Privacy Policy

Who we are

DMKatalog (DMKatalog) provides a software service that automatically answers the incoming messages and comments of businesses selling on Instagram, using their product catalogs.

The distinction between roles matters. The seller who owns the Instagram account is the data controller for their customers' personal data. DMKatalog processes this data only on the seller's behalf and on the seller's instructions; in other words, it is a data processor (KVKK Art. 3, GDPR Art. 28).

What data we process

Seller (our customer) data:

• Email address (for signing in; we don't store passwords, sign-in works with a one-time link)
• Email addresses of team members the seller adds to the dashboard (for signing in and notifications)
• Instagram username and account ID
• Instagram access token, encrypted (AES-256-GCM); never stored in plain text anywhere
• Product catalog, store information text and order records
• IBAN and account holder's name, if the seller accepts payment by bank transfer
• Telegram chat ID, if the seller has chosen to receive notifications on Telegram

Data belonging to the seller's customers:

• Instagram user ID (IGSID), username, display name if any, and profile photo URL
• The content and time of the messages they send; the text of their comments on posts. If a customer writes their delivery address in a message, the address remains in the message content.
• The replies sent by the automated assistant
• If the seller connected an ikas, Ticimax or Shopify store: the number, products, amount and status of store orders placed through a product link sent in DMs; this information is matched with the conversation. The customer's name, address, phone number and email are not stored; if the platform's response includes them, they are discarded without being read.

Data such as location, payment card details or ID numbers is not collected. We do not collect payments; we only pass on the payment link or bank transfer details (IBAN and reference code) set by the seller. Addresses are not written to order records.

Why we process it

The sole purpose is the service itself: generating replies to incoming messages from the seller's catalog, showing conversations in the dashboard so the seller can take over, and keeping an order record when payment details are sent. The legal basis is the performance of the contract between the seller and us.

If the seller connected an ikas, Ticimax or Shopify store, showing the seller the store orders placed through links in DMs is also part of the service.

We do not use the data for advertising, we do not sell it and we do not pass it on to third parties for marketing. AI models are not trained on this data.

Who we share it with

• Meta Platforms: messages are sent and received through Instagram.
• AI provider (OpenAI): when AI is used to generate a reply, the latest messages of the conversation concerned, the seller's catalog and the store information are sent. To read the products, the catalog text the seller pastes and Instagram post captions are also sent. To recognize the product, the photo a customer sends, the image of a post they share and the image of a story they reply to or tag the store in are also sent. The provider does not use this data to train models.
• Hosting (Narhost (Türkiye)): the servers where the data is stored.
• Cloudflare: domain, encrypted connection and traffic routing; bot check on the application form (Turnstile); site visits are counted in aggregate, without cookies.
• Email delivery provider: sign-in and application confirmation links, and notification emails.
• Telegram: if the seller has chosen to receive notifications on Telegram; notifications include the customer's username and the status of the conversation.
• The seller's e-commerce platform (ikas, Ticimax, Shopify): the seller's catalog and the orders that came from DMs are read from this platform; product links in DMs carry a code showing which conversation an order came from.

Apart from these, no data is transferred to any third party. Some of these providers are located outside Türkiye.

How long we keep it

• Message content: 90 days. Older messages are deleted by an automatic cleanup that runs every day.
• Conversations: a conversation with no messages at all for 90 days is deleted entirely.
• Order records: kept to meet commercial and financial obligations; when the related conversation is deleted, they are stripped of personal data (the link to the customer is removed; only the product, amount and date remain).
• Store orders: same rules as order records; when the related conversation is deleted, the link to it is removed.
• Raw platform notifications: 30 days (for debugging and auditing).
• Pilot applications: 7 days if the email address isn't verified, 6 months if it is (details in the Application privacy notice).
• Seller account: until the account is closed; deleted within 30 days of closure.

Your rights and deleting your data

Under KVKK Art. 11 and the GDPR, you have the right to access, correct and delete your data and to object to its processing.

You can ask for your data to be deleted in three ways:

• Through Instagram: when you remove the app's access in your Instagram settings, Meta automatically sends us a deletion request; we give you a confirmation code and a status page.
• Through the seller: the seller can start the deletion of your data from their dashboard.
• By writing to us directly: [email protected]

Requests are processed within 24 hours at the latest; your conversation, message and comment records are deleted. You can check the status of your request on the status page with the confirmation code you were given.

Automated messaging

When you write to a seller's account, the replies may be generated by automated software working on the seller's behalf. At any time, if you write “dur” (Turkish for “stop”), or one of the words “mesaj atmayın”, “stop” or “rahatsız etme”, we stop sending you automated messages; the request takes effect immediately. If you want automated replies again, just write “DEVAM” (Turkish for “continue”).

Security

• All traffic is encrypted over HTTPS.
• Instagram access tokens are stored encrypted in the database with AES-256-GCM.
• Platform notifications are not processed without signature verification.
• Sellers sign in without a password; they receive a one-time link that is valid for 15 minutes. The link that confirms a pilot application is also single-use and valid for 24 hours.
• The database is backed up daily.

Cookies and information stored in your browser

The dashboard uses two functional cookies (dmk_lang and dmk_theme, 1 year) to remember your chosen language and appearance (light, dark or your system setting). To keep you signed in, your sign-in key is stored in your browser's local storage and deleted when you sign out. No advertising, tracking or analytics cookies are used.

Changes and contact

If this policy changes significantly, we will notify sellers by email. For questions: [email protected] · —