Privacy Policy

Effective Date: September 19, 2026

Core Privacy Principles: ScaleDM is an official Meta Graph API infrastructure platform. We never ask for, see, or store your Instagram passwords. Authentication occurs strictly via official Meta OAuth 2.0. We do not sell personal data, and we never use your private direct messages to train public AI models.

ScaleDM ("ScaleDM," "we," "our," or "us") operates the website at https://scaledm.io and the ScaleDM Instagram automation platform, including our Comment-to-DM automation, Ask-for-Follow verification, Ask-for-Contact lead collection, and AI agent connector services (collectively, the "Service").

This Privacy Policy explains what information we collect, how it is processed and protected, and the choices and rights available to you. For any privacy inquiries, reach us directly at support@scaledm.io.

1. Who We Are and What This Policy Covers

This Privacy Policy applies to:

  • Website Visitors: Individuals visiting https://scaledm.io or interacting with our official channels, including our Instagram account at @scaledm.io.
  • Platform Customers: Creators, businesses, and developers who connect their Instagram Professional accounts to ScaleDM to deploy automation rules or AI agents.
  • End Users: Instagram users who comment on a customer's post or converse via Instagram Direct Messages with an account powered by ScaleDM.

2. Information We Collect and Process

A. Account Authorization Data (Official Meta Graph API)

When you connect an Instagram Professional account to ScaleDM:

  • Official OAuth Tokens: We receive authorized access tokens from Meta via official OAuth 2.0. Tokens are encrypted at rest with AES-256.
  • Public Profile Metadata: Instagram Business ID, username, profile picture, follower counts, and post IDs permitted by your approved scopes.
  • We NEVER receive your Instagram password. Login and authorization take place entirely within Meta's official authentication dialogs.

B. Automation & Messaging Interactions

  • Comment Triggers: When a user comments on a post or Reel, we receive webhook events (comment text, comment ID, commenter username, and post ID) to evaluate whether a Comment-to-DM rule should fire.
  • Direct Messages: Inbound and outbound message texts processed through Meta's Instagram Messaging API to send requested links, guides, or AI agent answers.
  • Follow Status (Ask-for-Follow): We query the official Instagram relationship endpoint to verify whether the commenter follows your account. This check is processed ephemerally to unlock gated links and is not stored permanently.
  • Contact Lead Capture (Ask-for-Contact): When an end user voluntarily replies with contact information (such as an email address or phone number) to receive a resource, we validate the format and transmit the lead directly to the customer's designated CRM, webhook, or marketing tool.

C. Technical & Diagnostic Data

  • IP addresses, browser type, timestamp logs, and API request latency stored temporarily for security audits, rate limit compliance, and fraud prevention.

3. How We Use Your Information

We use collected information exclusively to:

  • Deliver automated direct messages and comment replies in response to user actions.
  • Verify follow relationships to execute Ask-for-Follow growth rules.
  • Deliver lead data to the customer's integrated software (e.g., HubSpot, Zapier, Webhooks).
  • Route conversational messages to the customer's configured AI agent (via Model Context Protocol or REST webhooks).
  • Maintain platform security, prevent spam, and enforce Meta Platform Policies.
  • Provide customer support via support@scaledm.io.

No Sale of Data: ScaleDM does not sell, rent, or monetize your personal information or your audience's data.

4. AI Agent Connector & LLM Data Processing

ScaleDM allows developers to connect AI agents (e.g., powered by Claude, OpenAI, or custom LLMs) via our Model Context Protocol (MCP) server.

  • Context Transmission: Message text is sent to the customer's selected AI provider solely to generate conversational replies in real time.
  • Zero Public Model Training: Private direct messages and contact details processed through ScaleDM are never used to train public foundation AI models.
  • Customer Sovereignty: Customers maintain full control over their AI prompts, tools, and provider agreements.

5. Data Security & Encryption

We implement rigorous technical and organizational security standards:

  • Encryption in Transit: All data transmitted between browsers, Meta servers, and ScaleDM uses TLS 1.3 encryption.
  • Encryption at Rest: All OAuth tokens, secrets, and database records are encrypted with AES-256 in Google Cloud Key Management Service.
  • Least Privilege Access: Production access is strictly compartmentalized and protected with multi-factor authentication.

6. Data Retention & Self-Service Deletion (GDPR & CCPA)

You have the right to access, export, correct, or delete your personal data at any time.

  • Disconnecting ScaleDM: You can revoke ScaleDM's access to your Instagram account at any time via your Instagram App Settings (Settings → Website Permissions → Apps and Websites).
  • Data Deletion Requests: To request permanent deletion of all data associated with your account or interactions, send an email to support@scaledm.io with the subject "Data Deletion Request". Requests are processed within 30 days.
  • Automated Data Purge: Webhook payload logs and ephemeral verification checks are automatically purged after 30 days.

7. Compliance with Meta Platform Terms

ScaleDM is committed to full transparency and adherence to Meta Platform Terms and the Instagram Graph API Developer Policies. We enforce rate limits, respect user blocking and opt-outs, and never engage in automated bulk spamming.

8. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact our privacy officer:

ScaleDM Privacy Team
Website: https://scaledm.io
Email: support@scaledm.io
Instagram: @scaledm.io