Privacy statement
This is an English translation for your convenience. The Dutch version is legally binding.
DMback is a service of DMback. This statement explains which data we process, for two groups: customers (businesses and creators who use the service) and Instagram users who comment on our customers’ posts.
In short
- We use Meta’s official Instagram API, and only to automatically answer comments that contain a requested word.
- We store as little as possible, in the EU, and erase it automatically.
- We don’t sell anything and don’t build profiles. No ads, no tracking.
1. If you comment on a post by one of our customers
If you comment under a customer’s Instagram post with a word that customer asked for (for example “GUIDE”), our software automatically sends one private message with the promised information on behalf of that customer. For this data, the customer is the controller and we are the processor.
Which data
- the ID of your comment (comment ID) and of the post (media ID);
- your Instagram user ID (a number); no username, profile picture or other profile data;
- the text of your comment, solely to see whether it contains a requested word and to investigate faults;
- the recognised word, the time and whether the message was sent.
Legal basis and retention period
The customer’s legitimate interest, at your initiative: you request the information yourself by responding to an explicit invitation. The data is erased automatically after the retention period the customer chooses (30 days by default, minimum 8). In any case, Instagram only allows a message within 7 days of your comment.
Stopping and deleting
You can delete the conversation on Instagram or block the account. If you want us to erase your data, request this via Instagram (the app deletion feature) or email the contact address on our website with your Instagram username; we will then look up your data and erase it across all customers within 30 days. See also data deletion.
2. If you are a customer
We are the controller for your own account data.
| Account | name, email address, encrypted password (hash), login times and IP address (security) |
|---|---|
| Instagram connection | account ID, username, name, profile picture URL and account type of your Instagram business account, and an access token (stored encrypted). Permissions requested: instagram_business_basic, instagram_business_manage_comments, instagram_business_manage_messages. |
| Billing | company name, address, VAT number and payment status (Stripe processes the payment details themselves; we don’t see them) |
| Purposes | providing the service, sending invoices, support, security and abuse prevention, statutory retention obligations |
| Legal basis | performance of the contract; legal obligation (7-year tax retention obligation for invoices); legitimate interest (security) |
| Retention period | as long as your account exists; after deletion we erase within 30 days, except billing data (7 years) |
If you disconnect Instagram or revoke access via Instagram, we delete the token immediately.
3. Who we share data with
Only with parties that are necessary to provide the service:
| Party | Purpose | Location | Transfer basis |
|---|---|---|---|
| Vercel Inc. | Application hosting (server functions in Frankfurt, fra1) | EU (Frankfurt); company in the US | EU-US Data Privacy Framework + SCC |
| Supabase Inc. | Database (PostgreSQL) | EU (Frankfurt, eu-central-1) | SCC; data stays in the EU |
| Meta Platforms Ireland Ltd. | Instagram API: receiving comments, sending DMs | EU / US | Necessary for the service; Meta Platform Terms |
| Stripe Payments Europe Ltd. | Payments and invoices (customer data only, no Instagram data) | EU (Ireland) / US | EU-US Data Privacy Framework + SCC |
| Resend (Plus Five Five Inc.) | Sending emails to customers (no Instagram data) | US / EU | EU-US Data Privacy Framework + SCC |
4. Security
Storage in the EU, encrypted connections, encrypted tokens, separation of customer data in the database, and logging of support access. See the Data Processing Agreement for details.
5. Cookies
We only use functional cookies: a login cookie and a cookie that remembers your language choice. No analytics or advertising cookies, so no cookie banner needed.
6. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. Customers can download a full export in the dashboard. For all requests, email the contact address on our website. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your own country.