Privacy Policy

We collect the following categories of information so we can provide and improve the Service:

• Account data — your name, email address, password (stored hashed) and billing details when you create an account or subscribe to a paid plan.
• Connected-channel data — when you connect an Instagram, Facebook or WhatsApp account through that platform’s official login, we receive the access tokens and the specific data the platform grants, such as your profile, posts, comments and the messages our automations send and receive on your behalf.
• Automation & contact data — keywords, message templates and the contacts (commenters and message recipients) that interact with your automations, including their public username, message content and timestamps.
• Contact details people choose to share — when an automation invites a person to share their email address or phone number inside a direct message (using Instagram’s built-in one-tap “share email / phone” quick replies), and the person taps to share it, we store that email or phone number as a contact for the account owner. Sharing is always optional and initiated by the person, and they can reply STOP at any time to opt out.
• Usage data — how you use the Service, including pages viewed, features used, device and browser type, IP address and diagnostic logs.
• Link-click data — when an automation delivers a link in a DM, that link is served through a MyDMFlow redirect so the account owner can see how many people clicked. When a link is clicked we record the click time, the referrer and a one-way hashed (not raw) form of the visitor’s IP address; we then forward the visitor to the destination. This is used to show link performance to the account owner and is retained for up to 90 days.
• Cookies & similar technologies — used to keep you signed in, remember preferences and measure performance (see “Cookies & Tracking”).

We use your information to:

• Provide, operate and maintain the Service and run the automations you configure.
• Send public replies and direct messages on your behalf through the connected platform’s official API.
• Process payments, manage subscriptions and send service-related communications.
• Provide support, respond to your requests and improve features, security and performance.
• Detect, prevent and address fraud, abuse and violations of our Terms or platform policies.
• Measure engagement with the links your automations share (how many clicks they receive), so you can see what resonates with your audience.
• Show promotional placements inside the dashboard to accounts on the Free plan, and record which placement a workspace was shown and whether it was clicked so we can measure them. Placements are selected by plan and workspace only — never from the content of your comments, contacts or messages, and never by sharing your data with an advertiser.
• Comply with legal obligations.

Email addresses and phone numbers that people share inside a DM are used only to add them as a contact for the account owner who ran the automation (for example, to send them the resource they asked for or to build that owner’s opt-in marketing list). We honor opt-outs: a person can reply STOP, UNSUBSCRIBE or CANCEL at any time and we mark them unsubscribed. If a person unsends the message in which they shared their email or phone, we delete that detail.

Automated follow-up emails. If the account owner enables follow-ups, and a person chose to share their email in the conversation, MyDMFlow may send that person a small number of automated follow-up emails on the account owner’s behalf — for example, a reminder about what they asked for. The prompt that asks for the email discloses this before it is shared. Every follow-up email says who it is on behalf of, includes a one-click unsubscribe link and our postal address, and we stop sending immediately if the person unsubscribes, replies STOP, converts, or is otherwise no longer an active contact.

To operate and support the Service, our authorized personnel may access your account and connected-channel data — including the posts, comments and messages your automations act on — but only when it is necessary to run the Service, provide support you have requested, investigate a technical problem or suspected abuse, or comply with a legal obligation. This access is limited to authorized staff on a least-privilege, need-to-know basis, and we do not use connected-account data for any purpose unrelated to providing the Service.

We do not sell your personal data, and we do not use data obtained through the Meta APIs for advertising or to build user profiles for purposes unrelated to the Service.

Our automations operate strictly through the official APIs of the platforms you connect. Your use of those platforms through MyDMFlow is also subject to the platform’s own terms and policies — for Meta, the Meta Platform Terms and Instagram Platform Policy.

We only request the minimum permissions needed to run comment-to-DM automation (for example, reading comments and sending messages). You can revoke our access at any time from within the connected platform’s settings or by disconnecting the account in MyDMFlow.

We share information only as needed to run the Service:

• Service providers (sub-processors) — the companies that host our infrastructure, process payments, send email and provide analytics. Each one is named below.
• Connected platforms — the platform APIs you authorize, in order to deliver replies and messages.
• Destinations you choose — if you switch on a CRM sync, an outbound webhook or a MyDMFlow API key, we send your leads to the destination you configure, on your instruction. You choose that destination and you are responsible for it; once data reaches it, it is governed by your agreement with that service, not by us.
• Legal & safety — when required by law, to enforce our Terms, or to protect the rights, property or safety of PlanMyTrip LLC, our users or the public.
• Business transfers — in connection with a merger, acquisition or sale of assets, in which case we will notify you.

We believe you should be able to see exactly who touches your data, not just the category they fall into. This list is accurate as of the “Last updated” date above, and we update it here whenever it changes.

These providers process personal data on our behalf, for the purposes we set, under the data-processing terms they make available to us:

• Vercel — hosting and content delivery for our website, dashboard and admin console.
• Railway — hosting for the automation engine that receives comments and sends your replies and direct messages, including the queue that holds an incoming comment and its outgoing reply while the automation runs. A recent window of completed and failed jobs is kept after processing so that a failed send can be retried and diagnosed; older entries are displaced as new ones arrive.
• Neon — the managed PostgreSQL database that stores account, automation, contact and lead data.
• Stripe — subscription payments and invoicing. Card details are submitted directly to Stripe and are never stored on our systems.
• Resend — transactional email such as verification, password reset, billing and account notices.
• OpenAI and Anthropic — used by our optional AI features. What we send depends on the feature. For AI writing and suggestions — the automation-flow writer, and “Suggest with AI” in Conversation tools, which drafts ice breakers for you — we send only what the draft needs: your Instagram @handle, display name, biography and website link, the captions of your recent posts, the automation’s trigger type and keywords, and your brand-voice note if you have written one. For AI comment replies, if you enable them: the text of the comment being replied to, plus the business details and knowledge you have given us to answer from. For the AI direct-message assistant, if you enable it: the text of the customer’s message and a short window of the recent messages in that conversation, so the reply makes sense in context, with any email addresses and phone numbers removed first — this means direct-message content is sent to the provider for that feature, and only for that feature. We will update this list before we send anything not described here. We never send your contact or lead records, your lead exports, their email addresses or phone numbers, your CRM notes on a lead, messages from conversations the assistant is not handling, your payment details, or your Instagram access token. These providers act as our processors under their API terms: they process what we send on our instructions, not for their own purposes, and do not use it to train their models. They may retain a request for a short period for their own abuse monitoring — up to 30 days in OpenAI’s case — after which it is deleted unless the law requires otherwise. We do not keep the prompts we send. We keep AI output only where the feature needs it — a comment reply waits in your review queue until you approve or reject it, and an ice breaker you save is stored on your Instagram account and mirrored in ours — and it is deleted with the rest of your account data. We also keep usage counts, token totals and estimated cost for up to 24 months, to apply your usage limits. These providers may process this data outside the country you are in. Where that involves a transfer from the EEA or the UK, we rely on the transfer terms in our agreement with them. If you supply your own OpenAI or Anthropic API key, we build and send the same request; it is billed to your own account with that AI provider and processed on their terms as well as ours.

Two further providers are named separately, because they are not purely processors — each also handles some data under its own terms and for its own purposes. Neither is used for analytics inside the signed-in dashboard:

• Google — Google Analytics on our public marketing website; “Continue with Google” sign-in if you choose it; and, for accounts created that way, your Google profile picture, which your browser loads directly from Google.
• Microsoft — Microsoft Clarity on our public marketing website (see “Cookies & Tracking”).

Meta (Instagram and Facebook) is not a sub-processor in the usual sense: it is the platform you connect, and it is the source of the comment and message data our automations act on. See “Platform Data” above.

Integrations you switch on yourself — syncing your leads to your own CRM, sending them to an outbound webhook URL you configure (including via Zapier or Make), or reading them through a MyDMFlow API key you generate — are different again. There we act on your instruction to send your data to a service you control, under your account and your agreement with that provider. Nothing is sent anywhere until you set it up, and you can revoke it at any time.

We retain personal data only for as long as necessary to provide the Service and for legitimate business or legal purposes. When you delete your account, we delete or anonymize your personal data within 90 days, except where we are required to retain it by law.

This covers the systems we operate. If you have exported data to a CRM, a webhook destination or another tool of your own, we pass the deletion request on to the integrations you connected through us — but we have no ability to erase data inside a system you control, so deleting it there remains your responsibility.

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent. You can exercise most of these directly in your account settings or by contacting us at info@mydmflow.com. We will not discriminate against you for exercising your rights.

If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the right to lodge a complaint with your local data protection supervisory authority. We would rather you came to us first at info@mydmflow.com so we can put it right, but that right exists regardless and you do not need our permission to use it.

You can delete your data at any time:

• In-app — sign in and delete individual automations and contacts, or delete your entire account from Account → Settings. Deleting your account stops your automations immediately, disconnects your channels and cancels any subscription. You then have a recovery window (currently 7 days) in which you can change your mind, after which your data is erased within the 90-day period described under “Data Retention”. If you want confirmation that the erasure is complete, email info@mydmflow.com and we will confirm it.
• Disconnect a channel — removing a connected account in MyDMFlow, or revoking MyDMFlow from the platform’s app settings, stops further data access.
• By request — email info@mydmflow.com with the subject “Data Deletion” and we will permanently delete your personal data within 90 days and confirm by email, except for records we are required to keep by law, such as billing and tax records.

We use industry-standard safeguards — encryption in transit, hashed credentials, access controls and regular review — to protect your information. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Essential cookies keep you signed in and protect your session. The Service cannot work without them.

Referral cookies — if you arrive through someone’s referral link, we set two cookies on our dashboard domain so that the person who referred you can be credited when you sign up, and so we can detect referral fraud. The visitor identifier they contain lasts up to 12 months. They are not used for advertising.

On our public marketing website at https://stage.mydmflow.com we also use the following analytics tools, and we would rather name them than describe them vaguely:

• Google Analytics — aggregate visit statistics, such as which pages people read and where they arrived from.
• Microsoft Clarity — heatmaps and session replay. Session replay records how a visitor moves, scrolls and clicks through our marketing pages so we can see where the site is confusing.

We do not currently run Google Analytics, Microsoft Clarity or any other analytics or screen-recording tool inside the signed-in dashboard. If we enable a product-analytics tool there, we will name it here first. Our implementation is built so that such a tool could see your account identifier, name and email address and which pages you open — never the content of your contacts, leads or messages — and screen recording is switched off in our own code rather than left to a vendor setting.

Your choice, and how it works. If you visit from the European Economic Area, the United Kingdom or Switzerland, we ask before any analytics tool loads: nothing is downloaded, no analytics cookie is set and no session is recorded until you choose. Declining takes one click and is offered exactly as prominently as accepting. If we cannot tell where you are, we ask.

Elsewhere the analytics above load by default, which local law permits — but you can opt out at any time using the “Cookie settings” link in the footer of every page, and we will remember your choice. You can change your mind whenever you like using the same link; withdrawing is as easy as agreeing.

Google also publishes a dedicated Google Analytics opt-out add-on at https://tools.google.com/dlpage/gaoptout, and your browser’s own cookie controls or a tracker-blocking extension will work too. None of these tools are necessary to run the Service, and blocking them has no effect on your account or your automations. If you have a concern about any of this, email us at info@mydmflow.com.

The Service is not intended for and may not be used by anyone under the age of 13 (or the minimum age required in your country, if higher). We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us personal data or is using the Service, contact us at info@mydmflow.com and we will delete the data and terminate the account.

PlanMyTrip LLC is based in the United States, and the providers listed above operate principally in the United States. Some may also process data in other regions where they run infrastructure. If you use the Service from outside the United States, your information will be transferred to and processed in the United States.

Where a provider offers the European Commission’s Standard Contractual Clauses, or another transfer mechanism recognised under applicable law, as part of the data-processing terms it makes available, those terms govern our use of that provider. If you have a question about a specific provider or transfer, email us at info@mydmflow.com.

We may update this Privacy Policy from time to time. We will post the updated version here with a new “Last updated” date and, for material changes, notify you by email or an in-app notice.

Questions about this policy or your data? Email us at info@mydmflow.com and we will be happy to help.

You can also call us at +1 984-357-8926, or write to us by mail: PlanMyTrip LLC, 2125 Stegemann St, Apex, NC 27502, United States.