Introduction

Welcome to DMpro (“DMpro,” “we,” “our,” or “us”), operated by InstaMedic Incorporated, located at 215 Fort York Blvd, Toronto, Ontario, M5V 4A2, Canada. DMpro is a cloud-based software-as-a-service (SaaS) platform that enables users to automate conversations, manage social messaging, connect multiple social media platforms, automate replies, generate AI-powered responses, collaborate with team members, schedule messages, manage leads, analyze conversations, and integrate with third-party services.

This Privacy Policy explains what information we collect, how we collect it, why we collect it, how we use it, and the choices you have regarding your information. It applies to all users of DMpro’s website at https://dmpro.app/, our browser extensions, mobile applications, APIs, and any other products or services that link to this Privacy Policy (collectively, the “Services”).

By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described here, please do not use our Services.

For additional product information, visit our Knowledge Base.

Definitions

For the purposes of this Privacy Policy, the following terms apply:

Information We Collect

We collect information in several categories. The specific data collected depends on which features you use, which integrations you enable, and how you interact with the Services.

3.1 Account and Profile Information

• Full name, display name, and username
• Email address and phone number
• Profile photograph or avatar
• Password (stored in hashed form only, never plain text)
• Account preferences, language, locale, and timezone

3.2 Business and Organization Information

• Company or organization name, type, industry, and size
• Business address and registration details
• Website URLs
• Tax identification numbers (where required for invoicing)
• Workspace name and configuration

3.3 Billing and Payment Information

• Subscription plan and tier
• Billing address
• Payment method details (processed and stored by our payment processors, not stored directly by DMpro)
• Payment history, transaction records, invoices, and receipts
• Refund and chargeback records, coupon or promotional codes used
• Trial participation records

3.4 Content and Communications

• Chat messages, direct messages, conversations, comments, and replies sent or received through the Services
• Post captions and media descriptions
• Uploaded files including images, videos, documents, audio files, logos, and brand assets
• AI prompts submitted to our AI features and AI-generated responses
• Automation workflows, campaign settings, message templates, and sequences
• Scheduled messages and drafts
• Support requests, feedback, survey responses, and correspondence with our team

3.5 CRM and Lead Data

• Contact names, email addresses, phone numbers
• Tags, labels, custom fields, lead status, lead scores, and pipeline stages
• Customer lists and audience segments
• Notes, internal annotations, and conversation history associated with contacts
• Shipping addresses and order information (when commerce integrations are active)

3.6 Connected Account Data

When you connect third-party accounts, we may receive data from those platforms, subject to the permissions you grant. This may include:

• Social media profile information (name, handle, bio, avatar, follower count)
• Page and business account details
• Messaging permissions and message content
• Post engagement and analytics
• Commerce data (orders, products, customers) from connected e-commerce platforms
• Calendar events, scheduling data, email metadata, and file metadata from connected productivity services

3.7 Technical and Usage Data

• IP address, browser type/version/language, operating system, and device type
• Screen resolution, referring URL, UTM parameters, and campaign identifiers
• Pages visited, features used, actions taken, click events, scroll depth, and interaction patterns
• Search queries within the application, session duration, and frequency of use
• Error messages and crash reports

3.8 Log and Diagnostic Data

• Server access logs, API request/response logs, webhook event logs
• Authentication and login logs, security event logs, and audit trails
• OAuth token metadata (tokens are encrypted; we log metadata such as grant time and scope, not tokens in plain text)
• Rate-limiting records, performance metrics, and latency data

3.9 Team and Workspace Data

• Team member names, email addresses, roles, and permission levels
• Invitation records, access history, activity and audit logs within the Workspace
• Organization-level settings and configurations

3.10 AI Usage Data

• Prompts submitted to AI features and token consumption statistics
• Feature-specific AI interaction logs and error logs related to AI processing

3.11 Notification and Marketing Preferences

• Email communication preferences and push notification settings
• Marketing opt-in and opt-out records
• Beta program participation status

3.12 Security and Fraud Prevention Data

• Two-factor authentication (2FA) configuration and recovery data
• Login attempt records (including failed attempts)
• Device fingerprints, trust indicators, and fraud-detection signals

3.13 Archived and Backup Data

• Archived messages, conversations, and workflows
• System backups containing account and content data
• Deleted data retained temporarily before permanent removal (see Section 12)

How We Collect Information

4.1 Information You Provide Directly

We collect information you actively provide when you register, update your profile, configure automations, upload files, submit AI prompts, enter billing details, contact support, respond to surveys, or invite team members.

4.2 Information from Connected Accounts

When you authorize DMpro to connect with a third-party service, we receive information through that service’s API, subject to the permissions you grant during the authorization process. This includes OAuth-based logins (such as Google Sign-In or Microsoft login) and platform-specific API integrations.

4.3 Information Collected Automatically

We collect technical and usage information automatically through:

• Cookies and similar technologies (see Section 9)
• Server logs that record requests made to our infrastructure
• Analytics tools embedded in our website and application
• Pixel and tracking technologies, local storage, and session storage
• Error-reporting and crash-monitoring tools

4.4 Information from Third-Party Sources

We may receive information from payment processors confirming transaction status, third-party analytics providers, social media platforms, CRM and commerce platforms synchronized by you, partners and resellers, and publicly available sources for fraud prevention and identity verification.

4.5 Future Collection Methods

As technology evolves, we may adopt new methods of data collection, including advanced analytics, new API protocols, and emerging platform integrations. We will update this Privacy Policy to reflect any material changes.

How We Use Your Information

5.1 Providing and Operating the Services

Creating and managing your account, authenticating identity, connecting and synchronizing authorized third-party accounts, sending/receiving/scheduling/automating messages, powering AI features, storing content and workflows, enabling team collaboration, and processing calendar integrations.

5.2 Billing and Payments

Processing subscription charges, upgrades, and downgrades, generating invoices, managing trials and promotions, and complying with tax reporting requirements.

5.3 Communication

Sending transactional emails (account confirmation, password resets, billing receipts), product updates and release notes, responding to support requests, and sending marketing communications where you have opted in. You may opt out of marketing emails at any time.

5.4 Improvement and Development

Analyzing usage patterns, conducting internal research, identifying and fixing bugs, developing and testing new features, and generating aggregated and anonymized insights that cannot identify individual users.

5.5 Security, Compliance, and Fraud Prevention

Detecting and preventing unauthorized access, fraud, abuse, and spam, monitoring system health, enforcing our Terms of Service, complying with legal obligations, and maintaining audit logs.

5.6 Personalization

Customizing your experience based on preferences and usage, recommending features and templates relevant to your use case, and tailoring notification frequency and content.

5.7 Legal and Business Purposes

Fulfilling legal obligations, responding to lawful requests, supporting corporate transactions such as mergers or acquisitions, resolving disputes, enforcing agreements, and internal reporting using aggregated data.

Social Account Access and Integrations

DMpro connects to your existing social media, messaging, commerce, and productivity accounts only after you explicitly grant permission.

6.1 Platforms We May Connect With

DMpro currently supports or may support integrations with the following types of platforms. This list is not exhaustive and may expand over time.

6.2 How Authorization Works

6.3 What We Do and Do Not Do

• DMpro never posts, sends, or publishes content on your behalf unless you configure an automation to do so or manually instruct the platform.
• DMpro never accesses private data beyond the scope of the permissions you have granted.
• DMpro never sells your social media credentials, tokens, or Connected Account data.
• DMpro does not independently scrape data from third-party platforms.

6.4 Disconnecting Integrations

You may disconnect any Connected Account at any time through your DMpro account settings. When you disconnect, DMpro stops accessing data from that platform, features that depend on the connection stop functioning, and previously retrieved data may be retained per our retention practices (see Section 12) unless you request deletion. We also recommend revoking DMpro’s access from within the third-party platform’s settings.

6.5 Platform-Specific Terms

Each third-party platform has its own terms of service, privacy policy, and developer requirements. DMpro complies with applicable platform policies. Your use of Connected Accounts is also subject to the terms and policies of those platforms.

Team Management and Workspaces

DMpro supports collaborative Workspaces where teams can manage messaging, automations, and customer interactions together.

7.1 Roles and Permissions

Workspace Owners and Admins are responsible for managing access and permissions for each team member.

7.2 Team Data

When a team member is invited to a Workspace, DMpro collects their name, email address, and role assignment. Activity within the Workspace, including message interactions, automation changes, and login events, may be logged in the Workspace audit trail.

7.3 Shared Inbox and Internal Notes

Conversations within a Workspace may be visible to multiple team members based on their role. Internal notes added to conversations are visible only to Workspace members, not to End Users.

7.4 Access Removal and Ownership Transfer

Team members can be removed at any time by an Owner or Admin. Upon removal, access is revoked immediately. Data they contributed (such as conversations and notes) remains within the Workspace. Workspace ownership can be transferred to another member by the current Owner.

AI Features

DMpro offers AI-powered features designed to help you communicate more effectively.

8.1 What AI Features Do

• Message generation and rewriting based on your prompts or conversation context
• Automated replies suggesting or generating responses to incoming messages
• Translation between languages
• Summarization of conversations or threads
• Knowledge bases using your uploaded content for contextually relevant responses
• Automation suggestions recommending workflow improvements

8.2 How AI Data Is Processed

When you use an AI feature, the relevant input (such as your prompt or conversation context) is sent to an AI processing service. Processing may be performed by DMpro’s own infrastructure or by third-party AI providers (such as OpenAI or Anthropic). Data is transmitted securely and subject to our contractual agreements with those providers.

AI inputs are processed in real time and are not retained by third-party AI providers for model training purposes, unless explicitly stated and agreed to by you.

8.3 AI Training

8.4 Limitations and Responsibilities

AI-generated content may contain inaccuracies, incomplete information, or unintended outputs (commonly referred to as “hallucinations”). You are responsible for reviewing and approving any AI-generated content before it is sent to End Users. DMpro does not guarantee the accuracy, completeness, or appropriateness of AI-generated content. Avoid submitting sensitive personal data (such as government IDs or financial account numbers) into AI prompts unless the feature is specifically designed and secured for that purpose.

Cookies and Similar Technologies

9.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website or use an application. Similar technologies include pixels, local storage, session storage, and device fingerprinting.

9.2 Types of Cookies We Use

9.3 Third-Party Cookies

Some cookies are placed by third-party services we use, such as analytics providers and advertising platforms. These third parties may collect information about your browsing activity across different websites.

9.4 Session vs. Persistent Cookies

Session cookies are temporary and deleted when you close your browser. Persistent cookies remain on your device until they expire or you delete them.

9.5 Your Cookie Choices

You can manage cookie preferences through our consent banner, or through your browser settings. Disabling certain cookies may affect functionality. For more information, visit allaboutcookies.org.

9.6 Future Technologies

We may adopt new tracking or analytics technologies in the future. This section will be updated accordingly.

Third-Party Services

DMpro integrates with and relies on a variety of third-party service providers. These providers process data on our behalf under contractual obligations that require them to protect your information.

Data Sharing and Disclosure

11.1 Service Providers and Sub-Processors

We share data with trusted service providers who perform functions on our behalf (cloud hosting, payment processing, email delivery, analytics, customer support, AI processing). These providers are contractually required to use your data only for the purposes we specify and to maintain appropriate security measures.

11.2 At Your Direction

We share data when you instruct us to, including sending messages through Connected Accounts, synchronizing data with enabled integrations, sharing Workspace data with invited team members, exporting data via API or webhook, and connecting commerce platforms.

11.3 Legal and Compliance

We may disclose your information when required to comply with applicable laws, respond to lawful government requests, enforce our Terms of Service, or investigate potential policy violations.

11.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or asset sale, your information may be transferred as part of that transaction. We will notify you of any such change and the choices available to you.

11.5 Other Disclosures

We may share data with professional advisors (auditors, legal counsel, accountants), fraud-prevention and security partners, affiliated entities under common ownership, and in the form of aggregated or anonymized data that cannot reasonably identify you.

Data Retention

12.1 General Principles

We retain your information for as long as necessary to provide the Services, fulfill the purposes described in this Privacy Policy, and comply with legal obligations.

12.2 Active Accounts

While your account is active, we retain all associated data, including content, settings, integrations, and usage history.

12.3 Account Closure

When you close your account, your data is scheduled for deletion from active systems. Certain data may persist in backups for a limited period before permanent removal. Data required for legal, tax, or regulatory compliance may be retained for the period required by applicable law (for example, financial records may be retained for up to seven years).

12.4 Deleted Content

When you delete specific content (messages, contacts, automations), it is removed from active systems promptly. Copies may persist in backups for up to 90 days before permanent deletion.

12.5 Temporary and Diagnostic Data

Server logs, error reports, and diagnostic data are typically retained for 30 to 90 days. AI processing inputs are retained only for the duration needed to generate a response and perform error monitoring.

12.6 Deletion Requests

You may request deletion of your data at any time (see Section 14). We will process your request subject to any legal obligations requiring retention of certain records.

Security

We take the security of your data seriously and implement industry-standard measures to protect it.

13.1 Encryption

All data in transit is encrypted using TLS over HTTPS. Sensitive data at rest, including OAuth tokens, is encrypted using strong algorithms. Passwords are never stored in plain text; we use cryptographic hashing with salting.

13.2 Access Controls

We enforce the principle of least privilege. Employees and contractors only access data necessary for their role. Role-based access control is used both within the application and internal systems. Multi-factor authentication (MFA) is available for user accounts and required for internal administrative access.

13.3 Infrastructure Security

Our infrastructure is hosted with providers maintaining industry-recognized certifications (SOC 2, ISO 27001). We use firewalls, intrusion detection, network segmentation, and regular security monitoring.

13.4 Development and Testing

We follow secure development practices including code reviews, static analysis, dependency scanning, vulnerability assessments, and penetration testing.

13.5 Incident Response

We maintain an incident response plan. In the event of a breach affecting your Personal Data, we will notify you and relevant authorities as required by applicable law.

13.6 Backups and Recovery

Regular backups and disaster-recovery procedures ensure data integrity and availability. Backup data is encrypted and access-controlled.

13.7 Data Minimization

We collect and retain only the data necessary to provide the Services and fulfill the purposes described in this Privacy Policy.

Your Rights and Choices

Depending on your location, you may have certain rights regarding your Personal Data.

14.1 GDPR and UK GDPR

If you are located in the European Economic Area (EEA) or the United Kingdom:

• Access: Request a copy of the Personal Data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion, subject to legal retention obligations.
• Restriction: Request that we limit processing in certain circumstances.
• Portability: Receive your data in a structured, machine-readable format.
• Object: Object to processing based on legitimate interests or for direct marketing.
• Withdraw Consent: Where processing is based on consent, withdraw at any time without affecting the lawfulness of prior processing.
• Lodge a Complaint: File a complaint with your local data protection authority.

14.2 CCPA and CPRA

If you are a California resident:

• Know: Request information about categories and specific pieces of data collected, sources, purposes, and third parties shared with.
• Delete: Request deletion of collected data, subject to exceptions.
• Correct: Request correction of inaccurate data.
• Opt Out: DMpro does not sell Personal Data. If this ever changes, we will provide a clear opt-out.
• Non-Discrimination: Exercise rights without discriminatory treatment.

14.3 Other Jurisdictions

Additional rights may be available under the laws of Canada (PIPEDA), Brazil (LGPD), Australia (Privacy Act 1988), India (DPDPA), and other applicable national and regional privacy laws. If you are located in these jurisdictions, you may have rights similar to those described above.

14.4 How to Exercise Your Rights

Contact us at privacy@dmpro.app. We will verify your identity before processing your request and aim to respond within 30 days (or within the period required by applicable law).

14.5 Appeals

If you are dissatisfied with our response, you may contact us again for further review, or lodge a complaint with the relevant data protection authority in your jurisdiction.

Children’s Privacy

DMpro is designed for business and professional use. Our Services are not intended for, and we do not knowingly collect Personal Data from, children under the age of 16 (or the applicable minimum age in your jurisdiction, such as 13 in the United States under COPPA).

If we become aware that we have inadvertently collected Personal Data from a child under the applicable age, we will take steps to delete that information promptly. If you believe a child has provided us with Personal Data, please contact us at privacy@dmpro.app.

International Data Transfers

DMpro operates globally, and your data may be processed in countries other than the one in which you reside. These countries may have data protection laws that differ from your jurisdiction.

16.1 Transfer Safeguards

When we transfer Personal Data internationally, we implement appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, Data Processing Agreements with third-party processors, and contractual commitments with sub-processors requiring them to maintain security and privacy standards consistent with this Privacy Policy.

16.2 Your Acknowledgment

By using the Services, you acknowledge that your data may be transferred to, stored in, and processed in jurisdictions outside your country of residence.

Legal Basis for Processing

For users in the EEA, UK, and other jurisdictions requiring a legal basis:

Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technologies, legal requirements, or for other operational reasons.

18.1 How We Notify You

Material changes will be communicated via email and through a prominent in-app notice prior to taking effect. Minor changes (such as formatting or typographical corrections) may be made without advance notice.

18.2 Continued Use

Your continued use of the Services after the effective date of a revised Privacy Policy constitutes your acknowledgment of the updated practices. If you do not agree with a material change, you may close your account.

18.3 Prior Versions

We maintain an archive of prior versions. You may request access to a previous version by contacting us.

Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, reach us through the following channels:

Website: https://dmpro.app/  ·  Knowledge Base: brandid.app/dmpro-knowledge-base

Postal address: InstaMedic Incorporated, 215 Fort York Blvd, Toronto, Ontario M5V 4A2, Canada.