Privacy Policy

1. Who this policy covers

This policy covers website visitors, account holders, and people who interact with our customers’ automations. DM Spark currently offers Instagram automation. Facebook automation is not available in the current launch. This policy also covers information retained from earlier Facebook connections.

We determine how information is used for our account administration, billing, security, support, and communications. Customers determine the purposes of their audience processing, and we process that information on their instructions. Our Terms of Service set out those processing obligations.

2. Information we collect

We receive information directly from you, from interactions with a customer’s automation, from connected Meta accounts, from an email service a customer connects, such as Kit (whether a contact unsubscribed there), and from the providers that operate DM Spark:

• Account and support: Name, email, profile photo, account identifiers, preferences, terms-acceptance records, and information you send us for help or feedback. Waitlist subscribers provide their name and email.
• Billing: Subscription and invoice identifiers, message pack purchases, plan, billing periods, payment status, and usage totals. Stripe processes card details; we do not store full card numbers or card security codes.
• Connected accounts: Account or Page identifiers, usernames, profile details, access credentials, permissions, and post metadata, captions, and media URLs supplied by Meta. We cache post responses and may store profile images and post metadata associated with Sparks.
• Automation activity: Rules, message templates, relevant incoming comments and messages, sender identifiers and available usernames, workflow progress, and delivery, interaction, and link-click records. Our database and processing queues hold message content used by automations. We do not retrieve your entire inbox as a conversation archive.
• Collected contacts: Email addresses and other details supplied through a workflow, associated platform identifiers, source account and Spark, collection wording, timestamps, and recorded consent or opt-out history.
• Technical records: IP addresses and request metadata processed by hosting and security providers, browser and device details needed to deliver or troubleshoot the service, and operational error and performance records.

3. How we use information

We use information to sign you in, run your Sparks, display activity and contacts, calculate usage and charges, prevent duplicate sends and abuse, secure the service, respond to support and privacy requests, and comply with law.

We send authentication, account, security, usage, and billing messages. You can control optional getting-started tips and next-post notifications in Settings or through their unsubscribe links. If you join the waitlist, or try to sign up while new accounts are paused, we use your name and email only to tell you when a spot opens. We do not add customers’ collected email addresses to our own mailing list.

Where a lawful basis is required for our own processing, we rely on:

• Contract: Providing the service to an individual customer, including account access and billing.
• Legitimate interests: Administering business customer relationships, supporting users, preventing abuse, and protecting the service.
• Legal obligations: Keeping required records and responding to lawful requests.
• Consent: Optional communications where consent is required. You may withdraw it at any time.

Customers are responsible for establishing the lawful basis for their audience processing.

4. Email collection by our customers

A customer collecting your email address is responsible for explaining its intended use, providing a privacy notice, obtaining any required marketing permission, and honoring unsubscribe and privacy requests. Supplying an email to receive requested content does not by itself authorize newsletters or ongoing marketing. We do not verify address ownership or certify marketing consent. Reusing a saved address does not create new consent.

Customers must protect exported lists and email lists they sync to a connected service such as Kit, and correct or delete information in their own systems when required. We cannot remove their downloaded copies, subscribers already added to their connected email service, or recall delivered Meta messages. We remain responsible for our own handling of information and for assisting with applicable privacy requests.

If you interacted with a customer’s automation, contact that customer about its use of your information. You can also contact us for help, including help identifying the customer. You do not need a DM Spark account.

5. Who receives information

Authorized users of a customer account can view and export its collected contacts. If a customer connects its own Kit account, collected email addresses are added to that account as subscribers, under the customer’s control. We use these providers as needed to operate DM Spark:

• Supabase: Authentication, database, and file storage.
• Render: Backend and automation processing.
• Upstash: Processing queues.
• Vercel: Website hosting.
• Resend: Account and product email delivery.
• Datadog: Server and worker operational monitoring, and optional browser diagnostics with your permission.
• Google Analytics: Optional page and feature usage counts with your permission.
• Stripe: Payments and billing.

Meta receives configured messages and related API requests and operates Instagram and Facebook under its own policies. We may also disclose information where reasonably necessary to comply with law, protect rights or security, or complete a business transfer subject to applicable protections.

We do not sell or rent personal information or share it for cross-context behavioral advertising.

6. Cookies and browser storage

We use cookies and browser storage for authentication, security, and interface preferences. Disabling necessary cookies may prevent sign-in or other requested features from working. Optional analytics and diagnostics remain off until you choose Accept. Decline is equally available and does not limit the application. You can withdraw permission in Settings at any time. We remember that choice in browser storage for up to 180 days, and clear it when you sign out or switch accounts.

With permission, Google Analytics receives fixed page and feature names and coarse conversion counts through our server. Datadog receives sanitized route names, named actions, numeric performance measurements, and fixed error codes. We exclude authentication callbacks, preview login, deletion confirmation pages, and unknown routes. We do not send account or social identifiers, emails, contacts, message text, query strings, fragments, or error text. Session replay, advertising features, cross-site tracking, and account identification are disabled.

Random telemetry session identifiers stay in this page's memory and reset on reload, withdrawal, sign-out, or account switching; we do not create an account-to-telemetry identity map. These identifiers and technical browser information can still be personal information. Datadog receives network information when your browser connects; collection settings and retention are managed separately with the provider. Google receives our server requests without your IP address or browser headers. Essential server security monitoring operates separately from optional browser consent.

Withdrawal stops future optional collection and clears the current telemetry session; it does not automatically erase earlier provider records. Contact hello@dmspark.io for a verified privacy request, including historical telemetry collected before these controls. We assess the relevant period and available identifiers, request provider deletion where required, and keep the provider part of your request open until it is resolved. We do not claim we can identify every earlier session. We do not sell personal information or share it for cross-context behavioral advertising; Global Privacy Control and Do Not Track do not enable optional collection.

7. How long we keep information and how deletion works

We keep account details, Sparks, automation records, and contacts while needed to provide your account and configured services. Request account deletion or use Delete connection data in Settings, delete a contact from its details, or email us.

Disconnecting stops a connection and removes active credentials. It preserves history and does not close your account or cancel your subscription. Deleting connection data removes that connection’s Sparks, contacts, and associated automation records and clears your current profile photo. A verified Meta deletion request initiates this deletion; Meta deauthorization only stops access.

Account deletion stops access and automations, stops subscription renewal, and removes active application records, associated profile files, and the authentication account. Charges for sends confirmed before deletion is accepted remain payable. We waive sends still unconfirmed at acceptance, even if they later arrive. We retry deletions after temporary failures; the confirmation link shows progress. A message already being sent may finish, and delivered messages cannot be recalled.

Contact deletion covers the selected contact’s platform identity within that connected account, including associated capture, workflow, and message records. It does not remove other platform identities that share an email address. For 30 days, we retain a coded identifier to prevent queued events from recreating the contact. This identifier is pseudonymous, not anonymous. Later fresh interactions may create a new contact. Customers must maintain any required unsubscribe records for their exported lists.

Some records are handled separately from automated deletion:

• Billing reconciliation: Our closed-account reconciliation record contains billing identifiers, message pack purchases, and the final usage period, normally for 90 days (30 days without billing identifiers). Unresolved billing may require longer. Provider invoices or specific legal obligations are assessed separately; we retain only the fields needed for the documented purpose.
• Minimal deletion confirmation records: Up to one year. Temporary contact suppression records expire after 30 days. Restricted coded restore markers remain until relevant older backups and replayable archives have expired.
• Logs and provider records: Retained according to their operational purpose, provider retention settings, and applicable legal requirements. We review these records separately and instruct providers to erase information we control where required.
• Backups: Account and connection deletion includes our retained older Spark configurations. Restricted infrastructure backup copies may remain after active-store deletion. The automated process does not erase every backup copy. We handle backup erasure separately in response to verified requests, subject to lawful retention exceptions; deletion requests must be reapplied before restored data returns to service.

A completed confirmation means erasure from active application stores. We process the overall verified privacy request without undue delay and within applicable legal deadlines, explain lawful exceptions, and address additional records separately. Customer exports and copies held independently by Meta remain outside our deletion controls.

8. Your privacy rights

Depending on applicable law, you may have rights to access, copy, correct, or delete your information; receive a portable copy; restrict or object to processing; or withdraw consent. Withdrawal does not affect earlier lawful processing. EEA and UK individuals may complain to their relevant supervisory authority.

Right to object: Where applicable law provides this right, you may object to processing based on legitimate interests and to direct marketing. Contact us to exercise it.

Applicable US state laws may also provide rights concerning sale, sharing, targeted advertising, sensitive information, authorized agents, and appeals. We do not sell personal information or share it for cross-context behavioral advertising. We will not unlawfully discriminate against you for exercising your rights.

Email hello@dmspark.io to make a request, act through an authorized agent, or appeal a response where applicable. We may request proportionate information to verify identity or authority and locate records. Do not send passwords or full card details. We will explain any lawful denial or limitation and available appeal options. For audience information processed on a customer’s behalf, we will assist with or route the request to that customer.

9. Security

We use access controls, encrypted network connections, managed infrastructure, and operational monitoring to protect information. Access credentials are restricted to service operations. No system can guarantee absolute security.

We investigate personal-data breaches and take appropriate containment and remediation steps. We notify customers, affected individuals, and authorities as required by law and our contracts. When acting as a processor, we notify the relevant customer without undue delay after becoming aware of a breach affecting its data.

10. International processing

NS Media LLC is based in the United States. Providers may process information in the United States and other countries, where data-protection laws may differ from those in your location.

Transfers requiring a legal safeguard must be covered by an applicable adequacy decision, approved contractual arrangement, or other lawful mechanism. Contact us for details about arrangements relevant to your information. Customers must contact us before processing that requires a separate transfer agreement; that processing may begin only once the required arrangements are in place.

11. Children

DM Spark accounts are for people aged 18 or older. The service is not directed to children under 13. Customers must not knowingly collect children’s information through DM Spark in violation of law. If you believe a child’s information was collected improperly, contact us so we can investigate and take appropriate action.

12. Changes and contact

We will update the date above when this policy changes and provide additional notice of material changes by email or through the service as appropriate. We will obtain consent for a new use where required. Prior published versions are available on request.

Contact NS Media LLC at hello@dmspark.io or 1255 Trinity Dr, Menlo Park, CA 94025, United States. You may use “Privacy Request” as your email subject.