Privacy notice

DMify runs the service. Write to hello@elkanahtechnologies.com for any privacy question, request or complaint. We acknowledge within 7 days.

• Legal entity: Elkanah Technologies
• Address: No.4, 3rd Main Road, Rajalakshmi Nagar, Dhandeeswaram, Velachery, Chennai, Tamil Nadu 600042

For people who comment on a creator's post, the creator decides to send the message and DMify sends it on the creator's behalf.

• Your email address. You sign in with a one-time code we email you; we do not use Google, Facebook or a password to sign you in.
• The Instagram professional account you connect: its id, username and profile picture address (shown next to your username in the app), and the access token Instagram gives us. The token is stored encrypted and is never written to logs.
• What you set up: automations, keywords, the facts and links you give us, message variants, and your tone settings.
• Plan and billing records, and invoices. Payments are handled by our payment provider; we never see or store your card or UPI details.

When a comment triggers an automation we keep only: the commenter's Instagram id and username, the comment text, the time, and the status of the messages we sent (queued, sent, failed or skipped, with the reason).

When a creator opens the Comments tab we also keep, for comments on any of that creator's posts, the commenter's Instagram id and username, the comment text and the time, so the creator can read the comments and reply. If the creator sends a reply from the tab we keep its wording and whether Instagram accepted it. The text of a comment is sent to the AI service only when the creator asks for a reply to that comment to be written. With it we send the start of the post's caption and the earlier comments in the same conversation under the post, as text only. We never send usernames or Instagram ids.

We do not keep the text of messages a commenter sends back to us, such as a reply, a button tap or a word like "stop". We use it to decide what to do and then discard it. An opt-out is recorded only as the fact that the person opted out and which listed word matched.

• To send the direct message and public reply the creator set up, and to show the creator what happened.
• To respect opt-outs and Instagram's limits.
• To keep the service secure, to fix faults, and to bill creators.

We do not sell personal data and we do not use it for advertising.

We use these providers to run the service. Each sees only what its job needs.

• Meta (Instagram): the source of comments and the route for messages.
• Our hosting provider: the server that runs DMify and holds its database and backups.
• Google (Gemini): drafts message variants and reply suggestions. We send it the comment text, the start of the post caption, earlier comments in the same conversation and the facts the creator supplied. We do not send usernames or Instagram ids.
• Razorpay: payments.
• Brevo: the emails we send you, namely your sign-in code, and service emails such as reconnect and usage alerts.
• Sentry: error reports with personal data removed, when error monitoring is switched on.

Google, Brevo and Sentry may process data outside India.

When you sign in we set one cookie that keeps you signed in. It is needed for the app to work, is not readable by scripts on the page, and is removed when you sign out or it expires. While you connect Instagram we also set a short-lived security cookie that protects the connection and is removed when it finishes. The only other cookie-like storage is the analytics choice described below, and only on our public pages.

Our public pages (the home page, About and Contact) can count visits with PostHog, an analytics service, using its EU region. It runs only if you choose "Accept" in the cookie notice, and never inside the signed-in app.

• What is counted: which of these pages was opened, which sections were reached, taps on "Get started free" and "Sign in", the monthly or yearly price switch, and which question was opened in the FAQ (by its position).
• What is never sent: your name, email address, Instagram account, comments, messages or anything from the app.
• Why: to see whether people understand DMify and find the sign-up button.
• Your choice: open "Cookie settings" at the bottom of any public page to change it at any time. Declining sends nothing.

We do not currently delete data automatically on a schedule. Creators see message history for a limited window that depends on their plan (7 days on Free, 90 days on Pro and Max by default); older rows are hidden from view but not yet erased. We will review scheduled deletion before public launch and update this page when it changes.

We keep nightly backups of the database on our server. Each one is replaced within about 14 days, and the Instagram access tokens in them are encrypted. Data you ask us to delete can remain in a backup until then, and is removed again if a backup is ever restored.

Data deleted at a creator's request, when an account is closed, or through a Meta data-deletion request is permanently removed, including from exports.

• Ask us what we hold about you, ask us to correct it, or ask us to delete it.
• Creators can download all their data, delete a lead, or delete their whole account in the app, under Settings and Leads. Deleting an account removes the data and the stored Instagram connection within minutes.
• Creators can disconnect Instagram at any time. Removing DMify under Instagram settings, Apps and websites, stops it acting on your account: we receive Meta's notice, pause the account and delete its stored token.
• When Meta sends us a data-deletion request, we remove the data for that person, and you can follow its progress on the status page Meta shows you.
• Tax invoices are kept after an account is deleted, because the law requires it.
• Anyone who receives a message can opt out by replying with a stop word; we then send no more.

To delete data, follow how to request deletion. We complete deletions within 30 days.

Access tokens are encrypted. The database accepts connections only from our own servers, and the app only reads the rows of the creator who is signed in. Secrets are kept out of our code and logs. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

DMify is for creators and businesses. It is not meant for children, and we do not knowingly target anyone under 18.

When this notice changes in substance we update the date at the top and tell signed-in creators by email.