Updated 3 November 2026
Privacy Policy
Operator and data controller
- Name / legal name
- Karel Matusiak
- Address
- U Hřiště 267/16, 747 71 Brumovice
- Czech registration number (IČO)
- 30210453
- [email protected]
DMFlow helps the operator of a professional Instagram account respond to requested comments and messages through the official Meta API. This policy explains personal-data processing under the GDPR. The controller is the operator identified above, who determines the purposes and automation settings. DMFlow is the software name.
1. Purposes and sources
We process data to deliver requested content, manage conversations and contacts, check the selected workflow conditions, secure the account, prevent repeated or unsolicited messages, measure links in aggregate, administer the workspace, handle feedback and your rights. Sources are your Instagram interactions supplied through Meta webhooks/API, information you send yourself and visits to tracked links.
2. Data categories
- Instagram-scoped ID (IGSID), username, post/comment/message and automation IDs, interaction timestamps and technical status.
- Temporary inbound message or comment text used to match keywords and continue the conversation, and outgoing content in the technical job queue.
- Email addresses you send during an email step, contact details and the associated automation. If a follow gate is enabled, the current result of checking whether you follow the professional account.
- The connected operator's encrypted OAuth access tokens, permissions and expiry. We do not request Instagram passwords.
- HMAC pseudonymous deduplication keys and aggregate click counts by automation, content, day, hour and approximate country/city.
- Text voluntarily entered in the feedback form, minimal monthly allowance records and daily aggregate follower counts. Workspace member emails and roles, invitation status, and deletion-request confirmation codes and encrypted identifiers from the Meta callback.
Optional exports and service alerts
The owner may connect Mailchimp or Ecomail to transfer email addresses voluntarily provided in a conversation to a selected list. Integration keys are encrypted. Providing an address for requested content is not newsletter consent. The integration does not start campaigns or autoresponders or resubscribe people who opted out. Existing provider records are preserved. Deleting a contact stops pending transfers; for records confirmed as created by this integration, cleanup requests archiving in Mailchimp or unsubscribing in Ecomail. This is not complete provider erasure; the owner must also review ambiguous outcomes and any further erasure there. An encrypted integration copy of the address is kept while the local contact exists; after local deletion it is cleared by maintenance after seven days even if cleanup remains unresolved. Technical transfer history and aggregate manual-review records are bounded to approximately 390 days; disconnecting or replacing a key removes the old credential and local addresses for that integration.
Optional owner service alerts are sent through Resend. Safe type, time and status history is kept for 90 days; completed email bodies are cleared from the queue. Public access requests contain an encrypted email, name and message where supplied, plus review status, and are removed after 30 days. A request alone creates neither an account nor marketing consent.
3. Lawful bases
- Legitimate interests – GDPR Article 6(1)(f): responding to communication you initiate, account security, preventing spam and repeated messages, and proportionate aggregate measurement. We assess necessity and balance these interests against your rights; you may object.
- Contract – Article 6(1)(b): only where processing is necessary for an actual contract with you or pre-contract steps you request, including agreed workspace administration.
- Legal obligation – Article 6(1)(c): handling data-subject rights and obligations imposed by law.
- Consent – Article 6(1)(a): only for separately agreed, genuinely optional additional uses if introduced. Sending an email address or granting Meta OAuth permissions is not newsletter consent. This service does not automatically subscribe you to marketing.
You do not have to provide data. Without the relevant interaction we cannot deliver the requested automated response; an enabled email step cannot complete without an address. You can contact the controller instead. Please do not send unnecessary sensitive data.
4. Recipients, security and processors
Authorized workspace members can access data according to their roles. Cloudflare is the technical processor: Workers runs the app, D1 stores database records, KV stores encrypted tokens/cache and Queues carries technical job IDs. The dashboard requires authentication. Optional member invitation emails may use Resend, which receives the invited member's address and invitation, not an automatic export of Instagram contacts. Meta also processes the original interactions under its own policies. We do not sell data.
Public forms use Cloudflare Turnstile for bot protection. During this check, Cloudflare processes technical signals from your device and browser. See Cloudflare’s Privacy Policy for details.
5. International transfers
Cloudflare and, if enabled, Resend may process data outside the European Economic Area, particularly in the USA. We do not promise EU-only storage. Applicable transfers rely on GDPR Chapter V safeguards in the relevant data-processing agreements: adequacy decisions where applicable, including the EU–US Data Privacy Framework for eligible recipients, or Standard Contractual Clauses and necessary supplementary measures. Contact the controller for details of the safeguards that apply.
References: Cloudflare DPA, Cloudflare subprocessors, Resend DPA.
6. Retention
| Data | Period / rule |
|---|---|
| Rewind previews, feedback and allowance records | Comment text and recipient identifiers in Rewind previews are removed on confirmation or after 15 minutes by maintenance; confirmed events then follow the inbox/jobs rule. Feedback-form messages are deleted after 30 days. Minimal monthly allowance records (job ID, month, time) and daily aggregate follower counts are removed after approximately 390 days; related technical history remains subject to necessity review and full erasure. |
| Inbound events (inbox) and message content in jobs | Processed inbound text is removed when an event completes. Remaining inbox/job plaintext, recipient identifiers and continuation text fields are scrubbed by scheduled maintenance after 7 days from creation. Old unsent jobs are terminated. Maintenance runs every minute when the infrastructure is available. |
| Contacts: IGSID, username, email and last interaction | Until the operator deletes the contact, a valid request is fulfilled or the purpose ends. Contacts have no automatic time-based expiry. The controller regularly reviews necessity and does not retain them without a purpose. |
| HMAC deduplication and related technical metadata | No automatic expiry, to prevent re-messaging the same person and abuse. These are pseudonymous personal data, not anonymous data. Necessity is reviewed regularly. A valid full-erasure request also removes linkable records unless retention is expressly required by law. |
| Encrypted access tokens and Instagram connection | While the connection is active. Old versions are removed on refresh and disconnection; any technical copies in KV expire at the configured token expiry. |
| Rules, automation IDs and configuration | While in use; the operator can delete them. Historical technical links are reviewed with deduplication records and as part of full erasure. |
| Aggregate click counts, countries, cities and time buckets | Approximately 390 days in whole daily buckets (the boundary day may reach almost 391 days), removed at the next scheduled maintenance run. There is no list of IP addresses. Aggregates that can no longer be associated with a person may remain after their erasure. |
| Workspace, members and invitations | Membership until removal. An invitation is valid for 7 days; acceptance removes its one-time token. The owner manages and removes inactive or expired records. |
| Erasure requests | Until resolved and then only as necessary to demonstrate handling or meet a legal obligation. Confirmation of completion removes the encrypted requester identifier in the app; remaining pseudonymous technical records are reviewed. |
HMAC keys allow us to recognize the same identifier on a later interaction. They are not anonymous and are not generally exempt from erasure rights. Ordinary removal of a contact row retains minimum re-messaging prevention records. A valid full-erasure request also covers linkable HMAC records; an exception needs a specific statutory reason.
7. Clicks and IP addresses
DMFlow does not store visitors' raw IP addresses from HTTP requests in its database or write them to application logs. It stores aggregate opening counts and approximate country/city supplied by Cloudflare, without precise location or a unique visitor profile. Cloudflare nevertheless processes technical data, including IP addresses, to deliver and secure the service under its Privacy Policy. VPNs, bots and link previews can affect the counts.
8. Children and automation
The service is not intended to target children, and we do not knowingly request their data in breach of applicable law or Meta's age rules. We do not automatically verify recipients' ages. A child or guardian with concerns should contact the controller. Keywords and selected conversation steps are evaluated automatically; we do not make decisions with legal or similarly significant effects under GDPR Article 22.
9. Your rights and contact
Subject to applicable conditions, you have rights of access and a copy, rectification, erasure, restriction, portability and objection to processing based on legitimate interests. Any consent can be withdrawn at any time without affecting earlier lawful processing. Your specific right to object to direct marketing remains unaffected.
Write to [email protected]. See Data deletion for the procedure. Identity checks are proportionate and never require passwords.
We handle requests without undue delay. Our SLA is 30 calendar days from receipt; where the statutory one-month GDPR deadline ends earlier, the shorter deadline applies. Only in legally permitted cases involving complexity or a high number of requests may this be extended by up to two further months. We explain the reasons and extension within the original deadline. If a request cannot be granted, we explain why and how to complain.
You may lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ) or another competent supervisory authority.
Disconnecting, opting out and human replies
You can disconnect Instagram in Settings or revoke the app’s permissions at Meta. A verified deauthorization callback disconnects the matching account, invalidates tokens, pauses live rules and cancels pending sends. Disconnecting does not erase historical data; use the erasure procedure above for full deletion.
A recipient can send STOP, ODHLÁSIT, ODHLASIT, UNSUBSCRIBE or STOP AUTOMATION, ignoring case and diacritics. We cancel their queued automated messages and private comment replies and may send one confirmation within the valid 24-hour window. Only a subsequent START or ZNOVU from that person re-enables automation. An owner’s manual resume does not override this opt-out.
When we detect a human message from the business account, automation pauses for that conversation for 24 hours by default; the owner can configure the duration. An authorized owner or editor can also pause or resume it manually. An outgoing message does not open a new 24-hour messaging window.
Phone numbers and optional webhooks
If you enable phone capture, a recipient may voluntarily send a phone number after the email step. We validate E.164 format, add +420 to a nine-digit Czech number and encrypt stored phone numbers. Authorized members can access them in Contacts, CSV and an export webhook you enable. The same purposes, lawful bases, necessity reviews and erasure rights apply as for other contact details. Sharing a phone number is not consent to advertising or an SMS campaign.
The owner can configure HTTPS webhooks for contact capture, conversation completion and opt-out. A captured contact may include a voluntarily supplied email and phone; an opt-out carries only a pseudonymous key and status. You choose the recipient, such as your Zapier or Make endpoint, and must check authorization, security, processing terms and any international transfers. Pending bodies and signing secrets are encrypted, requests are signed and history is limited to seven days. Deleting a contact stops pending transfers and removes their stored payload; you must arrange deletion of data already delivered to a recipient.
We do not sell data or use it for advertising. Use it only for an authorized purpose under the Meta Platform Terms, Instagram policies and applicable law. DMFlow does not replace those rules or any required consent.