Privacy Policy

Effective date: October 14, 2026

DMpilot ("we", "us") takes the privacy of our users seriously and complies with applicable data protection laws. This policy explains how we handle personal data collected when you use the DMpilot service.

1. Information We Collect

We collect the following categories of personal data to provide the service.

  • Account information: email address, password (stored encrypted), and the name and email provided by Apple or Google if you sign in with them
  • Connected Instagram account data: Instagram user ID, username, profile information, access token (stored encrypted)
  • Automation trigger data: the Instagram handle and content of comments, and the content of messages used to trigger DM and story-mention automations
  • Usage records: automated DM delivery logs, how many times links in your DMs were opened, and how many people you reached each month
  • Subscription information: product, trial status and expiry date (payments are processed by the App Store or Google Play; we never receive card details)
  • Device information: a device token used to send push notifications

2. How We Use Your Information

Collected data is used only for the following purposes and never for any purpose beyond them.

  • Sending automated DMs based on the comment, DM, and story-mention rules you configure
  • Running comment-based giveaways and selecting winners
  • Operating the service, handling errors, and responding to user inquiries

3. Data Retention

When you disconnect your Instagram account, we immediately delete the connected account information, access token, and related trigger data (comment, DM, and story-mention content).

When you delete your account, we destroy all personal data without delay unless retention is required by applicable law.

4. Notice Regarding Meta Platform Data

DMpilot processes data made available through Meta’s Instagram API. Data obtained this way is handled in accordance with Meta’s Platform Terms and Developer Policies, and is never used for any purpose other than those stated in this policy (automated DM delivery and comment giveaways).

Data collected via the Meta platform is never sold to third parties or used for advertising, and is processed only to the extent necessary to provide the service.

5. Your Rights and How to Request Deletion

You may request access to, correction of, or deletion of your personal data at any time by:

  • Delete your account: in the app, Settings > Delete account. Your account, connected Instagram data, automations and delivery logs are deleted immediately. If you cannot use the app, email contact@ytlab.site from the address you signed up with.
  • Disconnect Instagram: in the app, Settings > disconnect the account
  • Cancel a subscription: deleting your account does not cancel an App Store or Google Play subscription. Cancel it in that store’s subscription settings.
  • Email: contact@ytlab.site

6. Processors and International Transfers

We use the following processors to provide the service. Account and automation data is stored in the Republic of Korea (Seoul).

  • Supabase Inc.: database and sign-in (Seoul, Korea)
  • Vercel Inc.: server hosting (Seoul, Korea)
  • Google LLC (Firebase): push notifications (United States; the device token is sent when a notification is delivered)
  • RevenueCat Inc.: subscription status (United States; your user identifier and purchase history when you subscribe)
  • Apple Inc., Google LLC: sign-in and in-app purchases
  • Meta Platforms, Inc.: message delivery through the Instagram API
Back to home