Privacy Policy
Last updated: 24 September 2026
DMagic ("we", "us") helps Instagram Business and Creator accounts reply to comments automatically and send the commenter a private message. This policy explains what data DMagic handles, why, and how you can delete it.
1. Data we collect about you (the DMagic user)
- Account details: your name and email address. If you sign in with Google, we also store your Google account ID; we ask Google only for your name, email address and whether that email is verified, and we never see your Google password. If you sign up with email, we store your password only as a secure one-way hash.
- Connected Instagram accounts: for each account you connect, its Instagram account ID, app-scoped user ID, username and the access token Instagram gives us. The access token is stored encrypted.
- Your automations: the posts you choose, trigger keywords, comment replies and the private message content you write, including any links, images or buttons you add.
- Payments: if you buy a plan, the payment and order reference IDs, amount and plan. Card, UPI and bank details are handled by our payment processor, Razorpay, and never reach our servers.
- Appeal Assistant: if you use it, the platform and account username the appeal is for, the legal name and reason you enter, the letter text, and the email address you say you sent it to. DMagic never sends appeals itself; you send them from your own email app.
2. Data we process about people who comment on your posts
When someone comments on one of your posts, Instagram sends us the comment ID, the comment text and the commenter's Instagram-scoped ID. We use this only in real time to check whether the comment matches one of your automations, then reply to the comment and send the one private message Instagram allows. We do not store commenters' comments, messages or profile information, and we do not add them to any list.
3. Instagram permissions we use
- instagram_business_basic: to read your account ID, username and list of posts so you can pick which post an automation runs on.
- instagram_business_manage_comments: to receive new comments on your posts and post your automated reply to them.
- instagram_business_manage_messages: to send the private message you wrote to people who commented on your post.
We only act on content from the Instagram account you connect, and only in the ways you set up in DMagic.
4. How we use data
- To run the automations you create.
- To keep you signed in and secure your account.
- To process payments and show your plan.
- To reply when you contact support.
We do not sell your data, use it for advertising, or use Instagram data for any purpose other than providing DMagic to you.
5. Sharing
We share data only with the services needed to run DMagic: Meta (Instagram), to read comments and send replies and messages on your behalf; Razorpay, to process payments; and our hosting providers, which store the app and its database. We may disclose data if required by law.
6. Retention
We keep your account data while your account exists. If you disconnect an Instagram account, we delete its access token, IDs and username straight away; the automations you created are kept in your DMagic account so you can reuse them, and you can delete them at any time. If you delete your account, we delete your account, automations, appeals and Instagram data straight away. Payment records (order and payment IDs, amount, date) are kept, no longer linked to your account, because we need them for refunds and tax law. Server error logs, which do not contain commenters' text, are deleted after 14 days.
7. Your choices and deleting your data
- Disconnect any Instagram account at any time: in DMagic open AutoDM, tap your @username at the top, then choose Disconnect from that account's menu.
- Delete your account from Profile → Delete Account in the app.
- Remove DMagic from Instagram's settings; this also deletes your Instagram data from DMagic.
- Or email us. See Data Deletion for every option.
You can also ask us for a copy of your data or to correct it by emailing enosktl@gmail.com.
8. Security
All traffic uses HTTPS, Instagram access tokens are encrypted at rest, passwords are hashed, and requests from Instagram are verified with Meta's signature before we act on them.
9. Children
DMagic is not meant for anyone under 18, and we do not knowingly collect data from children.
10. Changes
If we change this policy, we will update the date above and, for significant changes, tell you in the app or by email.
11. Contact
Questions or requests: enosktl@gmail.com