Privacy Policy
How FreshDM collects, encrypts, and handles your data while maintaining 100% compliance with official Meta platform guidelines.
Zero Password Storage
We authenticate through official Meta OAuth. We never ask for, view, or store your Instagram password.
Encrypted at Rest
All authorization tokens are encrypted with authenticated AES-256-GCM encryption before database write.
Instant Right to Delete
Revoke access in 1 click anytime. We permanently wipe all connection and token records immediately.
1. Scope & Meta Platform Compliance
Welcome to FreshDM ("we", "our", or "us"). This Privacy Policy governs the manner in which FreshDM collects, uses, encrypts, and protects data gathered through our Instagram comment-to-DM automation software.
FreshDM connects exclusively through official Meta Graph API endpoints and Meta Webhook subscriptions. We comply fully with Meta's Platform Terms, Developer Policies, and Commercial Terms.
2. Information We Access & Collect
When you connect your Instagram Professional account (Creator or Business) to FreshDM, we request only the permissions strictly required to deliver automated message workflows:
- Account Identification: Your Instagram username, account ID, profile picture, and follower count.
- Published Media Metadata: Post IDs, media URLs, and captions for published Reels, Posts, and Carousels to enable keyword trigger monitoring.
- Public Comment Webhooks: Comment text, commenter username, comment ID, and timestamp dispatched by Meta when a user comments on your monitored media.
- What We NEVER Access: We never access personal private messages outside of automated replies, passwords, payment credentials, or personal device data.
3. Token Security & Cryptographic Protection
We employ defense-in-depth security standards to protect your authorization tokens and credentials:
- AES-256-GCM Encryption: All Instagram user access tokens and long-lived tokens are encrypted at rest using industry-grade AES-256-GCM authenticated encryption before database storage.
- Cryptographic Webhook Verification: Every incoming webhook payload from Meta is validated using SHA-256 HMAC (X-Hub-Signature-256) before processing.
- Zero Client Exposure: Access tokens are strictly isolated in server-side runtimes and are never exposed in client bundles or public APIs.
4. Third-Party Sharing & Data Selling
We do not sell, rent, or monetize your personal data or your followers' data under any circumstances.
Data is exchanged strictly with Meta Platforms, Inc. servers to execute user-configured actions (such as sending direct message replies and public comments) as authorized by your account.
5. Data Retention & Right to Deletion
You maintain full ownership and control over your connection and stored data at all times:
- 1-Click Disconnect: You can disconnect your Instagram account at any time from your Account Settings. Upon disconnection, stored access tokens are immediately revoked and deleted.
- Complete Account Deletion: Deleting your account permanently deletes all user records, connection history, automations, and event logs.
- Meta Data Deletion Callback: We support Meta's automatic Data Deletion Request callback, providing users with a confirmation code and status tracking at /deletion-status.
6. Questions & Data Protection Officer
If you have questions, feedback, or inquiries regarding this Privacy Policy or our data practices, our team is available to assist:
Privacy & Compliance Team
privacy@freshdm.io / support@freshdm.io