Last updated:
Privacy Policy
This policy explains what DMdrop collects, why, who we share it with, how long we keep it, and what you can do about it. It covers dmdrop.co, the DMdrop app, and the DMdrop MCP server.
DMdrop is run by Quorven Digital LLC, a New Mexico limited liability company in the United States ("DMdrop", "we", "us"). Questions: contact@dmdrop.co.
Who this policy is about
- Coaches who apply, sign in and use DMdrop. For your data, we are the controller.
- Visitors to dmdrop.co. For your data, we are the controller.
- People who comment on a coach's Reel or message a coach ("commenters"). DMdrop sends and organises messages for the coach, on the coach's instructions. For your data, the coach is the controller and we are their processor. See If you commented on a coach's Reel.
What we collect
When you apply for the beta
- Your Instagram handle.
- Your answers: the kind of coaching you do, your price range, your follower range, how you handle keyword Reels today, which tool you use and what you pay for it, how many DMs you follow up with, the feature you want first, and the plan you'd pick after the beta.
- Public numbers about your Instagram professional account that we look up from your handle through Instagram's API: followers, Reels in the last 30 days, median views, your best recent Reel's link and thumbnail, and keyword calls to action in recent captions. We don't store captions.
- Which page you came from and campaign tags in the link (UTM tags).
- A random token in a cookie, so you can finish later on the same browser.
When you create an account and sign in
- Your email address and name.
- If you sign in with Google or Apple: the account ID, name and email address they share with us.
- A password, if you set one (stored only as a hash), and your two-factor settings and backup codes (encrypted).
- For each signed-in device: the IP address, the browser and operating system, and when it was last active. You can see and sign out these sessions in Settings.
When you connect Instagram and use DMdrop
- Your Instagram account ID, username, profile details and an access token, through Instagram's official login.
- Your Reels, comments and messages that DMdrop needs to run your keyword flows, alerts, reminders and reports.
- What you set up in DMdrop: keywords, qualifying questions, messages and settings.
- The commenters' data described below.
- If you use the MCP server: which tools your AI assistant calls, and when.
When you contact us
- What you write in the feedback form or a bug report, and your email if you write to us.
Automatically
- Product analytics: pages viewed and actions taken (for example "signed in" or "report viewed"), with a random user ID, device and browser type, and approximate location from your IP address. We don't put email addresses, Instagram handles, names or anything you type into analytics.
- Server logs for security and fixing errors. We keep personal data out of logs.
- Short-lived counters that limit sign-in attempts. They store scrambled (hashed) values of the address and IP, not the address itself.
Why we use it, and our legal bases
We don't ask for your consent where the law doesn't require it. Where it does, we ask first.
| Purpose | Legal basis (EEA, UK, Switzerland) |
|---|---|
| Running your application, account and the features you use | Performing our contract with you |
| Deciding who joins the beta first and keeping the queue | Our legitimate interest in running a limited beta |
| Keeping accounts secure: sign-in codes, two-factor, rate limits, security emails | Contract, and our legitimate interest in security |
| Understanding how DMdrop is used and improving it | Our legitimate interest. You can opt out in Privacy settings. In the EEA, UK and Switzerland analytics run without cookies or anything stored on your device |
| Emails about your account and the beta | Contract |
| Emails about DMdrop news | Legitimate interest for coaches who signed up, with an unsubscribe link in every email; consent where the law requires it |
| Answering support requests | Contract and legitimate interest |
| Meeting legal obligations and defending claims | Legal obligation and legitimate interest |
Where we rely on legitimate interests, you can object (see Your rights).
Instagram data. We use data from Instagram only to provide the features you turned on. We don't sell it, license it, use it for advertising, or use it to build profiles of people. We follow Meta's Platform Terms and Developer Policies.
We don't sell personal data, and we don't share it for cross-context behavioural advertising.
Who we share it with
Only service providers that help us run DMdrop, under contracts that limit their use of the data:
| Provider | What for |
|---|---|
| Railway | Hosting the app and database |
| Resend | Sending email |
| PostHog | Product analytics |
| Google, Apple | Sign-in, if you choose them |
| Meta (Instagram) | Connecting your account, reading comments, sending messages, the handle lookup |
| Cal.com | Booking a setup call, if you book one |
Your AI assistant. If you connect an AI assistant (such as a chatbot app) to DMdrop through the MCP server, DMdrop sends it the data you ask for: your leads, messages and reports. You choose that assistant and its provider; it isn't our service provider, and its own terms and privacy policy apply to what it receives. You can disconnect it at any time.
We may also share data if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of DMdrop (we'll tell you first).
Where it's stored
DMdrop and our providers store data in the United States, including PostHog's US cloud for analytics. When we transfer data from the EEA, UK or Switzerland, we use the European Commission's Standard Contractual Clauses (and the UK addendum) or the provider's certification under the EU-US Data Privacy Framework.
How long we keep it
| Data | Kept for |
|---|---|
| An application that never becomes an account | Deleted 30 days after its last change |
| Account, application and settings | Until your account is erased |
| Signed-in sessions | 30 days, or until signed out |
| "Trust this device" for two-factor | 30 days |
| Sign-in rate-limit counters | Minutes to 24 hours |
| Instagram data, leads and commenters' data | Until your DMdrop account is erased. Disconnecting Instagram stops us reading new data but keeps your leads and reports, so they're there if you reconnect. Exceptions: if you or a commenter ask Meta or us to delete Instagram data, we delete it within 30 days |
| Feedback and bug reports | Kept to improve DMdrop; when your account is erased, they are no longer linked to it |
| Analytics | 1 year, then deleted by PostHog |
Deleting your account. "Delete account" in Settings signs you out everywhere and hides your account. If you sign in again, it's restored. To erase it for good, email contact@dmdrop.co from the address on your account; we erase it, including your application, Instagram data, leads and reports, within 30 days. Copies in our database backups are overwritten within 35 days.
Your rights
Depending on where you live (including the EEA, UK, Switzerland, California and other US states), you can ask to:
- see the data we hold about you and get a copy;
- correct it;
- delete it;
- restrict or object to how we use it, including for direct marketing;
- move it to another service;
- withdraw consent you gave, at any time (this doesn't affect what we did before);
- not be treated differently for using these rights.
Email contact@dmdrop.co. We answer within 30 days (45 days where US state law allows), and may need to confirm it's you. An authorised agent can ask for you with your signed permission. If you're in the EEA, UK or Switzerland, you can also complain to your data protection authority.
To opt out of analytics, open Privacy settings in the site footer or in the app under Settings → Legal & safety. See the Cookie Policy.
If you commented on a coach's Reel
If you commented a keyword on a coach's Reel, or messaged a coach who uses DMdrop, DMdrop may process, for that coach:
- your Instagram-scoped user ID and username;
- your comment and the messages between you and the coach;
- your answers to the coach's questions, and notes on whether you're a likely client and when to follow up.
The coach decides what is asked and sent; we process it only on their instructions and only to provide DMdrop to them. To use your rights, contact the coach first. You can also email contact@dmdrop.co and we'll pass your request on and help them answer it. If you remove your comment or ask Meta to delete data about you, the coach and DMdrop delete it too.
Children
DMdrop isn't for anyone under 18, and we don't knowingly collect their data. If you think a child has given us data, email us and we'll delete it.
Security
We encrypt data in transit, store passwords only as hashes, encrypt two-factor secrets, limit sign-in attempts, and limit who on our side can reach production data. No system is perfectly secure; if a breach affects you, we'll tell you as the law requires.
Changes
If we change this policy, we'll update the date at the top. For important changes, we'll tell signed-in coaches by email or in the app before they apply.
Contact
Quorven Digital LLC, contact@dmdrop.co.