DMLink Privacy Policy
Last updated:
Data controller: Niyazi Yaşar, Topraklık, Turan Güneş Cd. No:43, 20150 Denizli Merkez/Denizli. Phone: +90 533 927 13 71. Contact: info@rilotti.com
1. What DMLink does
DMLink lets creators and businesses with an Instagram professional account automatically send a private message (DM) with a link to people who comment a chosen keyword on their posts.
2. How you connect your Instagram account
DMLink connects to Instagram with Meta’s Facebook Login for Business (Instagram API with Unified Login). You sign in with Meta and share your Instagram professional account with DMLink through your own Meta business portfolio. You decide which account you share, and you can remove DMLink’s access at any time (see section 9).
3. What data we process
Data we receive from Meta when you connect:
- Your Instagram account ID, username and profile picture URL
- The list of your posts, so you can choose which post a rule applies to
- Comments on your posts: comment ID, comment text, and the commenter’s Instagram ID and username
- Your Meta business portfolio ID
- The access token Meta issues to DMLink. It is stored only on our servers, in encrypted infrastructure, and is never sent to the app or to third parties.
Data you give us in DMLink:
- Your email address and DMLink account ID
- The rules you create: keywords, message text, link, optional public comment reply
- Delivery records used for statistics: comment ID, post ID, status, time
People who comment on your posts: we use their comment ID, comment text, Instagram ID and username only to apply your rule, avoid sending the same person two messages, and show you statistics.
4. Meta permissions DMLink uses
DMLink asks Meta for these four permissions and uses each one only for the purpose below.
| Permission | Why DMLink needs it |
|---|---|
instagram_basic | To show the connected Instagram professional account (username, profile photo) and list its posts so you can pick which post a rule applies to. |
instagram_manage_comments | To read comments on your posts and find the ones that contain your keyword; optionally to post your public reply under that comment. |
instagram_manage_messages | To send one private reply (DM) with your link to the person who commented. Meta allows at most one private reply per comment, within 7 days. |
business_management | To find which Instagram account you shared with DMLink through your Meta business portfolio. DMLink does not change anything in your business portfolio. |
public_profile is the basic permission that Facebook Login always grants, and Meta may list it separately on its screen. DMLink uses it only to complete sign-in and does not store personal Facebook profile data.
5. What DMLink does not do
- It does not manage ads.
- It does not publish posts.
- It does not read or store your DM inbox. It only records the result of the messages DMLink itself sends.
- It does not read your follower list.
- It does not sell your data or use it for advertising.
6. Why we process data and on what legal basis
- Providing the service: performance of a contract
- Security and abuse prevention (for example, hourly sending limits): legitimate interest
- Legal obligations: compliance with the law
7. Who we share data with
- Meta Platforms (Instagram): we use the Instagram API to read comments and send messages and comment replies.
- Google Cloud / Firebase: hosting and database. Data is stored in the EU (Belgium, europe-west1).
- Authorities, where required by law.
8. How long we keep data
- Your account and rules: until you delete them
- Access token: deleted immediately when you delete your account. If you remove DMLink’s access in Meta, the token stops working right away.
- Delivery records: while your account is active. All are deleted with the account.
- Technical counters: 48 hours
9. Removing access, your rights and deleting your data
- Remove access in Meta: Meta Business Settings → Integrations → Connected apps → DMLink → Remove. Once access is removed, the token becomes invalid and your account is set to inactive in DMLink.
- In the app: Settings → “Delete my account”. This deletes all of your data in DMLink.
- Through Meta: if you send a data deletion request for DMLink through Meta, we delete your data. You get a confirmation code to follow the status of your request.
- By email: info@rilotti.com. You can exercise your rights of access, correction, deletion, objection and others under GDPR Articles 15–22 and Turkish KVKK Article 11.
See the data deletion instructions for details.
10. Security
Access tokens are kept server-side only, in encrypted infrastructure and a database area closed to clients, and are masked in logs. All communication is encrypted with HTTPS.
11. Children
DMLink is not intended for people under 18.
12. Changes
If we update this policy, we will change the date on this page and announce important changes in the app.