Privacy Policy

Last updated September 1, 2026

inDM is an independent product. We are not endorsed by, sponsored by, or affiliated with Meta Platforms, Inc. or Instagram. "Instagram," "Reels," and "Stories" are trademarks of Meta and are used here only to describe how inDM works.

1. Who we are

For the purposes of this policy, inDM ("we," "us," or "our") is the operator of the inDM application and website, and the controller of the personal information described below. You can reach us at any time at privacy@indm.social.

2. The information we collect

We collect the following, and nothing we don't need:

Account information you give us. Your name, email address, and password when you create an inDM account. Passwords are handled by our authentication provider and stored only in hashed form, we never see them in plain text.
Payout details, if you join the affiliate program. The PayPal or Wise address you ask us to pay commission to, and the name on that account. It is stored separately from the rest of your account data, is never returned to the browser in full, and is used for nothing but paying you.
Instagram information you authorize us to access. When you connect your account through Meta's official login, we access, with your consent and limited to the permissions you grant, your Instagram profile (such as your account ID, username, and profile details), your published media (posts, reels, and stories), the comments and direct messages sent to your account, story replies, and aggregate engagement metrics. See Section 6 for exactly how we use this.
Contacts created by your automations. When someone interacts with your content and an automation responds, we record that interaction so you can see and manage it: for example the person's Instagram username, the message or comment that triggered the automation, and any email address they choose to share with you through an email gate.
Link taps by people who receive your DMs. When an automation delivers a link, we record that the link was opened, the IP address and approximate location it was opened from, and which delivered message it belonged to. This is described in full in Section 7, including what we deliberately do not collect.
A referral code, if you arrived through one. If you open a link from somebody in our affiliate program, we store a short code in your browser for 60 days so their referral can be credited when you create an account. It is a first-party cookie on indm.social, it holds a code and the date, and it identifies the person who referred you rather than you. It is never used for advertising and it is deleted once the referral is recorded. Blocking cookies in your browser prevents it, and the only consequence is that whoever recommended inDM to you is not credited.
Usage and device information. Basic product-analytics and log data (pages viewed, actions taken, approximate location, browser and device type, and IP address), so we can keep inDM reliable and understand what to improve. Our website uses Google Analytics, which sets its own cookies on your browser to count visits and tell a returning visit from a new one. You can opt out of it entirely with Google's browser add-on, or by blocking cookies in your browser.

3. How we use your information

We use the information above to:

Provide the core service: run the automations you set up, send the DMs and replies you configure, and show you your content, contacts, and results.
Create and secure your account, and authenticate you when you log in.
Show you your own analytics and momentum (for example, how many conversations your automations created).
Maintain, troubleshoot, and improve the product, and keep it safe from abuse.
Communicate with you about your account, important changes, and support requests.
Comply with our legal obligations and enforce our terms.

We do not sell your personal information, and we do not use the Instagram data we access to build advertising profiles or for any purpose other than providing the features you enable.

4. How we share information

We share information only in these limited circumstances, never for sale, and never for others' advertising:

Service providers. We use trusted vendors to run inDM: a cloud database and authentication provider (Supabase) to store your account and product data, cloud hosting (Amazon Web Services) to run our servers and serve the app, and analytics providers (PostHog for product usage, Google Analytics for website traffic) to understand how people find and use inDM. They may process your information only to provide their service to us.
Meta / Instagram. To deliver your automations, we exchange data with Meta's platform: for example, sending the DM or reply your automation triggers, and receiving the events (comments, messages) that trigger it.
Legal and safety. When required by law, legal process, or to protect the rights, property, or safety of inDM, our users, or the public.
Business transfers. If inDM is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction; we will notify you and honor this policy.

5. Retention

We keep your information for as long as your account is active and as needed to provide the service. Records of link taps (Section 7) follow the same lifecycle as the rest of your account data: they are kept while your account is active, so that your own results remain available to you, and are deleted or de-identified on the same schedule below. When you disconnect your Instagram account or delete your inDM account, we delete or de-identify the associated data within 90 days, except where we must retain it to meet a legal obligation, resolve disputes, or enforce our agreements. Aggregated or de-identified data that can no longer be linked to you may be kept.

6. Instagram and Meta platform data

When you connect your account, you grant inDM access to specific Instagram data through Meta's official APIs. We use it strictly to operate the features you turn on:

Your media (posts, reels, stories) so you can attach automations to real content.
Comments and messages sent to your account, so an automation can recognize a trigger and respond.
Engagement metrics so we can show you your results.

Our access to and use of information obtained through Meta complies with the Meta Platform Terms and Developer Policies. We only request the permissions the product needs, we use the data only to provide inDM to you, and we do not transfer it to data brokers, ad networks, or any party for a purpose unrelated to the service. You can revoke inDM's access at any time from your Instagram settings under Apps and Websites, see Section 8.

7. Links we deliver, and the taps we record

When one of your automations delivers a link, inDM does not put your destination address straight into the message. We replace it with a short link on a domain we operate (indm-team.com) that forwards the person to the address you chose, immediately and automatically.

Your link is passed through unchanged. Every part of the address you entered is preserved exactly, including any tracking parameters you added yourself. We do not append anything of our own to it.

What we record when someone taps the link:

that the link was opened, and when;
the IP address the tap came from;
the approximate location of that tap, as our content-delivery network reports it at the moment of the request: country, state or region, and city;
a shortened description of the browser or app used, which we keep only to tell a real person apart from an automated scanner;
which of your delivered messages the tap belonged to, which means the tap is associated with the person in your Contacts who received that message.

The location is approximate, and we say so because it is easy to over-read. It is worked out from the network the tap arrived on, not from anything on the person's device. On a mobile network it often points at the place where that carrier connects to the internet rather than where the person is standing, which can be a different city. Treat it as a rough indication, never as someone's address.

What we deliberately do not record. We do not place a cookie, a device identifier, or any other tracker on the person's device. We do not record GPS coordinates, a postal code, or anything more precise than a city, even though our network offers them. We do not use these taps for advertising, we do not build profiles from them, and we do not combine them with information from any other source.

Who this information is about, and who controls it. The people tapping these links are members of your audience, not inDM users. They chose to interact with your Instagram account, and this record exists so that you can see how your own automations performed. For this information you are the controller and inDM is the processor: we hold it on your behalf, use it only to provide you with the feature, and never for our own purposes. If you are subject to the GDPR, the UK GDPR, or a similar law, the duty to tell your audience what you do with information about them, and to have a lawful basis for it, is yours.

This applies to the links your automations deliver, and is not something your audience opts into. A person tapping a link in a DM is forwarded through our domain either way. Whether the resulting figures are visible to you inside inDM depends on your plan; the forwarding and the record happen regardless.

Deleting it. Link-tap records are removed along with the rest of your data when you disconnect Instagram or delete your inDM account, as described in Sections 5 and 8. You can also write to us at privacy@indm.social to have them deleted separately.

8. Deleting your data and revoking access

You are always in control of your data. You can remove it in any of these ways:

Disconnect Instagram. Disconnecting your account inside inDM stops all data access and removes the associated Instagram data from our systems.
Revoke access at Meta. On Instagram, go to Settings → Apps and Websites, select inDM, and remove it. This immediately revokes our permissions.
Delete your inDM account. Deleting your account erases your account and its associated data, subject to the limited retention described in Section 5.
Request deletion by email. Write to us at privacy@indm.social with the subject "Data deletion request" and we will delete your data and confirm within 30 days.

9. Your rights and choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, contact us at privacy@indm.social. We will respond within the timeframe required by applicable law. You also have the right to lodge a complaint with your local data protection authority.

10. Security

We protect your information with encryption in transit, access controls, and tenant isolation so that each account's data stays separate. No system is perfectly secure, but we work to safeguard your data and to notify you and the relevant authorities if a breach ever affects you.

11. International data transfers

inDM and our service providers may process and store your information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards, such as standard contractual clauses, to protect your information when it is transferred.

12. Children's privacy

inDM is a business tool and is not directed to children. You must be at least 18 years old, and meet Instagram's own age requirements, to use inDM. We do not knowingly collect information from children. If you believe a child has provided us information, contact us and we will delete it.

13. Changes to this policy

We may update this policy as inDM evolves. When we make material changes, we will update the date above and, where appropriate, notify you. Continuing to use inDM after a change means you accept the updated policy.

14. Contact us

Questions about this policy or your data? Email us at privacy@indm.social. We read every message.