Skip to content
OttoDM

Privacy policy

Last updated 29 September 2026

OttoDM replies to comments on your Instagram posts and sends follow-up direct messages on your behalf. Doing that requires handling some personal data, both yours and that of people who interact with your posts. This page explains exactly what is held and why.

Who this covers

Two groups. Creators are people with an OttoDM account who connect an Instagram account. Commenters are people who comment on a creator's post or message them, and who never sign up for anything here.

What is collected from creators

  • Your email address, and a hashed version of your password if you chose one. The password itself is never stored.
  • The Instagram account you connect: its account ID, username, display name, and profile picture.
  • An access token issued by Instagram, encrypted before it is written to the database.
  • The automations you build, and counts of how often they ran.
  • If you pay for Pro: your plan and the IDs Stripe gives your subscription. Card details are typed into Stripe's own page and never reach OttoDM.

What is collected from commenters

  • The Instagram-scoped ID, username and display name of anyone whose comment or message triggers one of your automations.
  • The text of that comment or message, and of anything OttoDM sent in reply.
  • Whether they tapped a button, so a creator can tell whether an automation is working.
  • Anything a creator's automation saves: a tag, an answer they gave, or an email address they replied with when asked for one.
  • What Instagram shares about someone who has messaged the account: their follower count, whether they are verified, and whether they and the creator follow each other.

This data comes from Instagram as a consequence of interacting with a creator's post. It is not bought, scraped, or combined with data from anywhere else.

Why it is held

Only to run the automations a creator has set up, to show that creator whether they worked, and to run the creator's own account and subscription. There is no advertising, no profiling, and no sale of data to anyone, ever.

Who it is shared with

  • Meta Platforms, because sending a reply or a DM means calling Instagram's API.
  • Render, which hosts the service and its database.
  • Stripe, which takes payment for Pro. It sees the paying creator's email address and card, and nothing about commenters.
  • Resend, which sends OttoDM's own emails, such as password resets. It sees the creator's email address and the email, and nothing about commenters.
  • Anyone we are legally required to disclose it to.

That is the whole list.

How long it is kept

Creator data is kept while the account is open. Commenter data is kept while the creator's account is open, because the creator may need to see who they replied to. Both are deleted on request — see the data deletion page.

Security

Instagram access tokens are encrypted at rest. Passwords are hashed with Argon2. Traffic is served over HTTPS. No system is perfectly secure, and this one is young — it is stated plainly rather than dressed up.

Your rights

You can ask what is held about you, ask for it to be corrected, or ask for it to be deleted. Write to tmmiltd@gmail.com and you will get a reply within 30 days.

Changes

If this policy changes materially, the date at the top changes with it.