Data & Privacy

What InfluDM stores, how long it keeps it, and how it can be removed.

What's stored

Data	Where it comes from
Your account — email, name	Your sign-in provider (Google, Facebook, or email sign-up).
Instagram account — user id, username, name, picture, access tokens	Instagram, at connect time.
Flows and lead forms	What you author in the app.
Contacts — Instagram user id, username, name, picture, follow relationship	The people who interact with your flows.
Conversation history — the triggering comment or message, and where the conversation got to	Instagram.
Leads — the answers people give your lead forms	The people themselves.
Brand collab requests — DMs identified as collaboration offers, with the sender and the offer	Collab Detection, when it's switched on.
Moderation log — comments that were classified as something other than Neutral	Comment Moderation, when it's switched on.
Billing — plan, payments, invoice details	Your purchases.

What the AI features store

Both AI features are off until you switch them on, and store nothing at all until you do.

When they are on, they store only what they act on:

• Collab Detection keeps the DMs it identifies as collaboration offers. Every other DM is read, classified and discarded — it is never written to our database.
• Comment Moderation keeps comments classified as Spam, Slurs/Abuse, Negative or Criticism. Neutral comments are never stored, and neutral is the overwhelming majority of everything your account receives.

The text of a message or comment is sent to the AI provider for the single classification and is not used to train any model. Each read is independent — the AI is given the one message being classified and nothing else about you, your audience or your business.

How the AI Works explains the full sequence.

Access tokens

Instagram issues an access token when you connect an account, and it is refreshed in the background. Disconnecting an account removes it. Tokens are used only to read the events your flows react to and to send the messages they define.

What InfluDM never does

• Message people who haven't interacted with you.
• Send bulk or broadcast DMs to your contact list.
• Follow, unfollow or like on your behalf.
• Scrape follower lists.
• Share your contacts or leads with other workspaces.

See Instagram's Messaging Rules.

Follow relationship data

The follow relationship on a contact is only ever fetched when Instagram allows it — that is, after the person has messaged your account. Contacts who only commented are recorded as Unknown, never inferred. See Contacts.

Data lifetime

Action	Effect
Delete a flow	Its executions go. Leads captured by it are kept.
Delete a lead form	Refused while a flow still uses it. Leads captured by it are kept.
Disconnect an Instagram account	Its flows and contacts are deleted. Leads are kept. Contact allowance is not restored.
Remove a team member	Their access ends. Nothing they created is deleted.
Delete your account (owner)	The whole workspace is wiped — including every lead. Irreversible.
Delete your account (member/admin)	Only that seat. The workspace continues.
Switch off an AI feature	It stops reading and storing immediately. What it already saved is kept.
Moderation log ageing out	Entries clear themselves after about a month, with no action from you.

Leads are deliberately the most durable thing in the product: each submission snapshots the contact's identity, the flow name, the form name and every question and answer, so it survives the deletion of everything that produced it. Only deleting the workspace destroys leads.

Removing your data via Meta

Instagram and Facebook let you revoke an app's access and request data deletion from your Meta settings. InfluDM handles both:

• Deauthorisation — when you remove InfluDM from your Instagram settings, the connection is dropped on our side too.
• Data deletion request — a request initiated from Meta returns a confirmation code. You can check the status of that request against the code at any time.

You can do the same thing inside the app by disconnecting the Instagram account, or by deleting your account entirely.

Your obligations

You're responsible for what your automations say and collect:

• Ask for personal data only where you have a reason to.
• Tell people what you'll do with an email or phone number before you ask for it.
• Honour opt-outs — if someone asks you to stop, stop.
• Follow Instagram's Platform Terms and your local privacy law (GDPR, DPDP and friends) when you export leads and use them elsewhere.

InfluDM gives you the tools; the messages are yours.