Privacy Policy

Last updated August 2026

What this service does

DM Bird helps a business answer customer messages it receives on Instagram, Facebook Messenger and WhatsApp. A business connects its own accounts, and we process the messages sent to those accounts so we can draft or send replies on the business's behalf.

What we collect

• Message content and timestamps for conversations with the connected business accounts.
• The platform-scoped sender id and display name of the person messaging the business.
• Access tokens for the connected accounts, stored encrypted.
• Answers the business has approved for the assistant to use.

We do not collect payment details, and we do not buy or receive customer data from third parties.

How we use it

Messages are used only to answer the customer, to show the conversation to the business's own support agents, and to hand a conversation to a human when the assistant is not confident. Message content may be sent to our AI provider to generate a reply. We do not sell personal data or use it for advertising.

Retention and deletion

Conversations are retained while the business's account is active. A business can disconnect an account at any time, which stops all processing, and can request deletion of its conversation history. To request deletion of your data, email privacy@dmbird.com.

Sharing

We share data only with the processors needed to run the service: Vercel Inc. (application hosting), Supabase Inc. (database hosting) and OpenAI, L.L.C. (reply generation). Each business's data is isolated from every other business's data. We do not sell personal data and we do not share it for advertising.

Security

Data is encrypted in transit and at rest. Access tokens for connected accounts are additionally encrypted with AES-256-GCM before they are stored, and access to production systems is limited to authorised staff who need it to operate the service.

Government and law enforcement requests

When a public authority asks us for personal data, we:

• review whether the request is legally valid and binding on us before responding;
• challenge requests we believe to be unlawful, overbroad or improperly served;
• disclose only the minimum information necessary to satisfy a valid request;
• document each request, our response, the legal reasoning and the people involved.

Where we are legally permitted to do so, we notify the affected business before responding.

Contact

Questions about this policy: privacy@dmbird.com.