Privacy Policy
Last updated: 12 September 2026
Poply DM is an Instagram automation service operated by Burhan Ahmad (“we”, “us”). It lets a business or creator reply automatically to comments on their own Instagram posts, using Meta’s official Instagram API. This policy explains what we collect, why, how long we keep it, and how to have it deleted.
Questions, access requests and deletion requests: burhanahmad3530a@gmail.com. We aim to respond within 30 days.
Who this policy covers
Account holders. People who create a Poply DM account and connect their own Instagram professional account.
People who interact with them on Instagram. If you comment on a post or send a direct message to a connected account, limited information about that interaction is processed so the account holder’s automation can reply to you.
What we collect
From account holders: email address and a password, both handled by our authentication provider. We never see your password in readable form.
From the connected Instagram account, with your authorisation: the Instagram account identifier, username, profile picture URL, the access token Meta issues, its expiry date, and the permissions granted. We also cache metadata for your recent posts and reels: identifier, caption, media type, permalink, thumbnail URL and publish date.
From people who interact: the comment identifier, the post it was left on, the commenter’s Instagram-scoped user identifier, their Instagram username, and the text of the comment. If someone replies to an automated message, the content of that conversation is stored so the account holder can read and answer it.
From operating the service: records of what was attempted and what happened, such as whether a keyword matched and whether a message was delivered, failed or was skipped.
What we never collect
We never ask for or store Instagram passwords. We do not scrape Instagram, use unofficial or private APIs, or automate a browser. We do not buy data, infer or harvest email addresses or phone numbers, and we do not collect anything about people who have not interacted with a connected account. We do not sell or rent personal information to anyone, and we do not use it for advertising or profiling.
Why we process it, and on what basis
We process this information to perform the service the account holder asked for: to recognise a comment, decide whether it matches an automation they configured, send the reply they wrote, and show them what happened. For account holders, the basis is performance of our agreement with them. For people who interact, the basis is our legitimate interest in delivering a reply that the interaction itself invited, balanced against the minimal data involved and the ability to opt out at any time.
Messaging rules we follow
We only send a message to someone who has interacted first. A single private reply may follow a comment. Anything after that requires the person to write back, and is only possible during the 24-hour window Meta allows after their most recent message. There is no bulk messaging, no contact importing, and no way to message someone who has not contacted the account.
Replying STOP or UNSUBSCRIBE to a connected account stops all further automated messages to you from that account immediately, including any sequence already in progress.
How it is stored and protected
Data is stored in a managed PostgreSQL database hosted by Supabase in Singapore, and served from our application server. Instagram access tokens are encrypted with AES-256-GCM before being written, and are never sent to a browser. Each customer workspace is isolated at the database level, and access is restricted by row-level security so one workspace cannot read another’s data. All traffic uses HTTPS.
Who else is involved
Meta Platforms provides the Instagram API this service is built on, and is the source of the interaction data we receive.
Supabase provides the database and authentication.
Our hosting provider runs the application server.
If an account holder turns on optional AI replies, the text of the conversation being answered is sent to the AI provider they chose and configured with their own key, solely to generate that reply. If paid plans are enabled, Stripe processes the payment; we never see or store card details. Both features are off unless an account holder deliberately enables them.
How long we keep it
Comment text, message content and activity records are kept for the retention period the account holder chooses, between 7 and 90 days, and default to 30 days. After that they are automatically erased.
Two things are deliberately kept longer, until the connected account or the workspace is deleted: a minimal record that a particular comment was already answered, so you are never messaged twice for the same thing, and a record that someone opted out, so we never message them again. Neither contains message content.
Your choices and rights
If you interact with a connected account: reply STOP to that account to opt out of all automated messages. To ask what is held about you or to have it deleted, email burhanahmad3530a@gmail.com with the Instagram username you used.
If you are an account holder: you can pause every automation at once, disconnect an Instagram account, which deletes its token and associated records, change the retention period, or delete your account and the workspaces you own. See the data deletion instructions.
You may also revoke our access directly in Instagram, under Settings, Apps and websites. Doing so stops all processing for that account.
Wherever you live, you may ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. If you are in a region with additional statutory rights, such as the European Economic Area or the United Kingdom, we will honour requests under those rules.
International transfers
We operate from Pakistan, and data is stored in Singapore. If you interact with a connected account from elsewhere, your information will be processed in those locations.
Children
This service is for businesses and creators and is not directed at children. We do not knowingly collect information from anyone under 13. If you believe a child’s information has reached us, email us and we will delete it.
Security incidents
If a breach affects personal information we hold, we will investigate, contain it, and notify affected account holders and the relevant authority where the law requires it.
Changes
If this policy changes materially, we will update the date at the top and notify account holders before the change takes effect. Continued use after that date means you accept the updated policy.
Contact
Burhan Ahmad
Email: burhanahmad3530a@gmail.com
Operating from Pakistan.
This policy is governed by the laws of Pakistan, without limiting any rights you have under the law of your own country.