Privacy policy

Who we are

StickyDM (“we”, “us”), a sole proprietorship of Divyansh Deep, registered in India under Udyam number UDYAM-UP-24-0066041, operates the StickyDM service. For any privacy question or request, contact us at support@stickydm.com.

Data we collect

Your account

• Your name, email address and profile picture from Google when you sign in.
• Your settings and the automations you create.

Your connected Instagram professional account

• Your Instagram account ID, username, display name, profile picture and follower count.
• An access token issued by Instagram when you connect. We encrypt it at rest (AES-256-GCM) and use it only to provide the features you turn on.
• Basic information about your posts and reels (ID, caption, thumbnail, link and date) so you can choose which ones an automation runs on.

Data we process on your behalf

• Comments on your posts and reels that we receive from Instagram, so we can check them against your keywords.
• Messages, story replies, story reactions and button taps that people send to your account, and the replies sent from your account through StickyDM.
• Contacts: the Instagram-scoped ID, username and name of people who interact with your account, whether they follow you, and any email address or phone number they choose to share in a conversation (leads).
• Emails people submit on your StickyDM link-in-bio page.
• Link clicks: which tracked link was opened and when, plus a one-way hash of the IP address and browser string used to count unique visitors. We do not store raw IP addresses for clicks.

Billing and usage

• Plan, billing status and invoices. Card and UPI details are handled by our payment processor; we never see or store full payment details.
• Product usage events (for example “automation published”) to understand how the product is used and improve it.

How we use data

• To run the automations you configure: replying to comments, sending messages, asking for follows or contact details, and sending follow-ups.
• To show you your results, your inbox, and your contacts and leads.
• To enforce Instagram's messaging rules and rate limits, prevent abuse and keep the service secure.
• To bill you, provide support and tell you about important changes to the service.

We do not sell personal data, use Instagram data for advertising, or use it to build profiles of people outside your own account's activity. We use Instagram Platform data only to provide StickyDM to you, in line with Meta's Platform Terms and Developer Policies.

Legal bases

We process your account data to perform our contract with you. For data about the people who interact with your Instagram account, you are the controller and we act as your processor, following your instructions. You are responsible for having a lawful basis to message the people your automations reply to. Product analytics rely on our legitimate interest in improving the service.

Who we share data with

We share data only with service providers that help us run StickyDM, under contracts that limit their use of it:

• MongoDB Atlas: database hosting (Mumbai, India region).
• Our cloud hosting provider: runs the web app and background workers.
• Razorpay: payment processing.
• PostHog: product analytics about how you use the StickyDM app (not the content of your conversations).
• Our AI model provider: only if you turn on AI replies. The incoming question and the knowledge you provide are sent to generate a reply. We only use AI providers that do not use this data to train their models.
• Google: sign-in.
• Meta: messages and replies are sent through Meta's official Instagram API.

We may also disclose data if required by law, or to protect the rights and safety of our users and the public.

How long we keep data

• Raw webhook deliveries from Instagram are kept for 14 days for debugging, then deleted automatically.
• Conversations, contacts, leads, automations and analytics are kept while your account is active, so your history stays available.
• Disconnecting an Instagram account stops all sending but keeps its data, so you can reconnect later. To delete data, use Settings → Danger zone, remove StickyDM from Instagram, or email us, as described on the data deletion page.
• Billing records are kept as long as tax law requires.

Security

Access tokens are encrypted at rest. All traffic uses TLS. Webhooks from Instagram are verified with an HMAC signature before we process them. Access to production systems is limited to people who need it to run the service.

Your rights and how to delete your data

You can access, export and delete your data from the app: export contacts and leads from Contacts, disconnect accounts in Settings → Instagram, and delete your contacts, conversations, leads and results in Settings → Danger zone. You can also remove StickyDM from Instagram (Settings → Apps and websites), which tells us to delete the data we hold for that account. See data deletion for every option. To exercise any other right, such as correction or objection, email support@stickydm.com. We reply within 30 days.

If you message a business that uses StickyDM and want your data removed, contact that business, or email us and we will pass the request on and help them action it.

Children

StickyDM is a business tool and is not directed at children. You must be at least 18 to create an account.

International transfers

Our primary data store is in India. Some providers listed above may process data in other countries, under appropriate safeguards.

Changes to this policy

If we make material changes, we will tell you by email or in the app before they take effect. The date at the top shows when this policy last changed.

Contact

Questions or requests: support@stickydm.com.