- Your account, connected Instagram accounts and campaigns: until you remove them or ask us to.
Security
Instagram access tokens are encrypted before they are stored. All traffic uses HTTPS. Each workspace can only read its own accounts, campaigns and delivery records. No system is perfectly secure, and we will tell you promptly if we learn of a breach affecting your data.
Your choices
- Disconnect an Instagram account in Settings. Its access token, campaigns and delivery records are deleted immediately.
- Remove DMflare's access from Instagram itself, under Settings, then Apps and websites.
- Ask for a copy, a correction or deletion of your data by writing to support@dmflare.in.
If you commented on or messaged an account that uses DMflare and want your record removed, seeData deletion.
Children
DMflare is a business tool and is not intended for anyone under 18. We do not knowingly collect information from children.
Changes
If this policy changes in a way that matters, we will update the date above and tell workspace owners by email before the change takes effect.