Privacy Policy

Information we collect

We collect information in three broad categories: account data you provide when signing up, data from connected social platforms (with your authorization), and technical data needed to run the service.

• Account data: email address and password (managed through Supabase Auth), organization and team membership, brand/account names, and optional organization logos you upload.
• Platform connection data: OAuth access tokens, refresh tokens (where the platform provides them), token expiry, granted scopes, and basic channel profile fields (username, display name, avatar, channel IDs, and platform-specific metadata needed to call each API).
• Content you create in DM IQ: post captions, scheduled post payloads, media files you upload for publishing, automation rules, and lead-capture form configurations.
• Interaction data from Instagram webhooks: comment text, direct message text, story-reply text, sender identifiers, media IDs, and button postback events — only for Instagram accounts you connect and only to run automations you configure.
• Contact records: Instagram-scoped user IDs, usernames, names, emails, phone numbers, and other answers collected through your lead-capture forms, plus interaction counts (comments and DMs).
• Analytics summaries: aggregated metrics we fetch from platform APIs (for example reach, views, impressions, subscriber counts) to display in your dashboard.
• Technical data: server logs, error messages, and request metadata needed to operate, secure, and debug the service.

Instagram / Meta

When you connect an Instagram business or creator account, you authorize DM IQ through Meta's Instagram API with Instagram Login. We request the following permissions: instagram_business_basic, instagram_business_manage_messages, instagram_business_manage_comments, instagram_business_content_publish, and instagram_business_manage_insights.

We use this access only to provide features you enable in DM IQ. We do not sell Instagram data.

• Messages: we receive and process direct messages and story replies via Meta webhooks to run your automations (for example auto-replies and lead-capture flows). Message text and sender IDs are stored in our database to process events and maintain contact records.
• Comments and mentions: we receive comment and mention notifications, including comment text, commenter identifiers, and associated media IDs. We may post public replies and send private follow-up DMs on your behalf according to your automation settings.
• Content publishing: when you publish or schedule posts, we upload media you provide to our storage and use the Instagram Content Publishing API to create and publish containers on your connected account.
• Insights and profile: we read profile information (username, name, profile picture, follower counts) and insights metrics (such as reach and account totals) to show analytics in your dashboard.
• OAuth tokens: long-lived access tokens are stored server-side in our database, associated with your connected channel, and refreshed as needed. Tokens are never exposed to other users in your organization or to the browser.
• Retention: Instagram interaction data, automation event logs, and contact records are kept while your account and connected channel remain active. You can disconnect Instagram at any time from the Channels page, which stops new data collection. You may request deletion of stored data by contacting us.

Google / YouTube

When you connect a YouTube channel, you authorize DM IQ through Google OAuth. We request openid, email, profile, youtube.upload, youtube.readonly, and yt-analytics.readonly scopes.

DM IQ's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Channel data: we read your channel title, custom URL, thumbnails, banner image, channel ID, and public statistics (subscriber count, view count, video count) to identify your connected channel and display profile information in the app.
• Video publishing: when you schedule or publish a video, we upload the video file and metadata you provide (title, description, tags, privacy status, made-for-kids setting, and optional custom thumbnail) to YouTube on your behalf using the YouTube Data API resumable upload flow.
• Analytics: we read YouTube Analytics and Data API metrics (such as daily views) to display performance summaries in your dashboard. We cache these results briefly to reduce API usage.
• Limited Use: YouTube API data is used solely to provide user-facing features you request — scheduling, publishing, and analytics within DM IQ. We do not use YouTube API data to serve advertisements, and we do not sell YouTube API data to third parties. We do not use it for creditworthiness or lending purposes. We may share it only with our infrastructure providers as necessary to operate the service (for example secure database and hosting), or when required by law.
• OAuth tokens: Google access and refresh tokens are stored server-side and refreshed automatically. Tokens are used only to call Google/YouTube APIs on your behalf.
• Revoking access: you can disconnect YouTube in DM IQ or revoke DM IQ's access at https://myaccount.google.com/permissions.

LinkedIn

When you connect a LinkedIn account, you authorize DM IQ through LinkedIn OAuth (OpenID Connect). We request openid, profile, email, and w_member_social scopes.

• Profile data at connection: we receive your LinkedIn member ID (sub), name, profile picture, and email address to identify your connected account and associate it with your DM IQ organization.
• Publishing: when you schedule or publish a post, we create posts on your behalf via the LinkedIn Posts API using the commentary and media you provide. Media files are downloaded from our storage and uploaded to LinkedIn as part of publishing.
• Analytics: we read member post analytics (impressions, reactions, comments, and reshares) through the LinkedIn memberCreatorPostAnalytics API to display dashboard metrics.
• Storage: OAuth tokens and your LinkedIn member identifier are stored server-side in our database. We do not sell LinkedIn member data.
• Retention: data is retained while your LinkedIn channel remains connected and your DM IQ account is active. Disconnecting LinkedIn stops new API access.

TikTok

When you connect a TikTok account, you authorize DM IQ through TikTok Login Kit. We request the user.info.basic scope.

• Profile data at connection: we receive your TikTok open ID, union ID (if provided), display name, username, and avatar URL to identify your connected account within DM IQ.
• OAuth tokens: access and refresh tokens are stored server-side in our database and used to maintain your connection.
• We do not sell TikTok user data. At this time, DM IQ stores your TikTok connection and profile identifiers; TikTok content publishing through our publish worker is not yet enabled. If you schedule TikTok targets in the composer, that content is stored as part of your scheduled post record but is not published to TikTok until publishing support is available.
• Retention: TikTok connection data is kept while your channel remains connected. Disconnecting removes our ability to access TikTok on your behalf.

How we use information

We use collected information to operate DM IQ and provide the features you configure:

• Authenticate you and manage your organization, teams, and brand accounts.
• Connect and maintain social channel integrations you authorize.
• Run Instagram automations, including public comment replies, direct messages, and lead-capture forms.
• Publish and schedule content to Instagram, YouTube, and LinkedIn on your behalf.
• Display analytics dashboards for connected channels.
• Generate optional AI-assisted captions when you use that feature (your prompt text may be sent to configured AI providers such as Groq or Google Gemini).
• Maintain security, prevent abuse, troubleshoot errors, and comply with legal obligations.

Storage, security, and processors

DM IQ is hosted on cloud infrastructure. Application data — including OAuth tokens, contacts, automations, scheduled posts, and uploaded media — is stored in Supabase (PostgreSQL database and object storage). Our publish worker runs on Render and accesses channel credentials server-side only.

OAuth tokens and refresh tokens are stored in database tables that are not directly accessible from client applications; access is restricted to server-side code and security-definer database functions.

Media you upload for publishing is stored in our Supabase storage bucket and served via public URLs required by platform publishing APIs.

We use industry-standard HTTPS for data in transit. No method of storage is 100% secure; we work to protect your data but cannot guarantee absolute security.

When we share information

We do not sell personal information or platform API data. We share information only in these circumstances:

• With platform APIs (Meta/Instagram, Google/YouTube, LinkedIn, TikTok) as necessary to perform actions you request — publishing, messaging, or reading analytics.
• With infrastructure providers that host and process data on our behalf (for example Supabase and Render), under contractual obligations to protect data.
• With AI providers (Groq, Google Gemini) only when you use AI caption features, limited to the text you submit for generation.
• When required by law, regulation, legal process, or to protect the rights, safety, and security of DM IQ, our users, or others.
• In connection with a merger, acquisition, or sale of assets, with notice to affected users where required by law.

Data retention

We retain information for as long as needed to provide the service and fulfill the purposes described in this policy.

• Account and organization data: retained while your account is active.
• Connected channel tokens and metadata: retained until you disconnect the channel or delete your account.
• Instagram contacts, automation events, and form responses: retained while your account is active unless you request deletion.
• Scheduled posts and publish job records: retained for operational history and troubleshooting; you can cancel scheduled posts before they publish.
• Server logs: retained for a limited period for security and debugging, then rotated or deleted.
• After account deletion or a verified deletion request, we delete or anonymize personal data within a reasonable timeframe, except where retention is required by law or legitimate business needs (for example fraud prevention or billing records).

Your choices and rights

Depending on your location, you may have rights to access, correct, delete, or export personal data, or to object to or restrict certain processing. To exercise these rights, contact us at hello@dmiq.site.

• Disconnect channels: remove a platform connection from the Channels page in DM IQ at any time.
• Revoke platform authorization: you can also revoke DM IQ in each platform's own settings (for example Google Account permissions or Meta Business integrations).
• Delete account: contact us to request account deletion — see Data deletion below.
• Marketing site analytics: our public website may use Google Tag Manager. You can control cookies through your browser settings.

Data deletion

You can request deletion of your DM IQ account data, connected channel data, contacts, automations, or other information we hold about you. Email us at hello@dmiq.site with the subject line "Data deletion request" and include the following so we can verify your identity and locate your records:

• Your full name
• The email address you use to sign in to DM IQ
• The channel(s) involved — for example Instagram, YouTube, LinkedIn, or TikTok (include the @username or channel name if you know it)
• A brief reason for your deletion request (optional, but helps us process it correctly — for example "closing my business", "disconnecting Instagram only", or "delete my entire account")
• Whether you want your full DM IQ account deleted or only data tied to a specific connected channel

Once we receive your request, we will reply with the steps needed to complete deletion — including disconnecting channels in DM IQ, revoking platform authorizations where relevant, and confirming what will be removed from our systems.

We aim to respond within a reasonable timeframe and will guide you through everything required. Some data may be retained where the law requires it or for legitimate purposes such as fraud prevention, but we will explain any exceptions in our reply.

Children's privacy

DM IQ is a business tool intended for users 18 years of age or older. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will take steps to delete it.

International users

DM IQ is operated from the United States. If you access the service from outside the U.S., your information may be transferred to, stored in, and processed in the U.S. and other countries where our service providers operate, which may have different data protection laws than your jurisdiction.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be communicated through the application or by email where appropriate. Continued use of DM IQ after changes take effect constitutes acceptance of the updated policy.

Contact us

If you have questions about this Privacy Policy or our data practices, contact us at hello@dmiq.site or visit https://dmiq.site.