Data & Privacy

What InfluDM stores, how long it keeps it, and how it can be removed.

What's stored

Data	Where it comes from
Your account — email, name	Your sign-in provider (Google, Facebook, or email sign-up).
Instagram account — user id, username, name, picture, access tokens	Instagram, at connect time.
Flows and lead forms	What you author in the app.
Contacts — Instagram user id, username, name, picture, follow relationship	The people who interact with your flows.
Executions — the triggering comment or message, and the conversation's state	Instagram webhooks.
Leads — the answers people give your lead forms	The people themselves.
Billing — plan, payments, invoice details	Your purchases.

Access tokens

Instagram issues a long-lived token that lasts 60 days and is refreshed in the background. Disconnecting an account removes it. Tokens are used only to receive webhooks and to send the messages your flows define.

What InfluDM never does

• Message people who haven't interacted with you.
• Send bulk or broadcast DMs to your contact list.
• Follow, unfollow or like on your behalf.
• Scrape follower lists.
• Share your contacts or leads with other workspaces.

See Instagram's Messaging Rules.

Follow relationship data

The follow relationship on a contact is only ever fetched when Instagram allows it — that is, after the person has messaged your account. Contacts who only commented are recorded as Unknown, never inferred. See Contacts.

Data lifetime

Action	Effect
Delete a flow	Its executions go. Leads captured by it are kept.
Delete a lead form	Refused while a flow still uses it. Leads captured by it are kept.
Disconnect an Instagram account	Its flows and contacts are deleted. Leads are kept. Contact allowance is not restored.
Remove a team member	Their access ends. Nothing they created is deleted.
Delete your account (owner)	The whole workspace is wiped — including every lead. Irreversible.
Delete your account (member/admin)	Only that seat. The workspace continues.

Leads are deliberately the most durable thing in the product: each submission snapshots the contact's identity, the flow name, the form name and every question and answer, so it survives the deletion of everything that produced it. Only deleting the workspace destroys leads.

Removing your data via Meta

Instagram and Facebook let you revoke an app's access and request data deletion from your Meta settings. InfluDM handles both:

• Deauthorisation — when you remove InfluDM from your Instagram settings, the connection is dropped on our side too.
• Data deletion request — a request initiated from Meta returns a confirmation code. You can check the status of that request against the code at any time.

You can do the same thing inside the app by disconnecting the Instagram account, or by deleting your account entirely.

Your obligations

You're responsible for what your automations say and collect:

• Ask for personal data only where you have a reason to.
• Tell people what you'll do with an email or phone number before you ask for it.
• Honour opt-outs — if someone asks you to stop, stop.
• Follow Instagram's Platform Terms and your local privacy law (GDPR, DPDP and friends) when you export leads and use them elsewhere.

InfluDM gives you the tools; the messages are yours.