1. Introduction & Overview
Welcome to LoopDM ("LoopDM", "we", "us", or "our"). LoopDM is an automation tool designed to help creators, brands, and businesses interact efficiently with their audience on Instagram and Facebook by delivering automated direct messages and comment replies triggered by user engagement.
We take your privacy and data protection very seriously. This Privacy Policy details the types of information we collect, how it is utilized and stored, how we interface with official Meta APIs (Instagram Graph API and Facebook Pages API), and your rights regarding data control, export, and deletion.
2. Information We Collect
We collect only the minimum necessary data required to fulfill the automation services and technical support configured by you:
A. Workspace Account Information
- Full Name and verified Email Address.
- Verified Mobile Phone Number (for accounts registered or authenticated via Phone OTP).
- Encrypted authentication credentials (passwords are hashed using bcrypt).
- Workspace settings, keyword triggers, and configured DM message templates.
B. Meta & Instagram Profile Data
- Facebook Page ID & Instagram Business/Creator Scoped User ID (IGSID).
- Public Page/Account username, display name, and avatar URL.
- Encrypted OAuth access tokens granted through Meta Login for Business.
C. Comment & Interaction Data
- Post and Reel IDs selected for keyword monitoring.
- Comment ID, comment timestamp, and text content to evaluate trigger keywords.
- Commenter Instagram/Facebook scoped ID and public username to dispatch requested DMs.
D. Technical & Operational Logs
- Affirmative consent audit metadata (timestamp of acceptance, legal terms policy version, client IP address, and browser/device user-agent string).
- Webhook delivery payload status codes and execution timestamps.
- Rate limit status and API delivery confirmation logs for troubleshooting.
- Session security identifiers to protect against unauthorized access.
E. Support Tickets & Diagnostic Telemetry
When you submit a support ticket or bug report through our in-app support modal, we collect:
- User-provided ticket details: Subject line, detailed issue description, category (Bug, Feature, Help, Account), and urgency level.
- Client technical telemetry: Operating system, browser user-agent, viewport resolution, active application route, and connected channel profile context at the time of ticket submission.
- This diagnostic data is used exclusively by our engineering team to investigate, reproduce, and resolve reported defects.
3. Purpose & Legal Basis of Data Processing
We use the information we collect solely for the following business and functional purposes:
- Executing Automation: Detecting when a user comments with your designated trigger words on designated Posts/Reels, sending an automated public reply, and delivering the requested DM via official Meta APIs.
- Service Delivery & Sync: Refreshing page metadata, media lists, and account connections.
- Security & Abuse Prevention: Ensuring compliance with Meta Platform Policies, preventing spam, detecting anomalies, and enforcing rate limiting.
- Customer Support & Bug Remediation: Processing user support tickets, reviewing technical telemetry, and diagnosing reported software defects to provide technical assistance.
- Analytics & Audit Logs: Providing creators with real-time visibility into trigger counts, message delivery successes, and error logs.
- Legal Compliance & Consent Audit Trail: Maintaining verifiable, timestamped evidentiary records of affirmative contractual assent (Clickwrap) and statutory age verification (18+) as mandated by global contract law and child data protection frameworks.
4. Third-Party Sub-Processors & Meta Compliance
We never sell, rent, license, or monetize your personal information or your audience's data. We do not share data with third-party advertisers, data brokers, or profiling agencies.
To provide high-availability automation services, LoopDM engages the following authorized sub-processors under strict data protection terms:
| Sub-Processor | Purpose / Service | Data Handled | Location |
|---|---|---|---|
| Meta Platforms, Inc. | Instagram Graph API & Facebook Pages API | Comments, messaging webhooks, DMs | Global / United States |
| Oracle Cloud (OCI) | Secure Cloud VPS Hosting & Server Infrastructure | Encrypted database, container workloads | Frankfurt / Singapore |
| PostgreSQL & Redis | Dedicated Self-Hosted Database & Event Queue | Encrypted credentials, triggers, audit logs | Isolated Cloud Container |
| Resend Technologies, Inc. | Transactional Email & OTP Verification | User email address, security alert emails | United States (AWS) |
| Google LLC / Firebase | Social Sign-In & Mobile Phone OTP Verification | Google profile email, mobile phone number | Global |
5. Cookie & Tracking Policy
LoopDM uses strictly necessary, HTTP-only session cookies solely to keep you securely authenticated while navigating the platform.
- No Advertising Cookies: We do not use third-party tracking pixels, Facebook Pixel, Google Ads, or advertising trackers.
- Secure Attributes: All session cookies are flagged with
HttpOnly,Secure, andSameSite=Laxto protect against CSRF and cross-site hijacking. - Zero Cross-Site Profiling: We do not monitor your browsing behavior across other websites or third-party applications.
6. Data Security & Retention
All Meta access tokens and sensitive credentials stored in LoopDM are protected using industry-standard AES-256 encryption at rest. All network communications between your browser, our servers, and Meta APIs occur exclusively over encrypted HTTPS/TLS 1.3 channels.
We retain your information only for as long as your workspace account remains active or as needed to maintain automation history. Operational audit log entries older than 90 days are automatically pruned from active memory. Affirmative consent audit records (client IP address, device user-agent, acceptance timestamp, terms policy version) are securely preserved alongside your account profile for the active duration of your workspace and applicable statutory limitation periods to demonstrate regulatory compliance and defend against legal claims. Support ticket records are retained as long as necessary to maintain resolution history and product quality standards.
7. Your Rights & Data Portability
Under GDPR (Art. 15–20), CCPA/CPRA, and the Indian Digital Personal Data Protection Act 2023, you retain complete ownership and control over your data. You may at any time:
- Self-Serve Data Portability: Download a full machine-readable JSON export of your workspace profile, triggers, connected channels, and delivery metrics directly from your Settings page with 1 click.
- Export Dispatch Logs: Download a complete CSV archive of all historical DM delivery records, timestamps, and error logs anytime from the Audit Logs section.
- Disconnect Channels: Disconnect any connected Instagram account or Facebook page immediately from your dashboard with one click.
- Revoke Permissions: Revoke LoopDM permissions directly from your Facebook Business Integrations or Instagram Account Security settings.
- Self-Service Account Deletion: Permanently delete your LoopDM workspace, trigger automations, contact lists, and logs via the "Delete Account & Data" option in your Account Settings.
Follow our automated instructions or verify your deletion status via confirmation code.
8. Grievance Redressal & Data Protection Officer
In compliance with the Digital Personal Data Protection (DPDP) Act 2023 and GDPR Article 37, LoopDM has designated a Grievance Officer and Data Protection Lead to promptly address privacy concerns, data subject requests, and regulatory inquiries:
9. Children's Privacy (Under 18 Notice)
LoopDM is strictly intended for use by adults, professionals, and business entities. In accordance with the Digital Personal Data Protection (DPDP) Act 2023 (Section 9) and the US Children's Online Privacy Protection Act (COPPA), we do not knowingly collect, solicit, or maintain personal information from individuals under eighteen (18) years of age. All new account registrations require an affirmative, mandatory confirmation of majority age (18+) before workspace provisioning.
If you are a parent or legal guardian and discover that your minor child has created a LoopDM workspace or provided personal data to our services without your consent, please contact our Data Protection Officer immediately at [email protected]. Upon verification, we will promptly purge all associated account records, tokens, and logs from our databases within 48 business hours.