Privacy Policy
This policy explains what information inDM collects, how we use and share it, and the choices and rights you have. inDM is a tool that connects to your Instagram Business or Creator account — with your permission, through Meta's official platform — to automate replies to comments, story replies, and direct messages. Because we handle Instagram data on your behalf, we hold ourselves to Meta's platform requirements and to applicable data-protection laws.
Last updated July 12, 2026
inDM is an independent product. We are not endorsed by, sponsored by, or affiliated with Meta Platforms, Inc. or Instagram. "Instagram," "Reels," and "Stories" are trademarks of Meta and are used here only to describe how inDM works.
1. Who we are
For the purposes of this policy, inDM ("we," "us," or "our") is the operator of the inDM application and website, and the controller of the personal information described below. You can reach us at any time at privacy@bloom.social.
2. The information we collect
We collect the following, and nothing we don't need:
- Account information you give us. Your name, email address, and password when you create an inDM account. Passwords are handled by our authentication provider and stored only in hashed form — we never see them in plain text.
- Instagram information you authorize us to access. When you connect your account through Meta's official login, we access — with your consent and limited to the permissions you grant — your Instagram profile (such as your account ID, username, and profile details), your published media (posts, reels, and stories), the comments and direct messages sent to your account, story replies, and aggregate engagement metrics. See Section 6 for exactly how we use this.
- Contacts created by your automations. When someone interacts with your content and an automation responds, we record that interaction so you can see and manage it — for example the person's Instagram username, the message or comment that triggered the automation, and any email address they choose to share with you through an email gate.
- Usage and device information. Basic product-analytics and log data — pages viewed, actions taken, approximate location, browser and device type, and IP address — so we can keep inDM reliable and understand what to improve.
3. How we use your information
We use the information above to:
- Provide the core service — run the automations you set up, send the DMs and replies you configure, and show you your content, contacts, and results.
- Create and secure your account, and authenticate you when you log in.
- Show you your own analytics and momentum (for example, how many conversations your automations created).
- Maintain, troubleshoot, and improve the product, and keep it safe from abuse.
- Communicate with you about your account, important changes, and support requests.
- Comply with our legal obligations and enforce our terms.
We do not sell your personal information, and we do not use the Instagram data we access to build advertising profiles or for any purpose other than providing the features you enable.
4. How we share information
We share information only in these limited circumstances — never for sale, and never for others' advertising:
- Service providers. We use trusted vendors to run inDM: a cloud database and authentication provider (Supabase) to store your account and product data, cloud hosting (Amazon Web Services) to run our servers and serve the app, and a product-analytics provider (PostHog) to understand usage. They may process your information only on our instructions and only to provide their service to us.
- Meta / Instagram. To deliver your automations, we exchange data with Meta's platform — for example, sending the DM or reply your automation triggers, and receiving the events (comments, messages) that trigger it.
- Legal and safety. When required by law, legal process, or to protect the rights, property, or safety of inDM, our users, or the public.
- Business transfers. If inDM is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction; we will notify you and honor this policy.
5. Retention
We keep your information for as long as your account is active and as needed to provide the service. When you disconnect your Instagram account or delete your inDM account, we delete or de-identify the associated data within 90 days, except where we must retain it to meet a legal obligation, resolve disputes, or enforce our agreements. Aggregated or de-identified data that can no longer be linked to you may be kept.
6. Instagram and Meta platform data
When you connect your account, you grant inDM access to specific Instagram data through Meta's official APIs. We use it strictly to operate the features you turn on:
- Your media (posts, reels, stories) so you can attach automations to real content.
- Comments and messages sent to your account, so an automation can recognize a trigger and respond.
- Engagement metrics so we can show you your results.
Our access to and use of information obtained through Meta complies with the Meta Platform Terms and Developer Policies. We only request the permissions the product needs, we use the data only to provide inDM to you, and we do not transfer it to data brokers, ad networks, or any party for a purpose unrelated to the service. You can revoke inDM's access at any time from your Instagram settings under Apps and Websites — see Section 7.
7. Deleting your data and revoking access
You are always in control of your data. You can remove it in any of these ways:
- Disconnect Instagram. Disconnecting your account inside inDM stops all data access and removes the associated Instagram data from our systems.
- Revoke access at Meta. On Instagram, go to Settings → Apps and Websites, select inDM, and remove it. This immediately revokes our permissions.
- Delete your inDM account. Deleting your account erases your account and its associated data, subject to the limited retention described in Section 5.
- Request deletion by email. Write to us at privacy@bloom.social with the subject "Data deletion request" and we will delete your data and confirm within 30 days.
8. Your rights and choices
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, contact us at privacy@bloom.social. We will respond within the timeframe required by applicable law. You also have the right to lodge a complaint with your local data protection authority.
9. Security
We protect your information with encryption in transit, access controls, and tenant isolation so that each account's data stays separate. No system is perfectly secure, but we work to safeguard your data and to notify you and the relevant authorities if a breach ever affects you.
10. International data transfers
inDM and our service providers may process and store your information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards — such as standard contractual clauses — to protect your information when it is transferred.
11. Children's privacy
inDM is a business tool and is not directed to children. You must be at least 18 years old, and meet Instagram's own age requirements, to use inDM. We do not knowingly collect information from children. If you believe a child has provided us information, contact us and we will delete it.
12. Changes to this policy
We may update this policy as inDM evolves. When we make material changes, we will update the date above and, where appropriate, notify you. Continuing to use inDM after a change means you accept the updated policy.
13. Contact us
Questions about this policy or your data? Email us at privacy@bloom.social — we read every message.