Privacy Policy

Last updated: October 15, 2026

RickshawDM ("we", "our", "the app") is a reply-automation platform that connects to your Facebook Page and/or Instagram professional account to automatically reply to direct messages and to comments on your own posts, based on rules you configure. This page explains what information we collect, how we use it, and how you can control it.

Information We Collect

• Your RickshawDM account: your email address, an optional name, and your password, which we store only as a one-way hash.
• Account credentials: When you connect a Facebook Page or Instagram account, we store the access token issued by that platform so we can send replies and manage your connection on your behalf.
• Page/account details: the Page or Instagram account ID and its name or username, used to identify the connection and route incoming events to it.
• Message content: Incoming direct messages (sender ID, sender name, message text, and the platform's raw event payload) are stored so that auto-reply rules can be matched and a history of conversations can be shown to you.
• Comment content: When someone comments on a post of your connected account, we receive the comment ID, the comment text, the commenter's ID and name or username, and the post ID. For comments that match one of your Comment to DM rules, we store these details so the rule can answer each commenter only once and so you can see the result in your Comment Log.
• Follower check: If you turn on "Require follower" for a comment rule, we ask Instagram whether the commenter follows your account and store the yes/no result with that comment's log entry.
• Your posts: When you create a comment rule, we load your account's own recent posts (image or thumbnail, caption and date) so you can pick which posts the rule watches. These are shown to you while you build the rule and are not stored; we store only the IDs of the posts you select.
• Reply activity: Records of which rule matched a message or comment and what reply was sent, so you can review your automation's performance.
• Billing: If you subscribe to a paid plan, our payment provider (Razorpay) processes your payment. We receive and store your plan, subscription status and payment events, but never your card or bank details.

How We Use Information

• To authenticate and maintain your connection to Facebook and Instagram.
• To receive incoming messages and comments via webhooks and match them against your rules.
• To send the replies you wrote, as your Page or account, through the connected platform's API: direct-message replies, one private reply per matching comment, and optional public comment replies.
• To display message history, reply logs and comment logs within your account dashboard.
• To apply your plan's limits and manage your subscription.

We do not use this data for advertising or profiling, and we only process it to run the features you configure.

How We Share Information

We do not sell or rent your information, and we do not share it with advertisers or data brokers. Messages and replies are sent only to the relevant platform (Meta: Facebook or Instagram) to deliver your automated replies. We use service providers that process data on our behalf only to run the app: our hosting provider, our database provider, and Razorpay for payments.

Data Retention & Deletion

We keep your data while your account is active. You can delete it at any time:

• Disconnect an account: in Settings, click the trash icon next to a connected account and choose Disconnect. This immediately deletes its access token and the messages, comments, comment rules and logs linked to it.
• Delete your whole account: email kb@thekbdigital.com from the address you sign in with. We delete your account and all its data within 30 days, except payment records that tax and accounting law requires us to keep.

Step-by-step instructions, including how to remove our app from Facebook and Instagram, are on our data deletion page.

Security

Data is sent over encrypted HTTPS connections. Access tokens and other data are stored in an access-controlled database that our hosting provider encrypts at rest, and are used only by our servers to communicate with the connected platform's APIs. Passwords are hashed, sessions use signed cookies, and webhook events from Meta are verified with Meta's signature before we process them.

Contact Us

If you have questions about this Privacy Policy or wish to request access to or deletion of your data, contact us at kb@thekbdigital.com.