Privacy Policy

Data We Collect

Account data: name, email address, password/authentication data (via Firebase Auth), and billing information (processed by our payment processor, not stored by us in full).

Instagram data, via the Meta Graph API and with your authorization: Instagram Business account identifiers and access tokens; comments on your posts, reels, and Stories that match your configured campaign keywords; direct messages sent and received through the service within Meta's 24-hour messaging window; follow-status flags used for follow-gate campaigns; and commenter/DM sender usernames, used only for personalization (e.g. {username}) and delivery.

Usage data: campaign configuration, tracked link clicks and CTR, DM send/skip/failure logs, and workspace membership and roles.

Technical data: IP address, device/browser information, and log data, collected automatically for security and diagnostics.

How We Use Data

To operate the service: matching keywords, sending automated DMs, tracking links, managing campaigns and workspaces, and rate-limiting per Meta's API caps. To provide the inbox feature. To bill your subscription and manage your account. To maintain DM logs for troubleshooting and abuse prevention. To communicate service updates, billing notices, and support responses. To comply with legal obligations and enforce our Terms of Use.

We do not sell your data or your end users' data to third parties.

Data Sharing

Meta Platforms, Inc.: all Instagram-related data is processed through Meta's official Graph API, subject to Meta's own data policies.

Service providers: hosting/infrastructure (database, queue, and application hosting providers), authentication (Firebase), email delivery, and payment processing, each bound to process data only for providing their service to us.

Legal requirements: we may disclose data if required by law, court order, or to protect the rights, safety, or property of Dugar Impex, our users, or others.

Data Retention

Account and campaign data is retained for as long as your account is active. DM logs and click-tracking data are retained for as long as needed for the features that depend on them, or until you delete the associated campaign/account. Upon account deletion, we delete or anonymize your data within a reasonable period, except where retention is required for legal, billing, or dispute-resolution purposes.

Your Rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, or to object to or restrict certain processing. To exercise these rights, contact fluxx.contactus@gmail.com. We will respond within a reasonable timeframe.

Security

We use reasonable technical and organizational measures (encrypted storage of tokens, access controls, secure infrastructure) to protect data. No method of transmission or storage is fully secure, and we cannot guarantee absolute security.

Children's Privacy

The service is not directed at individuals under 18. We do not knowingly collect data from minors. If you believe a minor's data has been submitted, contact us for removal.

International Transfers

Data may be processed and stored on servers located outside your country of residence. By using the service, you consent to this transfer, consistent with applicable data protection law.

Contact

Privacy questions or data requests: fluxx.contactus@gmail.com