Skip to content
PookieDMJoin the waitlist

Privacy Policy

Last updated:

This policy explains how POOKIEDM ("PookieDM", "we", "us") collects, uses, shares and protects personal data when you use the PookieDM website, waitlist and Instagram automation service (together, the "Service").

We handle personal data in line with India's Digital Personal Data Protection Act, 2023 and its rules, the Information Technology Act, 2000, and Meta's Platform Terms and Developer Policies.

1. Who we are

PookieDM is operated by POOKIEDM, a Sole proprietorship with its registered address at Room No. 2, Rajdeo Singh Chawl, Parshiwadi, LBS Marg, Mumbai, Maharashtra 400086. For any privacy question, email privacy@pookiedm.com.

2. Personal data we collect

2.1 Data you give us

  • Waitlist: your email address and, if you choose to share them, your name, Instagram username, the kind of account you run and your follower range.
  • Login: you log in with Instagram's official login. There is no separate PookieDM account or password, and we never see or store your Instagram password.
  • Billing: your plan, payment status and invoices. Payments are processed by our payment partner, Razorpay. We never see or store your full card number, UPI PIN or net banking password.
  • Support: messages you send us and details you share to get help.

2.2 Data from Instagram when you connect your account

When you connect an Instagram professional account through Instagram's official login, and only with the permissions you approve, we receive:

  • Your Instagram professional account ID, the app-specific ID Instagram gives PookieDM, your username, your account type and the permissions you approved.
  • An access token that lets the Service act for your account, and when it expires. We encrypt the token before storing it.
  • For each post or Reel you pick for a comment automation: its ID, the first part of its caption and its link. When you pick a post we show your recent posts from Instagram, but we don't store the ones you don't pick.
  • Notifications from Instagram about new comments on your posts and messages sent to your account. We use the text only to check it for your keywords, then discard it. We never store the text of messages or comments.

2.3 Data about people who interact with your account

To run your automations we process limited data about people who comment on your posts, reply to your stories or message your account ("your audience"):

  • Their Instagram-scoped ID (an ID Instagram creates only for your account). For a DM reply we keep it only until we've finished sending the reply. We also keep a coded (hashed) version for up to 30 days, so the same person doesn't get the same automated reply again too soon.
  • The text of their comment or message, which we use only to check for your keywords and never store.
  • The ID of the comment or message and when it was sent, so we reply only once and only within the time Instagram allows.

We process your audience's data on your behalf and only to provide the Service to you. If you collect details from your audience, such as email addresses, you are responsible for telling them how you will use those details.

2.4 Data collected automatically

  • Device and log data: IP address, browser type, pages viewed and the time of your visit. We use this to keep the Service secure and working.
  • Cookies: we use only essential cookies: a session cookie that keeps you logged in for up to 30 days, and a security cookie that protects the Instagram login step and expires after 10 minutes. We don't use advertising cookies. If we add analytics, we will update this policy and ask for your consent where the law requires it.

3. How we use personal data

  • To provide the Service: send the replies and messages you set up, show results in your dashboard and keep your automations running.
  • To manage your account and subscription, including reminders before auto-debits.
  • To email you about early access, product updates and service notices. You can unsubscribe from marketing emails at any time.
  • To answer support requests.
  • To keep the Service safe by preventing spam, abuse, fraud and security incidents, and to enforce our Terms of Service.
  • To improve the Service using aggregated or de-identified usage information.
  • To meet legal obligations, such as tax and accounting rules.

What we never do:

  • We don't sell personal data.
  • We don't use Instagram data for advertising, to build profiles of your audience, or for anything other than the features you turn on.
  • We don't message anyone who hasn't interacted with your account first.
  • We don't ask for or store your Instagram password.

4. AI features

If you turn on AI replies, the relevant message text and the knowledge you add (such as your FAQs) are sent to our AI provider to draft or send a reply. We send only what the reply needs, and we use providers and settings under which this data is not used to train their models.

5. Why we are allowed to process your data

We process personal data with your consent, for example when you join the waitlist or connect Instagram, or for legitimate uses permitted under the Digital Personal Data Protection Act, such as when you give us data for a specific purpose or when the law requires it. You can withdraw your consent at any time. This doesn't affect processing that happened before, but we may not be able to provide the Service without certain data.

6. Who we share data with

  • Meta: to deliver your replies and messages through the Instagram API, on your instructions.
  • Service providers that help us run PookieDM, under contracts that limit how they can use the data: cloud hosting and database storage, email delivery, payment processing (Razorpay), error monitoring and, if you use AI replies, an AI provider.
  • Authorities, when the law requires it or to protect the rights, safety and security of our users and the Service.
  • A buyer or successor, if our business is merged or sold. They must keep protecting your data under this policy.

7. Where your data is stored

We store data with our cloud hosting and database providers, which may store or process it outside India. When that happens, we use providers with strong security commitments and transfer data only as Indian law permits.

8. How long we keep data

  • Instagram connection, settings and automations: while your Instagram account stays connected. When you disconnect in your dashboard, or remove PookieDM in your Instagram settings, we delete them immediately. Email requests are handled within 30 days.
  • Activity records (which automation ran, when, and whether the reply was sent): 30 days, then deleted automatically. The text of messages and comments is never stored.
  • Login sessions: up to 30 days, or until you log out.
  • Deletion confirmation codes: 90 days. They contain no personal data.
  • Waitlist data: until 12 months after launch, or sooner if you unsubscribe or ask us to delete it.
  • Billing records: for as long as Indian tax and accounting laws require.

9. How we protect data

  • We use HTTPS for all traffic.
  • Instagram access tokens are encrypted with AES-256-GCM before they are stored, and are never sent to your browser.
  • Your session cookie is a random value. We store only a hash of it, so a copy of our database can't be used to log in as you.
  • Each connected Instagram account's settings, automations and activity are kept separate, and only someone logged in with that account can see or change them.
  • We accept notifications about comments and messages only when Meta's signature on them is valid.
  • We limit access to production systems to people who need it.

No system is completely secure. If a personal data breach happens, we will inform affected users and the Data Protection Board of India as the law requires.

10. Your rights

Under the Digital Personal Data Protection Act, you can:

  • Ask for a summary of the personal data we process about you and how we use it.
  • Ask us to correct, complete or update your data.
  • Ask us to erase your data, unless the law requires us to keep it.
  • Withdraw your consent at any time.
  • Nominate another person to exercise your rights if you die or become unable to do so.
  • Raise a grievance with us and, if it isn't resolved, with the Data Protection Board of India.

To use these rights, email privacy@pookiedm.com. For a connected Instagram account, include its username, and we will check that the request comes from the account owner before acting on it. We reply within 30 days. If you are part of a creator's audience, you can contact that creator or business, or write to us and we will help.

11. Deleting your data

You can disconnect Instagram and delete your data yourself at any time from the Account page in your dashboard. See our Data Deletion Instructions for the other ways to delete your data.

12. Children

The Service is meant for people aged 18 and over. We don't knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We will post any changes on this page and update the date at the top. If a change is significant, we will also tell you by email or in the app.

14. Contact and Grievance Officer