Privacy Policy
Utolsó frissítés: 2026. október 23.
A Hungarian summary of what we keep after an erasure is at the end of this page ("Magyar nyelvű kivonat").
This Privacy Policy explains how dmconverts processes personal data. dmconverts is a service that replies to Instagram comments with private messages, hands out coupon codes and reports the webshop orders those messages drive.
Who we are
dmconverts is operated by Flowstart Kft., Hungary (registered office: 1141 Budapest, Szugló utca 161. 1/2.; company registration number: 01 09 429426; tax number: 32538133-2-42). Contact: info@flowstart.eu.
- For the accounts of brands and agencies that use dmconverts ("customers"), for our website and for billing, Flowstart Kft. is the data controller.
- For the data of people who comment on or message a customer's Instagram account ("commenters"), the customer is the controller and Flowstart Kft. processes that data on the customer's behalf as a processor, under our Terms of Service. Commenters can still contact us directly; see "Your rights" below.
What data we process
Customer account data. Name, email address, organization name, team members and their roles, plan and billing status.
Instagram professional account of the customer. Instagram account id, username, display name, profile picture URL, and the access token Meta issues when the customer connects the account. The access token is encrypted at rest and deleted when the account is disconnected.
Commenter data received through Meta webhooks. When someone comments on, or sends a message to, a connected Instagram account, Meta sends us:
- the commenter's Instagram-scoped user id (IGSID) and username;
- the text of the comment or direct message, and the post it belongs to;
- the button taps in our messages, with the time of consent (for example, consent to receive a coupon code);
- opt-out status: replying STOP, NEM, NE, LEIRATKOZOM or UNSUBSCRIBE stops every automated message to that person for that account, permanently;
- an email address, only if the commenter types it into the conversation when a campaign asks for it.
Coupon codes. The codes a customer uploads or generates, and which code was given to which commenter and when.
Link clicks. When a commenter opens a tracked link in our message: time, campaign, a hashed IP address, user agent and referrer.
Webshop order data. From the customer's connected webshop (for example Shopify or WooCommerce): order id, order status, amounts, currency, the coupon code used and campaign tags (UTM parameters). We do not receive or store card or other payment details.
Technical data. Server and error logs needed to run and secure the service.
Why we process it
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the service to customers (connect Instagram, run campaigns, send messages, hand out coupons, report orders) | Customer account, Instagram account, commenter, coupon, click and order data | Contract with the customer (GDPR Art. 6(1)(b)); for commenter data, the customer's own legal basis, on whose behalf we act |
| Respecting commenter choices (consent records, opt-out) | Consent and opt-out timestamps, IGSID | Legal obligation and legitimate interest (Art. 6(1)(c) and (f)) |
| Billing and invoicing | Customer account and billing data | Contract and legal obligation (accounting law) |
| Security, abuse prevention and error monitoring | Technical data, scrubbed error reports | Legitimate interest (Art. 6(1)(f)) |
| Service emails (password, quota and account notices) | Customer email address | Contract |
We do not sell personal data, we do not use commenter data for our own marketing, and we do not build profiles of commenters across customers.
How long we keep it
| Data | Retention |
|---|---|
| Raw webhook payloads from Meta and webshops | 14 days |
| Link click logs | 400 days |
| Commenter records (contacts) and message delivery records | Until the customer deletes them, the commenter's erasure request is completed, or the Instagram account is removed from dmconverts through Meta's deauthorization or data deletion request |
| Instagram access token | Until the account is disconnected (then deleted immediately) |
| Instagram account id after a Meta deauthorization or data deletion request | Kept (without the username, display name or profile picture) to prevent silent re-connection of the account by another organisation |
| Opt-out suppression record of a commenter who had opted out, written when that commenter's data is erased (by the customer from its contact list, or through a Meta deauthorization or data deletion request): a keyed one-way hash of the commenter's IGSID, the Instagram account id and the opt-out date | No automatic deletion: kept for as long as needed so that the person is never messaged again, also after the customer's workspace is deleted. Commenters who had not opted out leave no such record |
| Deletion request record of a Meta deauthorization or data deletion request: confirmation code, the Instagram user id Meta sent with the request (the account's Instagram id or app-scoped id), request type, received and completed time | No automatic deletion: kept for as long as needed to prove the erasure and to answer the confirmation code on the Data Deletion page, also after the customer's workspace is deleted |
| Audit log entry of an erasure (confirmation code, Instagram account id, the Instagram user id from the request, request type, counts of erased records) | Until the customer's workspace is deleted |
| Order attribution records | For the life of the customer's account; after a contact is erased the order record no longer links to that person |
| Customer account and billing records | For the life of the account; invoices for the period required by Hungarian accounting law |
Processors and transfers
We use the following service providers. Each processes data only as needed for its task.
| Provider | Role | Data |
|---|---|---|
| Meta Platforms (Instagram) | Delivers comments and messages, sends our replies | Instagram account and commenter data |
| Inngest (Inngest Cloud, United States) | Runs background jobs | Identifiers only (internal ids, IGSIDs); no message text, names or email addresses |
| Resend | Sends service emails | Customer email addresses and email content |
| Stripe | Subscription payments | Customer billing data; card details are handled by Stripe and never reach us |
| Sentry | Error monitoring | Error reports, scrubbed of message text, tokens and webhook bodies |
| Vercel Inc. (hosting, United States) | Runs the application | All data listed above, while it is processed |
| Neon (database, EU region Frankfurt) | Stores the database | All data listed above |
Where a provider processes data outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
Meta Platform Terms
dmconverts uses the Instagram API under the Meta Platform Terms and Meta's Developer Policies. We use data received from Meta only to provide the service to the customer whose Instagram account it came from, and we delete it as described in this policy and on our Data Deletion page.
Your rights
Under the GDPR you have the right to access, rectify and erase your personal data, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing.
- Customers can disconnect Instagram under Settings → Instagram, and can write to info@flowstart.eu for any other request.
- Commenters can stop all automated messages by replying STOP, NEM, NE, LEIRATKOZOM or UNSUBSCRIBE. To have your data erased, ask the brand whose account you interacted with, or write to info@flowstart.eu with your Instagram username and the account's name; we will pass the request to the brand and help complete it.
- When a brand removes dmconverts from its Instagram account, or Meta sends us a data deletion request for it, we erase the data collected through that account. The Instagram account id is retained to prevent silent re-connection of the account by another organisation, and the deletion request record (with the Instagram user id Meta sent) is retained to prove the erasure. If an erased commenter had opted out, a keyed one-way hash of their IGSID is retained so that they are never messaged again. See Data Deletion.
We answer requests without undue delay and within one month at the latest. You may also lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, naih.hu) or with the supervisory authority of your country.
Security
Access tokens are encrypted at rest, traffic is encrypted in transit, data of different customers is kept separate, and access to production systems is limited to the people who operate the service.
Changes to this policy
We will post any change on this page and update the date at the top. For material changes we notify customers by email.
Contact
Flowstart Kft., info@flowstart.eu
Magyar nyelvű kivonat: amit a törlés után megőrzünk
Ez a szakasz a fenti angol nyelvű tájékoztató egy részének magyar kivonata; eltérés esetén az angol szöveg az irányadó.
- Leiratkozott kommentelők. Ha egy kommentelő adatait töröljük (a márka törli őt a kontaktlistájáról, vagy a Meta adattörlési kérelme vagy hozzáférés-visszavonása miatt töröljük a fiókhoz tartozó adatokat), és a kommentelő korábban leiratkozott az üzenetekről, megőrizzük az Instagram-hatókörű azonosítójának (IGSID) kulccsal képzett, egyirányú hash-ét, az Instagram-fiók azonosítóját és a leiratkozás dátumát. A hash-ből az azonosító nem állítható vissza; csak arra szolgál, hogy az illető soha többé ne kapjon automatikus üzenetet. Azokról a kommentelőkről, akik nem iratkoztak le, ilyen adat nem marad.
- A törlési kérelem. A Meta adattörlési kérelméről vagy hozzáférés-visszavonásáról megőrizzük a megerősítő kódot, a Meta által a kérelemmel küldött Instagram-felhasználói azonosítót (a fiók Instagram-azonosítóját vagy alkalmazás-hatókörű azonosítóját), a kérelem típusát, valamint a beérkezés és a teljesítés időpontját. Ez igazolja, hogy a törlés megtörtént, és ennek alapján válaszol az Adattörlés oldal a megerősítő kódra. A márka munkaterületének naplójában is marad egy bejegyzés a megerősítő kóddal, a fiók azonosítójával, a kérelemben kapott Instagram-felhasználói azonosítóval, a kérelem típusával és a törölt adatok számával; ez a munkaterülettel együtt törlődik.
- Megőrzési idő. A leiratkozási hash-eket és a törlési kérelmek adatait nem töröljük automatikusan: addig őrizzük meg őket, amíg a törlés igazolásához és a leiratkozások betartásához szükségesek, akkor is, ha a márka dmconverts-munkaterületét már törölték.
- Az Instagram-fiók azonosítója (felhasználónév, név és profilkép nélkül) szintén megmarad, hogy egy másik szervezet ne csatlakoztathassa újra észrevétlenül a fiókot.