Privacy Policy

DMKaro is operated by World X Growth Official (MSME-registered partnership firm, India) — "we", "us". This policy explains what personal data we collect when you use our website, web app and mobile app (the "Service"), why we collect it, and your rights under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

1. Data we collect

Account data

• Name, email address and a password stored only as an Argon2id hash — or, if you sign in with Google, your Google account ID, name and verified email (we never see your Google password).
• Mobile number, verified once by an OTP sent via SMS/WhatsApp before you create your first automation (when this check is enabled).
• Consent record: the date and time you accepted our Terms and this Policy, the version you accepted and the IP address used — kept as proof of consent.

Verification codes: one-time codes (email or SMS) are stored only as secure hashes and expire within minutes.

Instagram & Facebook data (via Meta's official API): your professional account / Page ID, username, profile picture, follower count, posts and Reels list, the comments and messages related to the automations you create, and an access token issued by Meta. We never ask for your Instagram or Facebook password.

People who interact with you: their platform-scoped ID and username and — only if they choose to share it in the chat — their email or phone, so you can see your leads.

Usage & device data: link clicks from DMs (with a hashed IP), browser type, pages used, and security logs.

Payment data: handled by our payment partners (Razorpay, Cashfree, Instamojo). We store only the transaction reference, amount and status — never card, UPI or bank details.

2. Why we use it

• To create and secure your account, verify that you are a real person, and prevent fake or duplicate registrations.
• To run the automations you configure, show analytics, and process payments.
• To send service messages: verification codes, welcome and account emails, payment receipts and important updates.
• To detect fraud and abuse, and to comply with law.

We do not sell your data, and we do not use Instagram/Facebook data for advertising. Marketing emails can be switched off at any time.

3. Legal basis

We process your data on the basis of the consent you give at sign-up (which you can withdraw at any time) and, where applicable, the legitimate uses permitted by the DPDP Act, 2023 — for example, to provide a service you asked for or to comply with law.

4. Who we share it with

Only with service providers that help us run the Service, under confidentiality obligations:

• Hosting and database providers
• Email delivery (SMTP) and SMS/OTP delivery providers (such as apitxt.com)
• Google (if you use Google sign-in) and Meta (to run Instagram/Facebook automations), under their own terms
• Payment gateways, for payments

We may disclose data when required by law, a court order or a government authority.

5. Cookies

We use one essential, secure, http-only session cookie to keep you logged in, and a short-lived cookie during Google sign-in. We do not use third-party advertising cookies.

6. Retention

We keep your data while your account is active. When you delete your account, we delete your account data, tokens, automations and contacts. Payment records and the consent record may be kept as long as the law requires (for example, tax and accounting rules), and security logs for a limited period.

7. Your rights

You can access a summary of your data, correct or update it, delete your account (Settings → Delete account), disconnect Instagram/Facebook at any time, withdraw consent, nominate another person to exercise your rights, and raise a grievance. See Data deletion.

8. Security

HTTPS everywhere; access tokens and API keys encrypted at rest (AES-256-GCM); passwords hashed with Argon2id; one-time codes hashed and rate-limited; least-privilege access for staff. No system is 100% secure, but we work hard to protect your data and will notify you and the authorities of a breach as required by law.

9. Children

The Service is for people 18 years or older. We do not knowingly collect children's data.

10. Changes

If we change this policy materially, we will update the date above and ask you to accept the new version.

11. Grievance Officer & contact

Grievance Officer, World X Growth Official — [email protected]. We acknowledge complaints within 48 hours and aim to resolve them within 30 days. You may also approach the Data Protection Board of India.