Privacy policy

DmTheLink is run by CodeShant Technologies (UDYAM registration UDYAM-BR-26-0188408), "we" or "us". DmTheLink sends a DM with a link when someone comments on a creator's post or Reel, and hosts the drops (the page a DM link opens), files and creator pages. Brands can write to creators through it about collabs.

We are the controller for the account data of creators and brands. For the comments and DMs a creator's automations handle, we work on that creator's instructions, under our data processing agreement.

Privacy questions: [email protected]. Everything else: [email protected].

• Account data: your email, your name and how you sign in (Google, Facebook or an email link). We never store a password.
• Google and Facebook sign-in: Google confirms your email and gives us a stable ID for your account. Facebook gives us your email if you allow it. We receive nothing else and cannot change anything in those accounts.
• Connected accounts: your Instagram professional account and Facebook Page, with their ID, username, name, follower count and the access token Meta gives us. Also your posts and Reels with their captions and thumbnails, so you can pick one.
• Comments and DMs: for posts with an automation, the commenter's username, the comment and its time, whether a DM went out, and the DM we sent. For people who DM a keyword, their username and that message.
• Files: the files creators upload for their drops, and the results of our type check and virus scan. We remove location data from JPG, PNG and WebP photos; HEIC photos, videos and files inside a zip keep theirs.
• Creator pages: name, photo, bio, link buttons, and the brand-ready info a creator chooses to add (niche, location, languages).
• Visit and click counts: for drops and creator pages we count visits, clicks and downloads per page. To count a visitor only once, we use a code made from the IP address and the date; it changes every day and is kept for 30 minutes at most. We do not record who visited.
• Instagram stats: views, likes, comments and reach for your posts, and reach and profile views for your account. We save a daily copy so you can compare old Reels for longer. This is on from when you connect; you can turn off Keep my stats history in Connections at any time and keep or delete what is saved.
• Brand accounts and collab requests: when a brand writes to a creator, the name, company and email of the person writing, and the messages in the chat. Only that creator and that brand see the chat.
• Reports: when a visitor reports a page, the reason, the note, the email they choose to give, and a code made from the IP address and the date, so one person can report a page once a day.
• Billing: your plan, payment status and invoices. Card and UPI details stay with Stripe or Razorpay; we never see them.
• Technical logs: limited server logs for security, debugging and abuse prevention.

• Contract (GDPR Art. 6(1)(b)): to run the service you signed up for, including the daily copy of your Instagram stats that your Stats history is built from. You can turn that copy off in Connections at any time.
• Steps before a contract (Art. 6(1)(b)): when a brand writes to a creator about a possible collab, to deliver the request and the chat that follows.
• Legitimate interests (Art. 6(1)(f)): to keep the service secure, stop abuse and count page visits.

Comments and DMs are different. The creator decides what their automation sends and to whom. We handle that data for them, on their instructions.

Message logs (the comments we saw and the DMs we sent) are kept for 90 days, then deleted.

Collab chats: a request the brand does not confirm by email within 72 hours is deleted. A chat with no new message for 6 months is deleted, and deleting either account deletes its chats.

Everything else stays until the account is deleted. When you delete your account in Settings, the request waits 7 days so you can undo it. Then we delete your account, connected accounts and tokens, automations, message logs, files, creator page, drops, collab chats and saved stats. See Data deletion.

Stripe and Razorpay keep their own payment records and invoices, as the law requires them to. These hold no comments, DMs or files.

On our own server in the European Union, run by Contabo. Files are stored on the same server.

These companies process data for us to run part of the service. We update this list before we add a new one.

If you are in the EU, the EEA or the UK, you have the right to:

• Access the personal data we hold about you.
• Correct data that is wrong or incomplete.
• Erase your data. Delete your account in Settings, see Data deletion.
• Restrict processing in some cases.
• Take your data with you: Download my data in Settings gives you a machine-readable file.
• Object to processing based on legitimate interests.
• Stop the saving of your Instagram stats at any time in Connections.

For anything you cannot do in Settings, email [email protected]. We answer within one month. You can also complain to your data protection authority; in Austria that is the Datenschutzbehörde (dsb.gv.at), in Germany the authority of your federal state, in the United Kingdom the Information Commissioner's Office (ico.org.uk).

If you commented on a creator's post, the creator decides what their automation does with your comment. Ask them first, or write to us and we will pass your request on.

Our server is in the EU. Meta, Stripe, Google and Cloudflare may process data in the United States, and Razorpay processes payments in India. They do so under their own data processing terms and the EU Standard Contractual Clauses or another Article 46 mechanism.

No cookie banner, because we only set cookies for things you ask for: one remembers the language you pick, and one keeps you logged in on app.dmthelink.com or brand.dmthelink.com, each kept on its own address. No advertising or tracking cookies.

Human check. The login, report and collab request forms use Cloudflare Turnstile to check that a person is sending them, not a script.

Analytics. On the public site we use Cloudflare Web Analytics to count page views. It stores nothing in your browser (no cookie, no local storage), does not fingerprint your device and holds no identifier for you. Drops and creator pages are counted by our own server, per page, not per person.

We may update this policy. Big changes show in the "Last updated" date above.