Privacy Policy

1. Overview & Introduction

Welcome to Auto DM by BHUMI CRM (“we”, “our”, or “us”). Auto DM is a software product developed, owned, and operated by BHUMI CRM. We are committed to protecting your personal privacy and securing any information processed through our platform. This Privacy Policy governs how BHUMI CRM and Auto DM access, collect, use, process, store, and protect information obtained when you connect your Instagram Professional / Business account and use our comment-to-DM automation services.

By accessing or using Auto DM, you agree to the collection and use of information in accordance with this policy and the Meta Platform Terms.

2. Meta & Instagram Platform Data We Access

To provide automated comment replies and direct messaging features via the official Meta Graph API (v25.0), we request the following permissions during the Meta OAuth flow:

• Account Identification (`instagram_business_basic`): We access your Instagram Business Account ID, username, public name, and profile picture URL to authenticate your account and display connection status in your workspace.
• Comments & Feed (`instagram_business_manage_comments`): When an Instagram user posts a comment on your posts or reels, our secure webhook receives the public comment text, comment ID, post ID, and commenter username solely to evaluate your active keyword rules and send public replies.
• Direct Messaging (`instagram_business_manage_messages`): We access direct messaging endpoints solely to send the requested automated response, info link, or call-to-action button to users who commented on your content.
• Access Tokens: We securely store your 60-day Long-Lived Meta user access token to maintain API connectivity for webhooks.

3. Purpose of Data Processing

We process Instagram platform data strictly for the following functional purposes:

• Triggering keyword-matched public replies and automated DMs in real-time when users interact with your reels.
• Providing you with audit execution logs (showing reply status, timestamp, and commenter username).
• Monitoring and preventing infinite comment loops, spam, or duplicate message dispatches.

4. Data Sharing, Transfer & Sale Prohibition

We strictly uphold Meta's developer policies regarding data privacy:

• No Data Sale: We do NOT sell, rent, lease, or monetize user data, Instagram platform data, or end-user conversation logs to any third parties or data brokers.
• No Cross-App Tracking: We do not use your Instagram data for third-party advertising, profiling, or cross-platform tracking.
• Service Providers: Data is hosted securely on Supabase (PostgreSQL with AES-256 encryption at rest) solely for the operation of this software.

5. Data Retention & Security

We implement enterprise-grade technical and organizational measures to safeguard your information:

• Encryption in Transit & at Rest: All data transmitted between your browser, Meta Graph API, and our backend is encrypted using TLS 1.3 / HTTPS. All credentials and database tables are encrypted at rest with AES-256.
• Token Expiry: OAuth tokens expire automatically after 60 days unless actively refreshed.
• Audit Retention: Automation logs are retained for 90 days for debugging and performance metrics, after which they are permanently pruned.

6. Your Rights & Data Deletion

You have the right to request access to, correction of, or permanent deletion of all data associated with your account. For step-by-step instructions on removing your account and purging all stored credentials, please visit our dedicated Data Deletion Instructions page.

7. Contact Information

If you have any questions or concerns regarding this Privacy Policy or our compliance with Meta Platform Terms, please contact our Data Protection Officer at:

Email: support@autodm.app
Entity: BHUMI CRM (Auto DM)