Trust & Safety

Privacy, Data And Security

What DMpro stores, how your Instagram and TikTok accounts stay safe, GDPR, cookies and acceptable use.

DMpro stores specific data about you for the service to function. Here is exactly what and why.

1. Account Data

  • Email address. Your primary account identifier.
  • Name. For personalization.
  • Country. For pricing display and invoice defaults.
  • Sign-up date and source. For onboarding attribution.
  • Referral code. Auto-generated per account.

2. Onboarding Data

  • Persona (Brand, Creator, Business).
  • Platform preference (Instagram, TikTok, both).
  • Use case (creator outreach, sales, etc.).
  • Goal and experience level.
  • Persona-specific answers (business type, offer, etc.).

3. Connected Social Accounts

  • Instagram/TikTok handles (@yourbrand, etc.).
  • When connected.
  • Last used.

Never stored: your Instagram or TikTok password.

4. Prompts And Templates

  • Every prompt you’ve created. Title, content, default status.
  • Usage count and last used per prompt.

5. Generated Messages

  • Recent generated messages (last 30-90 days) for the Activity Log.
  • Older messages may be aggregated or deleted per retention policy.

6. Campaigns

  • Every campaign you’ve created. Name, platform, usernames, settings, statuses.
  • Per-username status and message.

7. Payment Data

  • Payment history (from Stripe): amount, date, plan.
  • Card last 4 digits. For your reference in billing history.
  • Never full card number, CVV, or expiration.

8. Usage And Analytics

  • Daily generation counts for your Usage view.
  • Aggregated stats for reports.
  • Campaign progress metrics.

9. Session Data

  • Active JWT tokens with 30-day expiry.
  • Login timestamps and device info for security.

10. Fingerprint Data

  • Which Instagram/TikTok handles are associated with your DMpro account. For anti-abuse.
  • Sources of association (onboarding self-report, extension detection, admin).

11. What DMpro Does NOT Store

  • Your Instagram or TikTok password. Never.
  • Full credit card details. Never (Stripe handles).
  • Your Instagram/TikTok DM history. Never.
  • Content from your Instagram/TikTok posts. Never.
  • Your browsing history outside DMpro. Never.

12. Data Retention

  • Account data: Kept as long as your account exists.
  • Generated messages: Recent history (30-90 days) then aggregated or deleted.
  • Payment records: Retained for tax and legal compliance (typically 7 years).
  • Deleted account data: Removed within 7 business days of deletion request.

Related questions:

DMpro is designed to protect your Instagram and TikTok account safety. Here is how.

1. DMpro Doesn’t Store Your Credentials

DMpro never asks for your Instagram or TikTok password. Never stores your login. The extension works by reading whichever session you’re already logged into in your browser.

2. DMpro Uses Your Browser Session

When you send a DM through DMpro:

  • The extension uses your existing Instagram/TikTok browser session.
  • Your login cookies stay in your browser.
  • No credentials leave your machine.

3. Rate Limits Protect Your Account

Safety Mode:

  • Caps at 20 DMs/day.
  • 3-6 min delays between sends.
  • Auto-pause on Instagram block signals.

Prevents your account from being flagged by Instagram/TikTok anti-spam.

4. Instagram’s Terms Of Service

DMpro operates within Instagram and TikTok’s normal use patterns. However:

  • Automated DMs at scale are technically against their TOS.
  • Instagram can block or flag accounts they suspect of automation.
  • DMpro’s Safety Mode reduces this risk but doesn’t eliminate it.

5. Best Practices To Stay Safe

  • Keep Safety Mode on.
  • Send genuine outreach (personalized, not spammy).
  • Don’t scale too fast (from 10 to 100 in a week is risky).
  • Use an established account (older is better).
  • Have real content on your profile (posts, followers).

6. What To Do If Blocked

See “Instagram Blocked Me: What To Do”.

7. Multi-Account Protection

DMpro’s fingerprint system tracks which Instagram/TikTok accounts are linked to which DMpro accounts. Prevents:

  • Users from creating fake DMpro accounts for the same social account (abuse).
  • Confusion about which social account is “yours”.

8. Privacy From Other DMpro Users

Your prompts, campaigns, and Instagram/TikTok connection are private to your DMpro account. No other DMpro user can see them.

9. Enterprise Safety Features

Enterprise Account Safety Guardrails offer:

  • Dynamic rate limits.
  • Multi-account rotation.
  • Post-send verification.

For accounts that need higher volume with lower risk.

10. Support For Safety Issues

If you have concerns about DMpro’s impact on your account safety, contact [email protected]. We can advise on best practices for your specific situation.

Related questions:

DMpro complies with GDPR, CCPA, and similar data protection laws. Here is your rights and how to exercise them.

1. Your Rights Under GDPR (EU) And CCPA (California)

  • Right to access. Request a full copy of your data.
  • Right to rectification. Correct inaccurate data.
  • Right to erasure (“right to be forgotten”). Request deletion.
  • Right to portability. Export your data in a machine-readable format.
  • Right to object. To processing of your data.
  • Right to withdraw consent. For marketing.

Applies to:

  • EU residents (GDPR).
  • California residents (CCPA).
  • UK residents (UK GDPR).

2. Requesting Your Data

Email [email protected] from your DMpro account email with:

  • Subject: “GDPR Data Request” or “CCPA Data Request”.
  • Type of request (access, rectification, erasure, portability).
  • Any specific data or accounts you’re referring to.

DMpro responds within 30 days (per GDPR requirement).

3. Requesting Deletion

If you want your account permanently deleted:

  1. Email [email protected] from your DMpro account email.
  2. Subject: “Delete My Account”.
  3. Confirm you understand deletion is irreversible.

Processed within 7 business days. See “How To Delete Your DMpro Account?”.

4. What Gets Deleted

  • User record: Removed.
  • Prompts: Deleted.
  • Campaigns: Deleted.
  • Sessions: Invalidated.
  • Fingerprint associations: Removed after retention period.
  • Payment records: Retained (tax/legal). Anonymized.

5. What Cannot Be Deleted (Retention)

  • Anonymized payment records. Required for tax and legal compliance. Retained typically 7 years.
  • Aggregated analytics. Already anonymized. Retained.
  • System logs. Anonymized. Retained per security policy.

Nothing that identifies you personally is retained after deletion (except anonymized transaction records for legal compliance).

6. Data Portability

Request an export:

  • Email support with “Export My Data” subject.
  • We provide your prompts, campaigns, and usage data in JSON or CSV format.
  • Delivered within 30 days.

7. Marketing Opt-Out

  • Turn off marketing in Notification Preferences.
  • Or click unsubscribe in a marketing email.
  • Effect: immediate.

8. Cookies And Tracking

See “Cookies And Tracking” for details.

9. Third-Party Data Sharing

DMpro does NOT sell your data. DMpro shares data with:

  • Stripe for payment processing (only what’s needed).
  • Postal for email delivery.
  • Other brandID products if you explicitly connected them.

No brokers, no advertising networks.

10. Contact For GDPR/CCPA Questions

Email [email protected]. For urgent matters, use the Chatgram support widget.

Related questions:

DMpro uses cookies for essential functionality and minimal analytics. Here is what and why.

1. Cookies DMpro Uses

  • JWT session cookie. Your login token. Required.
  • Preferences cookie. UI preferences (side panel state, etc.).
  • Analytics cookies. Aggregated, anonymized (see below).

2. Cookies DMpro Does NOT Use

  • Advertising cookies. DMpro is ad-free.
  • Third-party marketing cookies. No Google Ads, no Facebook Pixel.
  • Cross-site tracking. DMpro doesn’t follow you around the web.

3. Analytics DMpro Uses

  • Google Analytics (or similar) for aggregated usage stats.
  • Anonymized IP.
  • No personal identifiers sent to analytics.

4. Third-Party Cookies

  • Stripe. For payment processing. Required when you’re on Stripe Checkout.
  • Chatgram. For support widget.

Each has its own privacy policy.

5. Cookie Consent (EU/UK Users)

Per GDPR, EU/UK users see a cookie consent banner on first visit. You can:

  • Accept all cookies.
  • Only essential cookies. (JWT + preferences.)
  • Customize (per-category toggle).

6. Managing Cookies In Your Browser

Chrome/Brave/Edge:

  • Settings → Privacy → Cookies.
  • Clear or block for specific sites.

7. Do Not Track

DMpro respects Do Not Track headers if your browser sends them. Non-essential cookies (analytics) are disabled.

8. Session Storage Vs Cookies

DMpro uses:

  • localStorage for the JWT token (dashboard).
  • Chrome extension storage for extension-specific data.
  • Cookies for cross-page state on the dashboard.

localStorage and extension storage are same-origin scoped so other sites can’t access them.

9. Deleting Cookies Signs You Out

Deleting DMpro cookies clears your session. Sign in again with the magic code flow.

10. Full Cookie Policy

The full cookie policy is at dmpro.brandid.app/privacy#cookies.

Related questions:

Instagram (and TikTok) have Terms of Service that govern how you use their platforms. Here is where DMpro stands.

1. What The TOS Says About Automation

Instagram and TikTok generally prohibit:

  • Automated posting or DMing.
  • Fake accounts.
  • Buying or selling likes/follows.
  • Scraping data at scale.
  • Using unauthorized API access.

2. Where DMpro Stands

DMpro’s approach:

  • Uses your real, logged-in browser session. Not fake accounts.
  • Sends from your real account. Not spoofed.
  • Personalizes each message with AI. Not identical spam blasts.
  • Enforces conservative rate limits (Safety Mode). To stay under anti-spam thresholds.

However, Instagram/TikTok can still consider DMpro’s use technically against TOS since it’s automation.

3. Why This Isn’t As Big A Deal As It Sounds

  • Instagram doesn’t actively hunt individual users at DMpro’s Safety Mode volumes. They target obvious spammers.
  • Personalized DMs are treated more leniently than repetitive spam blasts.
  • Millions of small users use similar tools. DMpro isn’t uniquely at risk.
  • DMpro doesn’t stand out from a manual user as much as some automation tools do.

4. What Could Trigger A Block

  • Sending 100+ DMs/day (way above Safety Mode’s 20).
  • Sending identical messages to many recipients.
  • Sending from a very new account.
  • Sending to profiles that report you.

Following Safety Mode dramatically reduces block risk.

5. Legal Vs Terms Violation

  • Legal: DMpro’s usage isn’t illegal in most jurisdictions.
  • TOS violation: Technically, yes. Enforcement is at Instagram/TikTok’s discretion.

The tradeoff: better efficiency vs slight TOS risk. Most DMpro users decide the tradeoff is worth it.

6. What Happens If Instagram Cracks Down

  • If Instagram blocks you, your DMpro subscription is unaffected. You just can’t send until the block clears.
  • If Instagram changes their API and breaks DMpro’s automation, we update the extension.
  • DMpro monitors industry developments closely.

7. TikTok Compared

TikTok is generally more lenient than Instagram for legitimate outreach. Same principles apply but with less risk.

8. Alternatives If You’re Uncomfortable

  • Manual sending. DMpro can generate messages you copy-paste manually. Removes automation concern.
  • Lower volume. Send 5-10/day manually. Below anti-spam radar.
  • Different platform. LinkedIn Sales Navigator, cold email, etc.

9. DMpro’s Ongoing Commitment

  • We keep the extension updated for platform changes.
  • We add safety features (Safety Mode, Enterprise Guardrails) proactively.
  • We advise users conservatively.

10. Legal Risks To You

For your own outreach:

  • CAN-SPAM (US): Requires opt-in for marketing DMs. Personal outreach is generally exempt.
  • GDPR (EU): Personal outreach to businesses often exempt if legitimate interest is claimed.
  • CASL (Canada): Similar to CAN-SPAM.

Consult a lawyer for specifics.

Related questions:

DMpro’s full Terms of Service are at dmpro.brandid.app/terms. This article summarizes the acceptable use rules that most affect day-to-day use.

1. Acceptable Uses

DMpro is designed for legitimate outreach:

  • Sales prospecting.
  • Creator collab pitches.
  • Brand influencer marketing.
  • Recruiting.
  • Partnership outreach.
  • Community engagement.

2. Prohibited Uses

Not allowed:

  • Spam. Sending irrelevant, unsolicited mass messages to random recipients.
  • Harassment. Messages designed to intimidate, threaten, or harm.
  • Sexual content or minors. DMs involving inappropriate content.
  • Impersonation. Pretending to be someone you’re not.
  • Illegal activity. Anything violating laws.
  • Circumventing Instagram/TikTok blocks. Bypassing bans, etc.
  • Multi-account abuse. Creating fake DMpro accounts to farm free credits.

3. Content Moderation

DMpro’s AI monitors for prohibited content categories. Flagged messages may:

  • Pause your generation.
  • Trigger a review.
  • Result in temporary account suspension.

4. Complaints About Your Outreach

If Instagram/TikTok users complain about your DMs to us:

  • We investigate.
  • Legitimate complaints result in warnings or suspension.
  • Frivolous complaints don’t affect you.

5. Consequences For Violations

  • First violation: Warning email.
  • Second violation: Temporary suspension (7-30 days).
  • Severe or repeated: Permanent account termination.
  • Illegal content: Immediate termination + potential legal action.

6. Age Restrictions

  • Must be 16+ (or 18+ in some jurisdictions).
  • Under-18 accounts suspended when detected.
  • Business accounts must be created by authorized representatives.

7. Account Sharing

  • One person per account (except Enterprise team plans).
  • Sharing credentials violates terms.
  • Enterprise plans support up to 10 team members.

8. Data You Send

  • You are responsible for the legality and accuracy of what you send.
  • DMpro facilitates delivery but is not the sender of record.
  • Comply with laws in your jurisdiction and recipients’.

9. Refund Rights

  • 30-day money-back guarantee for unused one-time credit packages.
  • 7-day money-back guarantee for annual plans.
  • 3-day full refund for monthly subscriptions; no refund after that window.

10. Changes To Terms

  • We may update terms periodically.
  • Material changes: 30-day email notice.
  • Continued use = acceptance.

11. Governing Law

  • DMpro operates from Toronto, Canada.
  • Disputes governed by Ontario law.
  • Enterprise contracts may specify different governing law.

12. Full Terms

The summary above isn’t comprehensive. For complete details:

  • Read dmpro.brandid.app/terms.
  • Consult a lawyer for specific interpretation.
  • Contact support for clarification.

Related questions:

DMpro is intentional about what data we do and don’t collect. Here is an explicit list of things DMpro NEVER stores.

1. Your Instagram Or TikTok Password

DMpro doesn’t have a login flow that asks for your Instagram/TikTok password. Never asked, never stored.

2. Full Credit Card Details

  • Card number: Never touches DMpro’s servers.
  • CVV: Never seen.
  • Full expiration date: Only stored by Stripe.

DMpro has: last 4 digits only, for your reference.

3. Your Bank Account Information

  • Bank routing/account numbers: Never asked.
  • Debit card PIN: Never asked.

Payment goes through Stripe. DMpro only sees payment confirmations.

4. Your Instagram/TikTok DM History

  • Past DMs you sent: Not read.
  • DMs from other people: Not read.
  • Group chat content: Not read.

DMpro’s extension only sends messages you generate through DMpro. It doesn’t peek at your existing conversations.

5. Your Post Content

  • Post captions: Not read.
  • Comment history: Not read.
  • Story views: Not tracked.

Only profile bio and header data is used (for AI prompt context).

6. Your Followers/Following List

  • Who you follow: Not read.
  • Who follows you: Not read.

Only aggregate counts.

7. Your Location

  • GPS coordinates: Not asked.
  • Precise location: Not tracked.
  • IP geolocation: Approximate country only, for pricing/tax.

8. Your Contacts List

  • Phone contacts: Not asked or synced.
  • Email address book: Not read.

9. Your Browsing History

  • Other websites you visit: Not tracked.
  • Search history: Not seen.
  • Google search: Not seen.

DMpro only knows about profile pages you deliberately visit while the extension is active.

10. Your Other Social Media

  • Facebook, Twitter, LinkedIn, Snapchat, etc.: Not accessed.
  • DMpro only touches Instagram and TikTok.

11. Data From Third Parties

  • We don’t buy data from brokers.
  • We don’t scrape public data at scale for our own use.
  • What you provide is what we have.

12. Sensitive Personal Info

  • SSN/national ID: Never asked.
  • Health info: Never asked.
  • Financial account balances: Never asked.
  • Political affiliations: Not tracked.

13. Voice Or Video Data

DMpro doesn’t do audio or video features. Nothing recorded.

14. Cookies From Other Sites

DMpro’s cookies are same-origin scoped. We don’t read cookies from other sites.

15. Bulk Metadata

  • Screen time on Instagram: Not tracked.
  • Clickstream: Not tracked in detail.

Related questions:

Related articles

Still stuck? We’re happy to help.

Create your account, or reach out to support.

Create Free Account Contact Support
Back to Help Center