Privacy Policy

1. Who we are

DMisland ("the Service", "we") is a comment-to-DM automation service for Instagram professional accounts, available at https://dmisland.com.

2. Information we collect

• Account information: your email address, and basic profile information (name, email address) if you sign in with Google.
• Instagram connection data: your Instagram account ID, username, and an API access token. Access tokens are stored encrypted (AES-256-GCM) and are never exposed to the browser.
• Automation activity: comment IDs, comment text, commenter usernames, and DM delivery results, kept so you can review what the Service sent on your behalf.
• Sign-in records: The time you signed in, the IP address used, and your device and browser type. Used only for account security (detecting unauthorized access) and support. Kept for 90 days, then deleted.
• App activity: The dates you used the Service while signed in, with the approximate location (country and city), device, and browser type of your first visit that day. One record per day, used for support and service operations. Kept for 90 days, then deleted.
• Website visit data: Pages visited, the referring site, approximate location (country and city estimated from your IP address), and device and browser type. We never store your IP address itself; visits are counted only with an anonymous identifier that changes every day. Kept for 400 days, then deleted.
• Payment information: Payments are processed by Lemon Squeezy. We do not store card details; we keep only payment identifiers and payment status.
• Inquiries: the content of feedback you send us through the app.
• Email delivery records: the recipient address, email type and delivery result of service emails and newsletters we send. Used only to confirm delivery and handle support requests, and deleted after 180 days.
• Partnership applications: if you apply for a partnership on our contact page, your name (or brand), email, Instagram account, follower count and message are used only to review and reply to your request, and deleted 30 days after you apply.

3. How we use information

We use the collected data only for: (1) running the automations you configure - detecting comments, sending DMs, and showing delivery logs; (2) responding to support requests and fixing issues - in which case only authorized staff view the relevant account's records; (3) anonymous visit statistics to improve the service; and (4) sending launch news and offers to users who opted in to product emails. We do not sell your data or use it for advertising.

4. Processors and international transfers

We do not provide your personal data to third parties. To operate the Service we use the processors below; for those located outside Korea, personal data is transferred over the network when you use the Service. Data is kept until you delete your account or the processing agreement ends. You can refuse the international transfer by deleting your account, in which case you will no longer be able to use the Service.

5. Data retention and deletion

You can delete your data at any time, in any of these ways:

• In the app: use "Delete account" in Settings to remove your account and all associated data.
• From Instagram: removing the DMisland app in your Instagram settings stops all automation immediately and invalidates our access token. Requesting data deletion from Instagram triggers our deletion callback - we delete your Instagram connection data and issue a confirmation code you can check at dmisland.com/deletion-status.
• By email: contact us at the address below and we will delete your data without undue delay.

Data is kept while your account exists and is deleted along with your account. However, the records below are kept separately for the period required by law, then deleted without delay in a way that cannot be recovered.

Message delivery logs (which comment triggered which message, and whether it was sent) are kept for up to 180 days and then deleted automatically; the app shows the most recent period allowed by your plan. For each rule we also keep a minimal record of which Instagram users have already received a message (Instagram user ID only) for as long as that rule exists, so the same person is never messaged twice by the same rule. For referral rewards, we keep only an irreversibly transformed value of the rewarded Instagram account ID for 1 year from the reward (including after account deletion) so the same Instagram account can't claim the reward again, and then delete it automatically. When you delete your account, your newsletter delivery records are deleted immediately, and the record of the account-deletion confirmation email is deleted after 7 days once delivery is confirmed. The email addresses of users who withdraw newsletter consent or delete their account are kept for up to 30 days only to remove them from our email provider's recipient list, and then deleted.

6. Your rights

You may request access to, correction, deletion, or suspension of processing of your personal data at any time, either in Settings or by emailing support@dmisland.com. We will act on your request without undue delay.

7. Cookies

We use cookies only to keep you signed in and to remember your language. You can block cookies in your browser settings, but you will not be able to use features that require signing in.

8. Security

All traffic is served over HTTPS. Instagram access tokens are encrypted at rest, database access is protected by row-level security, and webhook requests are verified with cryptographic signatures.

9. Data protection officer and contact

Data Protection Officer: Seunghyeon Baek. For any privacy question or request, contact us at: support@dmisland.com

10. Remedies

For advice on privacy infringement, you may contact the Korean Personal Information Dispute Mediation Committee (+82 1833-6972, www.kopico.go.kr).

11. Changes to this policy

We may update this policy as the Service evolves. Material changes will be announced on this page with a new effective date.