How OttoDM uses Instagram

The three permissions we request

You are shown these by Instagram when you connect, and you can read them there too. There is no fourth.

instagram_business_basic

Read your account name, profile picture, and the list of your own posts, so you can pick which post an automation runs on.

instagram_business_manage_comments

Read comments on your posts, and reply to them publicly.

instagram_business_manage_messages

Send the direct message you wrote to the person who commented, and receive their reply.

Each one has to be justified separately to Meta with a video showing it in use, which is why the list is this short. Asking for permissions a product does not need is one of the most common reasons an app is rejected.

What we never ask for

• Your Instagram password.You connect through Instagram's own login screen. The password is typed into Instagram, never into OttoDM, and never reaches our servers.
• Permission to post to your feed, your stories, or your reels.
• Permission to follow, unfollow, or like anything on your behalf.
• Anything to do with advertising, ad accounts, or ad spend.
• Access to the accounts of people you follow.

Turning it off

Two ways, and neither requires asking us. In OttoDM, disconnect Instagram from the Accounts page — automations stop immediately and the stored token is deleted. In Instagram, go to Settings → Apps and websitesand revoke access there. Revoking from Instagram's side works even if you never sign in here again.

The access token Instagram issues lasts 60 days and is encrypted before it is written to our database. Revoking makes it dead immediately, regardless of how much of that 60 days is left.

The limits Meta sets

These are Meta's published figures for Instagram private replies and messaging, not ours. OttoDM is built around them rather than against them.

• One DM per comment.Meta allows exactly one private reply to a given comment. A flow that opens with two message steps would fail on the second, so OttoDM's builder refuses to save one.
• Seven days. A private reply must be sent within 7 days of the comment being posted. Live-stream comments are stricter still: they can only be replied to during the broadcast.
• 750 private replies per hour, per Instagram account, for comments on posts and reels.
• A 24-hour window. After someone messages you, you have 24 hours to send freely written replies. That window is set by Meta and applies to every tool, including this one.

The limits we set on ourselves

Meta's ceiling is not a target. Running at it is how accounts get flagged, so OttoDM paces well underneath.

• Direct sends are paced at 200 per minute, against a documented ceiling of 100 per second — roughly a thirtieth of what is allowed.
• Public comment replies are capped at 300 per hour. Meta publishes no hourly figure here at all; this one is ours, chosen to be cautious.
• Every public reply needs at least three different wordings before an automation can be switched on. Posting the identical comment over and over is what spam filters look for, so the builder will not let you.

A number you will see elsewhere

Several tools state a “200 DMs per hour Instagram limit”. Meta publishes no such figure for Instagram. The number appears to have drifted over from the Messenger Platform, which documents 200 API calls per hour per user — a different platform measuring a different thing. The figure that does apply to comment-triggered DMs is the 750 per hour above.

It is a small thing, but it is worth saying plainly: if a page quotes you a limit, it is fair to ask which Meta document it came from.

Where your data sits

OttoDM is operated by TMMI Ltd, a company registered in England and Wales (no. 12534102), and is the data controller. The service and its database run on Render, Inc. in Oregon, US West. Two other companies handle a small part of it: Stripe takes payment for Pro and holds the card details, and Resend sends OttoDM's own emails, such as password resets. Access tokens are encrypted at rest and passwords are hashed with Argon2.

Meta verified this business as a Tech Provideron 17 August 2026, following business verification and access verification. That status is what permits an app to handle Instagram data belonging to other people's accounts — it is a requirement for a product like this one, not a decoration. It is also not the same thing as being a “Meta Business Partner”, which is an advertising and marketing programme and grants no data access at all.

The full detail of what is stored, for how long, and how to have it erased is on the privacy policy and the data deletion page.

Checking any of this

Meta's documentation for private replies and for Instagram Platform rate limits is public, and every figure above can be found in one of them. If something here does not match what you read, tell us at tmmiltd@gmail.com and we will correct the page.