Privacy policy

Last updated 30 September 2026

DMagical helps businesses and creators answer Instagram comments and messages, see which posts lead to sales, and make new content. This page explains what information that involves and what we do with it. It is written to be read, not skimmed past. If anything is unclear, write to support@dmagical.com.

Who we are

DMagical is operated by GTM Development Johansen, a Norwegian sole proprietorship, organisation number 937 103 794, Maristuen 3, 9011 Tromsø, Norway. We are the data controller for the information about our customers described below. You can reach us at support@dmagical.com.

Two kinds of people, two roles

Customers are the businesses, creators and agencies who sign up and connect an Instagram professional account. For their account, billing and usage information, we are the controller.

Their audience are the people who comment on a customer's posts or send them a message on Instagram. For that information, the customer is the controller and DMagical is their processor: we handle it only to do what the customer set up, on their instructions, under the data processing terms in our Terms. If you messaged a business that uses DMagical and want your data removed, you can ask that business, or write to us and we will help (see Data deletion).

What we collect

From customers

Account details: name, email address, a hash of your password (never the password itself), and your team members' names and emails if you invite them.
Billing: your plan, subscription status and invoices. Card payments are handled by Stripe; we never see or store full card numbers.
What you set up in DMagical: automations, messages, brand information you give the AI, links, templates, uploaded images and videos, and content you generate.
Sales you connect: when you connect Stripe, Shopify, Gumroad or send us sales yourself, we receive the amount, currency, time, product name, the buyer's email address where the source provides it, and the reference we added to the link. We use this only to show which post, automation and conversation led to the sale.
Technical data: sign-in times, a keyed hash of the IP address used (not the address itself), browser type, and error logs.

From Instagram, after a customer connects their account

The connected account's username, name, profile picture, follower count and account type.
The account's posts, reels and ads: captions, links, thumbnails, like and comment counts.
Comments on those posts: the comment text, time, and the commenter's Instagram-scoped ID and username.
Direct messages with the account: text, attachments, voice notes, reactions and button taps, plus the sender's Instagram-scoped ID, name, username, profile picture, follower count and whether they follow the account, where Instagram provides them.
Answers people give inside an automation, such as an email address they chose to share.

From people who tap a link sent by DMagical

The time of the tap, the link, a keyed hash of the IP address, and the browser type. Link previews made by apps and crawlers are recognised and not counted.

Why we use it, and on what legal basis

Purpose	Legal basis (GDPR)
Running the service you signed up for: sending the replies you configured, showing your inbox, counting results	Contract (Art. 6(1)(b)); for audience data, on the customer's instructions as processor (Art. 28)
Billing, invoices and bookkeeping	Contract and legal obligation (Art. 6(1)(b) and (c))
Keeping accounts secure, preventing abuse and spam, fixing errors	Legitimate interest (Art. 6(1)(f))
Emails about your account, your connection and your plan	Contract (Art. 6(1)(b))
Understanding how the product is used, only in aggregate	Legitimate interest (Art. 6(1)(f))

We do not sell personal data. We do not use it for advertising. We do not use customers' Instagram data or conversations to train AI models.

Instagram data

DMagical connects through Meta's official Instagram API, only after a customer signs in with Instagram and grants permissions. We use Instagram data only to provide the features the customer turned on, in line with Meta's Platform Terms and Developer Policies. A customer can disconnect at any time in DMagical, or remove DMagical in Instagram (Settings, Apps and websites). Removing it there stops all access immediately and starts deletion of that account's data.

AI features

When a customer turns on AI replies, voice note transcription, or content ideas, the relevant conversation text, voice note audio or post captions are sent to an AI model provider or a speech-to-text provider working as our processor, to produce the reply, transcript or idea. These providers may not use the data to train their models and delete it on a short schedule. Images and videos created in the Studio are made by a generation provider working as our processor, from the prompt and any reference images the customer supplies. Customers decide whether these features are on.

Who processes it for us

We use a small number of service providers, each bound by a data processing agreement and allowed to use the data only to provide their service to us:

Meta Platforms (Instagram API), which is how comments and messages reach us and how replies are sent.
Stripe, for payments and invoices.
A cloud hosting provider, for our servers in the European Union.
A network security and delivery provider, which protects the site and carries traffic to it.
An email delivery provider, for account and report emails.
An AI model provider, a speech-to-text provider, and an image and video generation provider, only when the related feature is used.

You can ask us for the current list of named providers at support@dmagical.com.

Where it is stored

Our database and files are stored on servers in the European Union (France). Some providers above are based in the United States. Where data leaves the EEA, the transfer relies on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

How long we keep it

Customer account data: while the account is open, and deleted within 30 days after it is closed, except invoices, which Norwegian bookkeeping law requires us to keep for 5 years.
Instagram comments, conversations and contacts: while the Instagram account stays connected. A conversation with no activity for 12 months is deleted automatically. When an account is disconnected and the customer asks, or when DMagical is removed in Instagram, that account's data is deleted.
Link taps: 13 months.
Backups: encrypted, kept for 14 days, then overwritten.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Write to support@dmagical.com; we answer within 30 days. If you are part of a customer's audience, we will pass your request to the business you interacted with and help them answer it. You can also complain to the Norwegian Data Protection Authority (Datatilsynet) or the authority where you live.

Cookies

We use one cookie that keeps you signed in to the app. It is strictly necessary, so there is no banner. We use no advertising or cross-site tracking cookies.

To see which parts of this website are read, we count page views, how far a page is scrolled, which sections are seen and which buttons are pressed, on our own server and without cookies. Nothing is stored on your device. Instead of your IP address we keep a code made from the date, your IP address and your browser, which changes every day, so a visit cannot be connected to you or to another day. We also keep the referring website, any campaign tags in the link, your country and whether the device is a phone. These counts are deleted after 13 months. Legal basis: our legitimate interest in knowing whether the site explains DMagical well (Art. 6(1)(f)).

Children

DMagical is a tool for businesses and creators aged 18 or over. Customers must not use it to target messages at children.

Changes

If we change this policy in a way that matters, we will email customers before the change takes effect. The date at the top shows the latest version.