This policy explains, in plain language, what data DMpro handles, why, where it goes, and what control you have over it. It covers our Chrome extension, the dashboard at dmpro.app, and all related APIs operated by Ainfluencer Inc.
DMpro is operated by Ainfluencer Inc., a corporation registered in Ontario, Canada. DMpro is part of the brandID family of products. For the purposes of GDPR, we are the data controller for the personal data we process about you through this Service.
| Legal entity | Ainfluencer Inc. |
|---|---|
| Registered office | Toronto, Ontario, Canada |
| Privacy contact | privacy@dmpro.app |
| Data Protection Officer | Reachable at the email above (mark the subject "Attn: DPO") |
We collect the minimum information we need to run the Service. Categories and examples:
| Category | Examples | Why |
|---|---|---|
| Account | Email address, display name, country code | Authentication, addressing you in product |
| Signup context | Source (extension vs. web), hashed IP, user agent, UTM tags | Anti-abuse, fraud detection, attribution analytics |
| Onboarding answers | Primary platform, persona, business type, target audience, optional Instagram/TikTok handle | Personalize defaults and AI prompts |
| Generated content | AI prompts you save, AI messages we generate for you | Provide the core feature and let you reuse what works |
| Profile data you target | Public Instagram or TikTok profile of recipients (username, bio, follower count, post count) | Personalize the AI-generated message. Read from the page you have already opened. |
| Send activity | DMs sent, campaigns, timestamps, success/failure status | Operate the Service, prevent duplicate sends, bill correctly |
| Billing | Plan tier, credits, transaction history, invoice IDs. Full card data is held by Stripe, not by us. | Process payments and provide receipts |
| Platform identifiers (new) | Instagram ds_user_id and TikTok uid_tt cookie values. See section 8. |
Abuse prevention only. Never used for advertising or third-party sharing. |
| Communications | Email preferences, support tickets, replies | Send transactional emails and respond to you |
Under GDPR Article 6, we rely on the following lawful bases:
| Purpose | Lawful basis |
|---|---|
| Operating the Service, generating AI messages, sending DMs on your behalf | Performance of contract (Art. 6(1)(b)) |
| Transactional emails (verification codes, receipts, account notifications) | Performance of contract (Art. 6(1)(b)) |
| Product update emails and tips | Consent (Art. 6(1)(a)). You opt in at signup and can withdraw anytime. |
| Abuse prevention, fraud detection, security monitoring | Legitimate interest (Art. 6(1)(f)) |
| Compliance with tax, accounting, and legal obligations | Legal obligation (Art. 6(1)(c)) |
We do not use your data for automated decision-making that produces legal or similarly significant effects on you. The abuse-prevention fingerprint described in section 8 may restrict access to free credits but does not affect your ability to use paid subscriptions.
DMpro generates personalized direct messages using a third-party large-language-model provider (currently OpenAI). When you click Generate, we send the following to OpenAI:
We do not send your email, your billing data, or your recipient's private content (DMs they sent you, stories, etc.). OpenAI processes the request under their API data usage policies, which prohibit using API content for model training. Generated messages are stored on our servers so you can re-use, edit, or audit them.
You can connect an AI app of your choice (for example Claude, ChatGPT, Cursor or VS Code) to your DMpro account with the Model Context Protocol (MCP). You sign in on DMpro's own page and choose what the app may see and change; the app never receives your email code, your payment details or your sign-in. While it is connected, the AI app receives the DMpro data it asks for within what you allowed (for example your prompts, campaigns, creators you revealed and usage reports), and the company that runs that app processes it under its own terms and privacy policy. You can see every request, pause every app, and disconnect an app at any time in DMpro, AI Assist (MCP).
We do not sell your personal data. We share it only with the limited set of sub-processors listed below, and only as needed to run the Service. All are bound by data-protection agreements and limit processing to our instructions.
| Sub-processor | What they do for us | Where they process |
|---|---|---|
| Stripe | Payment processing, hosted checkout, card storage | United States (with SCCs for EU transfers) |
| OpenAI | AI message generation. See section 4. | United States |
| MongoDB Atlas | Primary database (account, generated messages, send activity) | Region you signed up from (EU or US) |
| Mailgun / transactional email provider | Verification codes, receipts, account emails | United States |
| Cloud hosting | Application servers, CDN, backups | Multi-region, primarily EU and US |
Beyond the list above, we may disclose information when legally required (subpoena, court order, lawful government request) or to protect rights, safety, or property. We will challenge disclosure requests that are overbroad or non-binding where it is lawful to do so.
We use cookies and local storage for two purposes only: keeping you signed in and preventing abuse. We do not use advertising cookies, third-party tracking pixels, or cross-site identifiers.
| Name | Purpose | Lifetime |
|---|---|---|
dmproToken (localStorage) | Auth session | 30 days, or until logout |
onboarding_* (localStorage) | Remember your onboarding progress so you can resume | 90 days |
__cf_bm | Cloudflare bot mitigation (operational, set by hosting) | 30 minutes |
The extension uses chrome.storage.local for the same auth token and your preferences (auto-DM toggle, default send delay, last-used prompt). It does not set any cookies on websites you visit.
The extension reads two specific cookies set by Instagram and TikTok themselves on their own domains. We never set cookies on those sites and never read any other cookies they set. Full details in section 8.
The DMpro Chrome extension requests these permissions. Each maps to a user-visible feature.
| Permission | Why we need it |
|---|---|
storage | Hold your auth token and preferences in chrome.storage.local |
scripting | Inject the message composer into Instagram's and TikTok's own DM interface so the Send button works inside their UI |
tabs | Detect when you are on a supported Instagram or TikTok profile page |
activeTab | Read the profile you are viewing when you click the DMpro icon (username, public bio, public follower count) to personalize the AI message |
sidePanel | Render the DMpro composer as a Chrome side panel next to Instagram or TikTok |
alarms | Schedule the 30-second campaign-progress poll and hourly abuse-fingerprint re-check |
webRequest | Detect Stripe payment-success redirects so the credit balance refreshes automatically. We do not block or modify any request. |
cookies | Read only ds_user_id from Instagram and uid_tt from TikTok for abuse prevention. See section 8. |
To keep our free tier and trial period sustainable, we need to detect when the same Instagram or TikTok account is being used to create multiple DMpro accounts. We do this by reading two specific cookies:
| Cookie | Set by | What it is |
|---|---|---|
ds_user_id | instagram.com | Your numeric Instagram user ID (the same ID Instagram uses for your profile internally) |
uid_tt | tiktok.com | Your TikTok user identifier |
Both cookies are marked HttpOnly by Instagram and TikTok, which is why our extension must use the Chrome cookies permission to read them.
We do not read any other cookies from these sites. We do not modify or set cookies. We do not transmit these values to anyone other than DMpro's own backend over HTTPS,
where they are stored solely to compare against fingerprints from prior signups.
If the Instagram or TikTok account you are currently logged into has already been used by a different DMpro email address, your new DMpro account will not receive free generation credits and will not be eligible for the free trial period. You can still subscribe to a paid plan at any time, which is unaffected. You can see your current fingerprint state in the extension header or the dashboard admin view.
| Data category | How long we keep it |
|---|---|
| Account, generated messages, prompts | For the life of your account, plus 90 days after deletion request |
| Send activity, campaign stats | 24 months (rolling), then aggregated and anonymized |
| Billing records, invoices, tax records | 7 years (legal obligation, Canadian and most other jurisdictions) |
| Hashed IPs from signup and login | 12 months (fraud and abuse-detection lookback window) |
| Abuse-prevention fingerprints | 24 months from last detection |
| Support tickets and email correspondence | 3 years after the ticket closes |
| Requests made by AI apps you connected (AI Assist) | 12 months |
| Requests that waited for your approval, with what they gave back | 180 days |
| AI app connections | Until you disconnect the app or it ends (90 days at most, or 30 days unused), then kept as ended for your history; deleted with your account |
We use industry-standard safeguards:
No system is perfectly secure. If we learn of a breach affecting you personally, we will notify you in line with applicable law (GDPR Art. 34 within 72 hours of awareness where required).
Your data may be processed in countries other than where you live, including Canada (our home base), the United States (where some sub-processors operate), and the European Union (where we operate some infrastructure).
Where required, we use European Commission Standard Contractual Clauses (SCCs) or rely on adequacy decisions (Canada has an EU adequacy decision for commercial data). For UK personal data, we use the UK International Data Transfer Addendum.
If you are in the EEA, UK, or Switzerland, you have the right to:
To exercise any of these rights, email privacy@dmpro.app. We respond within 30 days (usually within 3 business days) and may need to verify your identity first.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (as amended by the CPRA):
To submit a verifiable consumer request, email privacy@dmpro.app. Authorized agents may submit requests on your behalf with written authorization.
We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial equivalents. Our commercial email practices comply with Canada's Anti-Spam Legislation (CASL):
DMpro is a B2B outreach tool and is not directed to anyone under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, contact us and we will delete it promptly. Many jurisdictions set a higher age (18 in some); we comply with whichever applies.
We may update this policy occasionally. When we do, we bump the version number and update the "Last updated" date at the top. Material changes (new categories of data, new sub-processors, new disclosure purposes) are announced in-product and by email if you have an active account. Continued use of the Service after the effective date means you accept the revised policy.
| Privacy questions | privacy@dmpro.app |
|---|---|
| Data subject requests (access, delete, port, correct) | privacy@dmpro.app with subject "Data Request" |
| Security disclosures | security@dmpro.app |
| General support | support@dmpro.app |
| Postal mail | Ainfluencer Inc., Toronto, Ontario, Canada (full address available on request) |
| Version | Date | What changed |
|---|---|---|
2.0 |
October 19, 2026 | Added "AI apps you connect (AI Assist, MCP)" to section 4 and its rows to the retention schedule. |
2.0 |
June 18, 2026 | Full rewrite. Added sub-processor list, AI/OpenAI disclosure, abuse-prevention fingerprint section (Instagram ds_user_id and TikTok uid_tt), browser permissions table, GDPR Article 6 lawful-basis grid, CCPA/CPRA section, PIPEDA/CASL section, retention schedule, version history. |
1.0 |
May 22, 2026 | Initial release. |