Privacy Policy

ZayDM ("we", "us", or "our") is a product operated by DanZay FZE. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use ZayDM at zaydm.com and dash.zaydm.com.

We handle personal data in accordance with applicable privacy and data protection requirements.

ZayDM is a social media automation, messaging, content publishing, and analytics product for supported Meta platforms, including Instagram and Facebook.

1. Information We Collect

Instagram Account Data

When you connect your Instagram Business or Creator account, we collect:

• Your Instagram User ID and username
• Your profile picture URL
• Your Instagram access token (encrypted at rest using industry-standard encryption)
• Basic account information (account type, follower count)
• Your Instagram-scoped User IDs of people who interact with your content

Automation Data

For Instagram automations, we collect:

• Automation rules you create (trigger keywords, response messages, settings)
• DM delivery statistics (messages sent, trigger counts, performance metrics)
• Comment trigger events (processed in real-time, comment text is not permanently stored)
• Selected post/reel IDs for automation targeting

Usage Data

• IP address, browser type, operating system
• Pages visited and time spent on our service
• Error logs and diagnostic information

Communications

• Email address if you contact our support team
• Support ticket content and correspondence

Facebook Page Information

When you connect a Facebook Page, ZayDM may receive:

• Facebook Page id and Page name
• Page access information necessary to provide the service, including a Page access token
• Published Page content metadata
• Post ids and media ids
• Content URLs and related metadata where applicable

We use this information to:

• Connect the Page you authorize
• Show Page content in ZayDM
• Run the automations you configure
• Publish content you submit
• Show analytics for that Page

Facebook Access Tokens

Facebook Page access tokens are used to communicate with Meta's APIs on behalf of the connected Page. Tokens are stored securely and protected using technical security controls, including encryption at rest, consistent with the protections described in this policy. We do not use a Page token to act for a Page you have disconnected.

Facebook Comments and Automations

When you use Facebook comment automations, ZayDM may process:

• Comment id and post id
• The commenter or user identifier supplied by Meta
• Comment text and comment timestamp
• Automation matching and delivery status

We use this information to:

• Detect the automation triggers you configure
• Determine all-post or selected-post and Reel targeting
• Send eligible private replies to personal-profile commenters
• Prevent duplicate processing
• Provide automation analytics

Messenger

When you use Messenger features for a connected Page, ZayDM may process:

• Page-scoped user identifiers supplied by Meta, such as PSIDs
• Inbound Messenger message text
• Message identifiers and timestamps
• Delivery results

We use this information to:

• Match Messenger automations you configure
• Send permitted responses
• Enforce messaging restrictions
• Prevent duplicate sends
• Provide automation results

ZayDM does not use this data to send unsolicited Facebook broadcasts.

Facebook Content Publishing

When you create or schedule Facebook Page content, ZayDM may process:

• Captions and other text you submit
• Media metadata and URLs
• Publishing status and schedule time
• Meta post and media identifiers
• Publishing errors and results

We use this information to create, schedule, publish, and monitor Facebook Page content you ask ZayDM to handle, including text posts, photo posts, video posts, Reels, and photo or video Stories.

Facebook Analytics

ZayDM may process:

• Page insight metrics returned by Meta, such as followers, views, post engagement, and profile or Page views where available
• ZayDM automation performance metrics for your account

ZayDM may combine Meta-provided Page performance metrics with ZayDM automation results so the connected user can view analytics in the dashboard.

Facebook Webhooks

After you connect a Page and authorize the relevant features, Meta may send ZayDM webhook events for that Page. Those events can include supported comment events and Messenger events needed to run the automations you configure.

2. How We Use Your Information

We use your information to:

• Provide and operate the ZayDM automation service
• Send automated DMs and comment replies on your behalf via Instagram's official API
• Connect an authorized Facebook Page and provide the Facebook features you request, including comment automations, permitted Messenger replies, content publishing, and analytics
• Display analytics and performance data for your automations
• Improve, maintain, and develop our service
• Detect and prevent fraud, abuse, or violations of our Terms
• Send transactional emails (account updates, service notifications)
• Comply with legal obligations

Facebook data is used to provide, secure, troubleshoot, improve, and operate the features you requested. The same principle applies to Instagram data used to provide the Instagram features you requested.

We do not use your Instagram or Facebook data for advertising and we do not sell it to third parties.

3. Instagram and Facebook API Data & Meta Platform

ZayDM uses Meta's official Instagram API with Instagram Login. This means:

• We access your Instagram account only with your explicit permission
• We request only the minimum permissions needed: instagram_business_basic, instagram_business_manage_messages, instagram_business_manage_comments, instagram_business_content_publish, instagram_business_manage_insights
• We send messages only when triggered by a user interaction (a comment or DM) - we do not send unsolicited messages
• Your Instagram access token is stored encrypted and never exposed to third parties

Facebook Page features use Meta's official Facebook APIs. For those features:

• We access a Facebook Page only after an authorized user connects it
• We request only the Meta permissions necessary to provide the Facebook features you choose to use, such as connecting Pages, reading supported Page content, running automations, publishing content, messaging, and retrieving Page insights
• Page access tokens are used only to communicate with Meta on behalf of the connected Page and are stored securely
• Messenger activity is limited to permitted replies and the automations you configure. We do not send unsolicited Facebook broadcasts
• Meta may send webhook events for an authorized connected Page, including supported comment and Messenger events

By using ZayDM, you also agree to:

• Meta's Terms of Service
• Instagram's Terms of Use
• Meta's Privacy Policy
• Meta's Platform Terms

4. Data Sharing

We do not sell your personal data. We share data only with:

• Meta Platforms Inc. - as required to perform Instagram and Facebook API operations you authorize, such as reading engagement, sending permitted messages, publishing content, receiving webhook events, and retrieving Page insights
• Infrastructure providers - cloud hosting and database services (Railway, Vercel, Neon/PostgreSQL, Redis) under data processing agreements
• Payment processors - if you subscribe to a paid plan (Stripe), they receive only what is necessary for billing
• Legal authorities - if required by applicable law, court order, or to protect our legal rights

5. Cookies

We use cookies and similar technologies as follows:

• Essential cookies - required to operate the service (for example authentication / session cookies on the dashboard, and affiliate referral cookies where applicable)
• Preference cookies - remember dashboard settings (last up to 1 year)
• Analytics cookies (optional) - only after you choose Accept All or enable Usage & Improvements in Cookie Settings. We use Google Analytics 4 and PostHog on zaydm.com and dash.zaydm.com to understand how people use ZayDM. These are not advertising cookies and we do not sell personal data. Your choice is stored in a first-party preference cookie (`zaydm_analytics_consent`) and may be shared across our zaydm.com subdomains.
• Session recording - not offered in Cookie Settings and remains off by default. If ZayDM ever enables session replay in a controlled environment, it would require separate explicit recording consent in addition to analytics consent, use maximum privacy masking, and would not be used on private conversation content by default.

Choosing Essential Only keeps the service and security working without optional analytics. You can change or withdraw analytics consent anytime via Cookie Settings in the website footer or your dashboard account settings. Blocking all cookies in your browser may prevent you from using the dashboard.

6. Data Retention

• Your account data is retained while your account is active
• Instagram access tokens are refreshed automatically before expiry (60-day lifetime)
• A Facebook Page access token is kept while that Page remains connected and is cleared from active use when you disconnect the Page. Disconnecting a Page stops future Facebook API use, automations, and publishing for that connection. It does not, by itself, immediately delete every historical record for that Page
• Upon account deletion, your Instagram access tokens are revoked immediately, connected Facebook Page tokens are stopped from further API use, and all personal data is permanently deleted within 30 days
• Anonymized usage statistics (no personally identifiable information) may be retained for service improvement

7. Your Rights

Depending on your location, you have the right to:

• Access - Request a copy of the personal data we hold about you
• Correction - Request correction of inaccurate data
• Deletion - Request deletion of your account and all associated data
• Portability - Request your data in a machine-readable format
• Objection - Object to processing of your personal data
• Withdrawal - Disconnect your Instagram account at any time from Settings → Connections, and disconnect a Facebook Page from the Facebook area of the dashboard or from Settings → Connections where that Page is listed

To exercise these rights, email us at privacy@zaydm.com or use the self-service options in your dashboard.

8. Data Deletion

You can delete or limit your data in these ways:

1. Dashboard - Settings → Danger Zone → Delete Account
2. Disconnect Instagram - Settings → Connections → Disconnect
3. Disconnect a Facebook Page - from the Facebook area of the dashboard, or from Settings → Connections where that Page is listed. Disconnecting stops future Facebook API use for that Page, clears the active Page authorization used by ZayDM, stops future automation and publishing for that connection, and removes or disables webhook access where applicable. It does not immediately delete every historical record
4. Email - Send a request to privacy@zaydm.com. A request can cover data associated with a connected Facebook Page, as well as Instagram data

Full instructions at: zaydm.com/data-deletion

9. Security

We implement industry-standard security measures for Instagram data, Facebook data, and the access credentials used for both:

• Encryption at rest for all access tokens, including Facebook Page access tokens, and other sensitive data
• HTTPS/TLS for all data transmission
• No storage of raw credentials - tokens are encrypted before storage
• Regular security reviews of our infrastructure

No online transmission is completely secure. While we take strong precautions, we cannot guarantee absolute security of data transmitted over the internet.

10. Payments & Financial Data

• We do not store credit or debit card details on our servers
• Payments are processed by Stripe - a PCI-DSS compliant payment processor
• We receive only a billing confirmation and subscription status from Stripe

11. Third-Party Links

Our service may contain links to third-party websites. We are not responsible for their privacy practices. We encourage you to review their privacy policies directly.

12. International Data Transfers

Your data may be transferred to and processed in countries where our infrastructure providers operate. We take appropriate measures to ensure your data is protected in accordance with this policy.

13. Children's Privacy

ZayDM is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal information, contact us at privacy@zaydm.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email or in-app notification at least 14 days before changes take effect. The "Last updated" date at the top will always reflect the most recent revision.

15. Contact Us

DanZay FZE (operating ZayDM)

📧 support@zaydm.com
🌐 zaydm.com