Privacy policy
Last updated: 1 November 2026
This policy explains which personal data we process when you visit dmowl.com or use DMowl, why we do it, and which rights you have under the General Data Protection Regulation (GDPR).
DMowl plays two roles: for our website, our customers’ accounts and billing we are the controller. For the contacts and conversations of our customers’ Instagram accounts we act as a processor on our customers’ behalf (Art. 28 GDPR) — see section 9.
1. Controller
DMowl, Michel Ruchti, Pfisters Reben 13, 3210 Kerzers, Switzerland.
Email: privacy@dmowl.com
We are not required to appoint a data protection officer. For all privacy questions, write to the address above.
2. Visiting the website
When you open dmowl.com, our hosting provider Cloudflare processes technical data your browser sends: IP address, date and time, requested page, referrer, browser and operating system. This is necessary to deliver the website, to keep it secure (e.g. against attacks) and to find errors.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a secure, working website. Logs are kept for at most 7 days unless needed to investigate an attack.
We read the visitor’s country from the request (not the exact location) to show prices in euros or US dollars. It is not stored.
Usage statistics: to understand which pages and features are used, we run Umami on our own server. Umami sets no cookies, does not store IP addresses and cannot recognise you across websites; it counts page views and a few events (e.g. “signed up”, “tool used”) anonymously. Tokens and codes in links are removed before anything is counted. On our public pages only (home, pricing, free tools, use cases, legal pages) Umami also records a sample of visits as anonymous session replays and heatmaps: mouse movements, clicks, scrolling and page changes. Everything you type into form fields is masked and never recorded; recordings are deleted after 30 days. We never record inside the app, during sign-up or login, or on pages reached through personal links. Legal basis: Art. 6(1)(f) GDPR — our interest in improving the website. If your browser sends “Do Not Track”, nothing is counted.
4. Bot protection (Cloudflare Turnstile)
On sign-up, login and password reset we use Cloudflare Turnstile to tell humans from bots. Turnstile evaluates technical signals from your browser (e.g. IP address, browser properties) without tracking cookies and without showing puzzles in most cases.
Legal basis: Art. 6(1)(f) GDPR — protecting accounts against automated attacks.
5. Your DMowl account
When you sign up we process your name, email address, a hashed password (we never store it in plain text), your language, and when you were last active. Team members you invite receive your name and the account name in the invitation.
Legal basis: Art. 6(1)(b) GDPR — performing the contract. We store this data as long as your account exists.
Inactive free accounts: if a free account has had no login and no automated activity for 30 days, we send a notice and delete it 14 days later unless you log in. This keeps the data we hold to a minimum (Art. 5(1)(c) and (e) GDPR). Paid accounts are never deleted for inactivity.
6. Sign in with Google
If you choose “Continue with Google”, Google Ireland Limited sends us your name, email address, whether it is verified, and a Google account ID. We don’t receive your Google password or other Google data.
Legal basis: Art. 6(1)(b) GDPR. Google’s privacy policy: https://policies.google.com/privacy
7. Connecting Instagram (and signing in with Instagram)
DMowl works through the official Instagram API of Meta Platforms Ireland Limited. When you connect your Instagram professional account and grant permissions, we receive and process:
- your Instagram user ID, username, name, follower count and profile information
- your posts and reels (captions, media links) to set up triggers
- comments on your posts, direct messages, story replies and mentions sent to your account — including the Instagram-scoped ID, username and name of the people writing
- an access token, which we store encrypted (AES-256-GCM) and renew automatically
Legal basis: Art. 6(1)(b) GDPR. You can disconnect Instagram in DMowl at any time or remove DMowl in Instagram (Settings → Website permissions → Apps and websites). We then stop receiving data. Meta’s privacy policy: https://privacycenter.instagram.com/policy
8. AI features
AI features are optional. If you switch on the AI agent or use AI drafts and rewrites, we send the relevant text through OpenRouter, Inc. (USA) to a language model to generate a response: for the agent, your agent settings and knowledge plus the recent messages of the conversation (up to 20).
We only allow routing to selected model hosts in the USA and EU that store no data (zero data retention) and do not use it for training. Providers in other third countries are excluded. The AI does not make decisions with legal or similarly significant effects on anyone (Art. 22 GDPR); it drafts and sends replies according to your settings and can hand over to a human at any time.
Legal basis: Art. 6(1)(b) GDPR for our customers; for their contacts see section 9.
9. Data of our customers’ contacts
If you have written to, commented on or mentioned an Instagram account that uses DMowl, that business decides how your data is used — it is the controller. DMowl processes the data only on its behalf and on its instructions, under a data processing agreement (Art. 28 GDPR).
To exercise your rights (access, deletion, objection) please contact that business directly. If you write to us, we will forward your request. You can stop automated messages at any time by replying “STOP” in the conversation.
10. Payments
Paid plans are processed by Stripe Payments Europe, Ltd. (Ireland). Stripe receives your name, email address, billing address, VAT ID if provided, and your payment method. We never see full card numbers. Stripe may itself act as a controller for fraud prevention and to meet legal obligations.
Legal basis: Art. 6(1)(b) GDPR and, for invoices and accounting records, Art. 6(1)(c) GDPR together with the statutory retention periods of commercial and tax law (usually 6 to 10 years). Stripe’s privacy policy: https://stripe.com/privacy
11. Emails we send
Service emails — confirming your address, password reset, team invitations, plan limits, payment and security notices, trial reminders, the inactivity notice — are part of the service (Art. 6(1)(b) GDPR).
After you sign up we also send a few tips that help you get started, and a reminder if you stop using DMowl. We do this based on our legitimate interest in helping customers use the product they signed up for (Art. 6(1)(f) GDPR). You can unsubscribe with the link in every such email or in your profile at any time; service emails are not affected.
12. API, MCP and webhooks
If you create API keys or webhooks, DMowl sends data to the systems you connect (e.g. a lead’s email address to your CRM). You decide which systems receive data and are responsible for them. API keys are stored only as hashes.
Revenue attribution: if you connect your shop (Shopify, Stripe or API), we receive the order ID, amount and currency of orders that came through a DMowl link, to show you which automation earned what. Other order data is ignored.
Referral program: if you share your referral link, we store who signed up through it and the commissions earned (Art. 6(1)(b) GDPR). The person who referred you only sees totals, never your name or data. Payout details you enter are used only for payouts.
13. Recipients and transfers outside the EU
We only share personal data with the service providers below, under contracts that oblige them to protect it. Some are located in the USA or can access data from there; transfers rely on the EU-U.S. Data Privacy Framework (adequacy decision of 10 July 2023) and/or the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Our database is stored in Cloudflare’s EU jurisdiction.
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, database (EU jurisdiction), email delivery, bot protection (Turnstile), rate limiting | USA / global network; database in the EU | EU-U.S. Data Privacy Framework, Standard Contractual Clauses |
| OpenRouter, Inc. | AI features (AI agent replies, drafts, rewrites) — only when enabled. Routed only to providers with zero data retention; no training on the data | USA; model hosting by selected providers in the USA/EU | Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. | Payment processing, invoices, tax calculation | Ireland (with group companies in the USA) | EU-U.S. Data Privacy Framework, Standard Contractual Clauses |
In addition, Google (section 6) and Meta (section 7) receive data when you use their sign-in or connect Instagram, under their own responsibility.
14. How long we keep data
- Account, Instagram and conversation data: as long as your account exists. Deleting your account removes it immediately; backups are overwritten within 30 days.
- Server logs: at most 7 days.
- Invoices and accounting records: as required by commercial and tax law.
- Email confirmation and password reset links: 48 hours and 1 hour.
15. Security
All connections are encrypted (TLS). Passwords are stored as salted hashes (scrypt), Instagram tokens encrypted with AES-256-GCM, API keys as hashes. Access within an account is controlled by roles (owner, admin, member, viewer). Login and API endpoints are rate-limited.
16. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw any consent with effect for the future (Art. 7(3)).
Right to object (Art. 21): where we rely on legitimate interests, you can object at any time for reasons arising from your particular situation. You can object to tips and reminders by email at any time without giving reasons.
To exercise your rights, write to privacy@dmowl.com. Much of it you can do yourself: edit your profile, export contacts as CSV, and delete your account in DMowl.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work.
17. Required data
You are not obliged to provide personal data, but without an email address (or a Google/Instagram sign-in) and, for paid plans, billing details we cannot provide the service.
18. Changes
We update this policy when our service or the law changes. The current version is always available here; we inform customers of material changes by email.