Privacy Policy

1. Introduction

BlipDM is operated by Oxono Labs LLP. In this policy, "BlipDM", "we" and "us" mean Oxono Labs LLP, which is the data controller responsible for the personal information described below. BlipDM provides a service that automatically sends Instagram direct messages in response to comments, story replies and direct messages received by an Instagram account you own or manage. This Privacy Policy describes how we handle personal information when you use that service.

This policy covers our website and the BlipDM web application. It applies both to you, as the account holder who signs up for BlipDM, and to the people who interact with your Instagram account and therefore have their information processed by us on your behalf.

2. Information We Collect

Account information

When you create a BlipDM account we store the identifiers needed to recognise you when you return: your email address (where you provide one), your Instagram professional account's numeric user ID, your Instagram username, and your profile picture URL. We use these to identify your account and display it in the dashboard.

Instagram authorisation

Connecting Instagram uses Meta's official OAuth flow. You enter your Instagram credentials on Instagram's own website, never on ours — we never see, receive or store your Instagram password. What we receive back is an access token, which we store together with its expiry so we can act on your behalf until you revoke it.

The permissions we request, and what each one is used for:

Automation content

We store the automations you build: the trigger keywords you choose, the message text, buttons and links you write, any image you upload for a message card, and a reference to the post, reel or story the automation is attached to. To keep your dashboard working after Instagram's own image links expire, we also save a copy of the thumbnail of the specific post, reel or story an automation targets. We do not copy your wider media library.

Data about people who interact with your account

This is the category most worth reading carefully. When someone comments on your post, replies to your story or messages you, Instagram sends us a webhook event. We record that event so we can decide whether one of your automations should respond, avoid replying to the same person twice, and show you what happened. That record includes:

• The sender's Instagram-scoped ID — an identifier that is specific to your account and cannot be used to identify that person on any other app.
• The text of the comment, story reply or message that triggered the automation.
• The ID of the post, reel or story involved, and the time it happened.
• The outcome — whether a reply was sent, skipped, or failed, and why.

We process this data as a service provider acting on your instructions. If you are subject to the GDPR or a similar law, you are the data controller for it and BlipDM is your processor; you are responsible for having a lawful basis to message the people who contact you.

Payment information

Payments are handled entirely by our payment processor, Razorpay. Card numbers never reach our servers. We retain only the payment and order references the processor returns, the amount, and the currency, so we can show your billing history and confirm your subscription.

Technical data

Our servers keep standard operational logs — such as request times, error messages, and the browser user agent associated with a login session — used for security, debugging and keeping the service running.

3. How We Use Your Information

We use the information described above only for the following purposes:

• Running the service — matching incoming comments, story replies and messages against your automations, and sending the replies you configured.
• Preventing duplicate messages — remembering who has already received a given automation so the same person is not messaged repeatedly.
• Showing you your account — displaying your posts, automations, activity and results in the dashboard.
• Billing — processing subscription payments and tracking usage against your plan's limits.
• Support and reliability — investigating problems you report and diagnosing failures.
• Security — detecting abuse, and protecting accounts from unauthorised access.
• Legal compliance — meeting obligations that apply to us, including Meta's Platform Terms.

4. Information Sharing and Disclosure

Service providers

We share information with a small number of providers strictly as needed to operate BlipDM. Each is bound to handle it only on our instructions:

Legal requirements

We may disclose information where we are legally required to, or where we believe in good faith that disclosure is necessary to comply with law, enforce our terms, or protect the rights and safety of our users or the public.

Business transfers

If BlipDM is involved in a merger, acquisition or sale of assets, your information may be transferred as part of that transaction. We will give notice before your information becomes subject to a different privacy policy.

Aggregated data

We may publish aggregated or de-identified statistics about how the service is used. This data cannot reasonably be used to identify you or anyone who messages you.

5. Data Security Measures

• All traffic between your browser and our servers is encrypted with HTTPS.
• Login sessions are identified by a cookie whose value is stored on our servers only as a hash, so a database copy alone cannot be used to impersonate you.
• Instagram access tokens are stored server-side and are never exposed to the browser or to any other customer.
• Incoming webhooks from Meta are signature-verified, so we do not act on forged events.
• Access to production systems is limited to personnel who need it to operate the service.
• Uploaded images are validated by inspecting their actual file contents, not merely their declared type.

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security, and you are responsible for keeping your own login credentials confidential.

6. Data Retention and Deletion

We keep your account details, automations and event history for as long as your account remains active, because the service needs them to keep working — event history in particular is what prevents the same person being messaged twice by the same automation.

Payment records are retained for as long as required for tax and accounting purposes, even after an account is closed.

How to delete your data

• Stop the automations — deactivate or delete individual automations at any time from your dashboard.
• Disconnect Instagram — revoke BlipDM's access from Instagram's settings, under Apps and Websites. We immediately lose the ability to read events or send messages on your behalf.
• Delete your account — contact us using the details in section 13 and we will delete your account and associated personal data, other than records we are legally required to keep.

We will action a verified deletion request within 30 days.

7. Your Privacy Rights and Choices

Depending on where you live, you may have some or all of the following rights over your personal information:

• Access — obtain a copy of the personal information we hold about you.
• Correction — have inaccurate information corrected.
• Deletion — request that we erase your personal information.
• Portability — receive your information in a machine-readable format.
• Objection and restriction — object to, or ask us to limit, certain processing.
• Withdraw consent — disconnect your Instagram account at any time, which stops all further processing of new events.

To exercise any of these, contact us using the details in section 13. We may need to verify your identity first. We will respond within 30 days, or sooner where the law requires it, and we will not charge you or degrade your service for exercising a right.

If you interacted with an Instagram account that uses BlipDM and want your data removed, please contact the owner of that account first, since they determine what happens to it. You may also contact us and we will help route the request.

8. Cookies and Tracking

BlipDM uses a single, strictly necessary cookie: a session cookie that keeps you logged in as you move between pages. Without it, the application cannot tell who you are, so it cannot be disabled while using the service.

You can clear or block cookies through your browser settings; blocking our session cookie will log you out and prevent you from signing in.

9. Third-Party Services

Instagram and the Meta Graph API

BlipDM is built on Instagram's official API and our use of it is governed by Meta's Platform Terms and developer policies. Your use of Instagram itself remains subject to Meta's own privacy policy, which we do not control. Revoking BlipDM's access from within Instagram takes effect immediately and independently of anything you do in BlipDM.

Other providers

Payments are processed by Razorpay and infrastructure is provided by Amazon Web Services, each under their own privacy policies.

Links to other sites

Automations you create may contain links to other websites. We are not responsible for the privacy practices of any site we do not operate, including sites you link to from your own messages.

10. International Data Transfers

BlipDM is operated from India and our service providers operate globally. Your information — and the information of people who interact with your account — may therefore be stored and processed in countries other than your own, including countries whose data protection laws differ from those where you live.

Where we transfer personal information out of a jurisdiction that restricts such transfers, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, to ensure it remains protected.

11. Children's Privacy

BlipDM is a business tool and is not directed at children. It is not intended for anyone under 18, and consistent with Instagram's own requirements you must be at least 13 to hold an Instagram account. We do not knowingly collect personal information from children.

If you believe a child has provided us with personal information, contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy as the service changes or the law requires. The "Last updated" date at the end of this page always reflects the current version.

If we make a material change — one that meaningfully affects how we handle your information — we will provide notice by email or through the application before it takes effect. Continuing to use BlipDM after a change takes effect means you accept the revised policy.

13. Contact Us

For any question about this policy, or to exercise any of the rights described in section 7, contact us at:

• Email: privacy@blipdm.com
• Support: support@blipdm.com

Please include enough detail for us to identify your account. We aim to respond to every privacy request within 30 days.

BlipDM is operated by Oxono Labs LLP. Correspondence about this policy, including data protection requests, should be addressed to Oxono Labs LLP at the email addresses above.