Privacy Policy
Last updated: 21 July 2026
This policy explains what data ReadyDM collects, why we collect it, who we share it with, and the choices you have. It covers both people who hold a ReadyDM account and people who interact with an account holder's Instagram content.
1. Who we are
ReadyDM (“ReadyDM”, “we”, “us”) is a comment-to-DM automation service for Instagram Business and Creator accounts, operated by Appweavers, a micro enterprise registered in India under Udyam Registration Number UDYAM-KL-02-0104042, with its registered office at Shantipuram 90, NGO Quarters, Kakkanad, Thrikkakara, Ernakulam, Kerala 682021, India. We are the data controller (or, under India's Digital Personal Data Protection Act, 2023, the “Data Fiduciary”) for the personal data described in this policy.
We are not affiliated with, endorsed by, or operated by Meta Platforms, Inc. Instagram is a trademark of Meta Platforms, Inc.
You can reach us about anything in this policy at support@readydm.com.
2. Whose data this policy covers
ReadyDM processes personal data about two different groups of people:
- Account holders — people who sign up for ReadyDM and connect an Instagram Business or Creator account.
- People who interact with an account holder's Instagram content — Instagram users who comment on a connected account's posts or send it a direct message. These people do not have a ReadyDM account and never sign in to our service, but their data is processed so the automation can work. Section 9 is written specifically for them.
3. What we collect
3.1 Account information
When you create a ReadyDM account we collect your name, email address, and a unique account identifier issued by our authentication provider. If you join or create an organisation, we store the organisation name and your role within it. If you invite a teammate, we store the email address you enter so we can match the invitation when they sign in.
3.2 Instagram account data
When you connect an Instagram Business or Creator account via Meta's official login, we receive and store:
- Your Instagram account ID, username, display name and profile picture
- Your follower count and media count
- Your posts and their metadata — caption, media type, media and thumbnail URLs, permalink, comment count, like count and post timestamp
- An encrypted access token that lets us act on your behalf
We store a copy of your Instagram profile picture and post media on our own storage so the dashboard loads reliably when Meta's temporary media links expire.
3.3 Automation and message content
We store the automations you configure — trigger keywords, the DM templates you write, any public reply text, and any images you upload for message cards. We also store delivery records for each message we attempt to send: status, timestamps, the message ID returned by Meta, and any error.
3.4 Data about people who interact with your content
This is the most sensitive category we handle. When someone comments on a connected account's post or messages it, we store: their Instagram-scoped user ID, username, display name, profile picture (a copy of which we store on our own storage), follower count, whether they follow the account and whether the account follows them, how many times they have interacted, and when they last interacted. We also store the text of the comment that triggered an automation, along with the comment and post IDs.
This information is shown to the relevant account holder in their ReadyDM dashboard as a contact list. Incoming direct messages are processed to decide whether an automation should run; we do not store the body of incoming direct messages in our database.
3.5 Technical and operational data
Our servers receive and log event notifications ("webhooks") sent by Meta, including the raw notification payload and its request headers, so we can process events reliably and investigate failures. We also keep application logs and aggregated daily counters (for example, DMs sent per automation per day).
3.6 Billing data
Paid plans are processed by Razorpay. We send Razorpay your name and email to create a customer record, and we store the identifiers Razorpay returns (customer ID, subscription ID), your plan, subscription status and billing period dates. We never receive or store your card, UPI or bank details — those are handled entirely by Razorpay.
3.7 What we do not collect
- We do not collect your Instagram password. Authorisation happens entirely on Meta's systems.
- We do not use advertising cookies, tracking pixels or third-party analytics SDKs on our app.
- We do not buy personal data from data brokers, and we do not sell your data.
4. How we use data, and our legal basis
| Purpose | Data used | Basis |
|---|---|---|
| Create and secure your account | Account information | Performance of our contract with you |
| Detect comments and send automated DMs on your behalf | Instagram data, automations, interaction data | Performance of contract; consent given to Meta at connection |
| Show your contact list and analytics | Interaction data, delivery records | Performance of contract |
| Take payment and manage subscriptions | Billing data | Performance of contract; legal obligation (tax records) |
| Keep the service reliable, debug failures, prevent abuse | Technical and operational data | Our legitimate interest in a secure, working service |
| Reply to your support requests | Account information, correspondence | Performance of contract |
We do not use your data, your posts, or your contacts' data to train machine learning models, and we do not use it for advertising.
5. Instagram permissions we request
ReadyDM uses Meta's official Instagram Graph API. We request only the permissions the product needs:
- instagram_business_basic — read your basic profile and your posts, so we can show them in the dashboard and let you pick which post an automation applies to.
- instagram_business_manage_comments — read comments on your posts (to detect triggers) and post public replies where you have configured one.
- instagram_business_manage_messages — send direct messages on your behalf and receive message events that your automations respond to.
Our use of information received from Meta APIs adheres to Meta's Platform Terms and Developer Policies, including their Limited Use requirements. Your access token is encrypted before it is stored, is never written to our logs, and is never shared with third parties. You can revoke ReadyDM's access at any time — see Section 8.
6. Who we share data with
We do not sell personal data and we do not share it for advertising. We share data only with the service providers that make ReadyDM work:
| Provider | What it does | What it receives |
|---|---|---|
| Google Firebase | Sign-in and authentication | Your email, name and sign-in credentials |
| Meta Platforms | The Instagram integration itself | Access tokens, message and reply content, recipient IDs |
| Razorpay | Payments and subscriptions | Your name, email and payment details you enter with them |
| Amazon Web Services | Application and database hosting | All service data, stored on our servers |
| Cloudflare R2 | Image and media storage | Profile pictures, post media, images you upload |
We may also disclose data if we are legally required to, to enforce our Terms & Conditions, to investigate fraud or abuse, or in connection with a merger or acquisition (in which case we will notify you before your data becomes subject to a different policy).
Note on media links: images we store are served from a public media domain. The URLs are long and unguessable, but they are not access-controlled — anyone holding a link can open it.
7. Security and where data is stored
Our infrastructure runs on Amazon Web Services, with media stored on Cloudflare R2. Because these are global providers, your data may be stored or processed outside the country you live in.
Our safeguards include:
- TLS encryption for all data in transit
- Encryption of Instagram access tokens at rest
- Signature verification on incoming Meta webhooks
- Access controls so that data is scoped to your organisation
- Regular database backups
No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant authorities as required by law.
8. Your rights and choices
Depending on where you live, you have some or all of the following rights:
- Access — ask for a copy of the personal data we hold about you.
- Correction — ask us to fix data that is wrong or incomplete.
- Deletion — ask us to delete your account and personal data.
- Withdraw consent — disconnect your Instagram account at any time.
- Complain — raise a concern with your data protection authority.
To exercise any of these, email support@readydm.com from the address on your account. We will respond within 30 days.
You can also revoke ReadyDM's access directly from Instagram, under Settings → Website permissions → Apps and websites. Doing so stops all automations immediately.
9. If you commented on someone's post
If you commented on, or messaged, an Instagram account that uses ReadyDM, we hold your public Instagram profile details and the text of your comment on behalf of that account holder — in the same way a business keeps a record of a customer enquiry. We use it only to deliver the reply you were sent and to show the account holder their interaction history. We do not use it to contact you for our own purposes, and we do not sell it.
To have your data removed, email support@readydm.com with your Instagram username and the account you interacted with. You can also stop future processing by deleting your comment or blocking the account.
10. How long we keep data
- While your account is open — we keep your account data, Instagram data, automations and contacts so the service works.
- After you ask us to delete your account — we deactivate it and remove or anonymise your personal data within 30 days, and we revoke and delete stored Instagram access tokens.
- Aggregated statistics — counts such as “DMs sent per day”, which no longer identify anyone, may be kept after deletion.
- Billing records — kept for as long as tax and accounting law requires.
- Operational logs and webhook records — kept only as long as needed for debugging, security and abuse investigation.
11. Children
ReadyDM is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us personal data, email us and we will delete it.
12. Changes to this policy
We may update this policy as the product changes. We will update the “last updated” date above, and for material changes we will notify account holders by email or in the app before the change takes effect.
13. Contact us
For any privacy question, request or complaint, contact support@readydm.com. If you are not satisfied with our response, you may escalate to the Data Protection Board of India or your local supervisory authority.