Data processing agreement

This agreement covers our processing of personal data on your behalf. It is part of the terms of service between you and CodeShant Technologies (UDYAM-BR-26-0188408), which runs DmTheLink ("we", "us"). It is the agreement Article 28(3) of the GDPR asks for, and for customers in the United Kingdom, Article 28(3) of the UK GDPR.

You are the controller and we are the processor for what your automations handle: the comments on your posts, the people who comment or DM you a keyword, the DMs we send for you, and the files you share. You decide why this data is processed. We process it only to run the service for you.

We are a separate controller for our own data: your account and login, your invoices, collab chats with brands, and our security logs. The privacy policy covers that data, not this agreement.

We process personal data only on your documented instructions, unless a law we are subject to requires otherwise. If that happens, we tell you first, unless that law forbids it.

Your instructions are this agreement, the terms and the settings you choose in the dashboard: which posts have an automation, the keywords, the message, the link or files, and the public reply. Changing a setting changes your instruction from that moment.

We will not use your followers' data, your messages or your files for any purpose of our own.

Everyone we allow to process your data is bound to confidentiality, also after their work with us ends. Only those who need access to run, support and secure the service get it.

We take the technical and organisational measures in Annex II. We may change them as the service grows, but never below the level Annex II describes.

You allow us to use subprocessors. The current ones are in Annex III. Before we add or replace one, we update Annex III and email you at least 30 days ahead. If you have a reasonable data protection objection, tell us within those 30 days. If we cannot solve it, you may end the service and get back what you prepaid for the unused time.

Every subprocessor is bound by data protection terms at least as strong as these. We stay fully liable to you for them.

People whose comments or messages your automations handle exercise their rights against you, as the controller. We help you answer them. If someone contacts us directly, we pass the request on to you and act on your instruction.

We tell you without undue delay after we learn of a personal data breach that affects your data, in time for your own 72-hour deadline under Article 33. We say what happened, which data and roughly how many people are affected, the likely effects and what we are doing about it. If we don't know everything yet, we send what we have and follow up.

We give you reasonable help with data protection impact assessments (Article 35) and prior consultation with a supervisory authority (Article 36). Annex I and Annex II are written so you can use them directly.

By accepting this agreement you instruct us to delete your personal data when the service ends, rather than return it. When you delete your account in Settings, the request waits 7 days so you can undo it, then we delete everything: automations, message logs, files, pages and saved stats.

Message logs are deleted after 90 days in any case. Before you delete your account, Download my data in Settings gives you a copy of your own data.

We give you the information you need to show that we meet Article 28, and we allow and help with audits by you or an auditor you choose. Please ask us first; most answers are in this agreement or the privacy policy. An audit can take place once a year, with 30 days written notice, in business hours and under confidentiality, or more often if a supervisory authority requires it or after a breach. You pay your own audit costs.

Your data is stored in the European Union, on our server at Contabo. Comments and DMs reach us through Meta, which may process them in the United States. Payment data goes to Stripe or, in India, to Razorpay.

These transfers are needed to run the service, and by accepting this agreement you allow them. They take place under each provider's data processing terms and the EU Standard Contractual Clauses or another Article 46 mechanism, with the UK Addendum for UK data.

This agreement applies for as long as we process personal data for you. Sections 9 and 12 continue after it ends. The liability limits in the terms apply, except where the GDPR does not allow them.

This agreement is governed by the laws of India. The GDPR, and for UK customers the UK GDPR, applies regardless. Where this agreement conflicts with them, they win.

If we update this agreement, we tell you and ask you to accept the new version.

Subject and nature. Receiving comments and messages through Meta's platform for the posts you choose, matching them to your keywords, sending DMs with your message and link, hosting your drops, files and creator page, and counting visits and clicks.

Purpose. Providing DmTheLink to you, and nothing else.

Duration. While your account is open. Message logs are kept for 90 days.

People concerned.

• People who comment on your posts or Reels, or DM you a keyword.
• Visitors of your drops and creator page (counted, not identified).
• People named or shown in the files you share.

Types of data.

• Instagram or Facebook username and ID of the person who commented or wrote.
• The comment or message, its time, and whether a DM went out.
• The DM we sent for you.
• Whatever personal data is in the files you upload.

Special categories. The service is not built to collect them, but we cannot stop people from writing sensitive things in a comment. Whether Article 9 applies to your use is for you to decide.

• Hosting in the EU: server, database and files at Contabo in the EU.
• Encryption in transit: HTTPS for the website, the dashboard, drops and our API.
• Tokens encrypted at rest: Meta access tokens are stored encrypted.
• No passwords: sign-in by Google, Facebook or an email link, so there is no password database.
• Separation: one creator's data cannot be reached from another creator's account.
• File safety: a real type check (also inside zips) and a virus scan before anyone can download a file; location data removed from JPG, PNG and WebP photos.
• Data minimisation: message logs deleted after 90 days; visits counted per page, not per person.
• Deletion: deleting an account removes its data after the 7-day undo window.

We hold no ISO 27001, SOC 2 or similar certification, and we do not claim one.

The same list as in our privacy policy.