ExpeDM Privacy Policy

Last updated: 9 November 2026

ExpeDM ("ExpeDM", "we") is a tool that sends a direct message on Instagram when someone comments a chosen keyword on a post the account owner selected. This page explains what data ExpeDM handles. Contact: hello@expedigit.net

Who Uses ExpeDM

ExpeDM is used by the owner of an Instagram professional account who signs in with Meta and connects their account ("the account owner"). We also handle data about people who comment on connected accounts ("commenters").

Data We Collect

From the account owner:

• Name, email address and profile image from sign-in.
• Instagram account ID, username, display name and profile picture URL.
• An access token from Meta that lets ExpeDM act for the connected account. It is stored encrypted.

From Meta webhooks, for all comments on connected accounts:

• When Meta notifies us of a comment or message event, we store the full notification as received. It includes the commenter's Instagram ID and the comment text. We store it before checking whether the comment matches any automation, so it can include comments on posts the account owner did not select.

From commenters whose comment matches an automation:

• Instagram user ID and name, the comment text and ID, the matched keyword, and whether a direct message was sent, with any error message.

Technical records:

• System and error logs. Logs for rejected webhook requests can include a short preview of the request body.

What We Use It For

• To detect a matching keyword in a comment on a selected post.
• To send the commenter the direct message the account owner wrote.
• To show the account owner their message log and keep the service working.

We do not sell data and do not use it for advertising. We send direct messages only to people whose comment on a selected post matched a keyword. We share data only with the services needed to run ExpeDM. Meta receives the message we send through Instagram. Webhook notifications from Meta reach our server through Cloudflare's tunnel service, so they pass through Cloudflare in transit. Our email provider receives account owners' email addresses when we send login links. The service runs on a computer we control, and AI coding tools used to maintain it can access the project files and database during maintenance.

Permissions We Request From Meta

instagram_basic, instagram_manage_comments and instagram_manage_messages.

How Long We Keep Data

ExpeDM does not currently delete data automatically. Account data, commenter records, stored webhook notifications and logs are kept until we delete them on request or when a connected account owner disconnects, as described below.

Deleting Your Data

• Account owners: disconnect your Instagram account in ExpeDM. This deletes the connection, its automations and its message logs. It does not currently delete stored webhook notifications or system logs, and it does not revoke ExpeDM's access token at Meta. To revoke access, remove ExpeDM in Instagram under Settings > Apps and websites. To have the remaining records deleted, email us.
• Commenters and anyone else: email hello@expedigit.net with your Instagram username. We handle deletion requests manually and delete the records about you that we can identify, including stored webhook notifications.

Security

Access tokens are encrypted at rest. No system is perfectly secure and we cannot guarantee that data will never be accessed without permission.

Changes

We will update this page when we change how data is handled.