Updated 3 November 2026

Data Deletion

You can request erasure of your DMFlow data directly or through Meta. A dashboard account is not required.

1. Request by email

Write to [email protected], preferably with the subject “DMFlow – data deletion”. Include your Instagram profile, any email used, an approximate interaction and the scope of your request. Send only necessary information.

2. Request through Meta

If Meta offers an app data deletion request, you may use it. The server accepts the signed Meta callback at /data-deletion/callback. It returns a confirmation code and a unique status link. This confirms receipt, not immediate completion of erasure.

We do not automatically treat the Facebook ASID in the callback as an Instagram IGSID. The controller verifies identity and the correct record links first and may request proportionate clarification. A request is not left unreviewed merely because automatic identity mapping is unavailable.

3. Verification and deadline

Where there are reasonable doubts, we verify that the request concerns your own data, for example through confirmation from the relevant profile or address. We request only proportionate information and never passwords or access tokens. Do not send original identity documents without first agreeing a necessary, secure verification method.

We handle requests without undue delay. Our SLA is 30 calendar days from receipt; where the statutory one-month GDPR deadline ends earlier, the shorter deadline applies. Only in legally permitted cases involving complexity or a high number of requests may this be extended by up to two further months. We explain the reasons and extension within the original deadline. If a request cannot be granted, we explain why and how to complain.

4. What is deleted and what may remain

• Full erasure removes linked contact details, email, IGSID/username and available content/metadata attributable to you, and ends pending conversations and jobs. Related technical links and the deletion request are also considered.
• Ordinary deletion of a contact in the dashboard retains minimum HMAC records for re-messaging and abuse prevention. These are not anonymous and are not automatically exempt from full erasure. A valid full request also removes linkable HMAC records and other links unless retention is expressly required by law.
• Aggregate statistics that can no longer be associated with a person and data necessary for a specific legal obligation may remain. We explain any statutory reason, scope and retention period; retained records are not used for further outreach.
• Erasure in DMFlow does not delete original comments, posts or conversations from Instagram/Meta systems. Manage those records with the relevant platform as well.

5. Request status

Open the link returned by Meta or enter your confirmation code on the request status page. For an email request, reply in the same email thread for an update; a confirmation code is supplied if the request is recorded in the callback system. Keep the code and unique link private.

See the Privacy Policy for more detail and rights. You may complain to the ÚOOÚ.