Updated 3 November 2026

Terms of Use

Operator and data controller

Name / legal name: Karel Matusiak
Address: U Hřiště 267/16, 747 71 Brumovice
Czech registration number (IČO): 30210453
E-mail: [email protected]

These terms govern use of the DMFlow dashboard by the Instagram account operator and authorized members. Receiving a message or opening a legal page does not make a recipient a dashboard user or constitute marketing consent.

1. Authorized use

Use only professional accounts you are entitled to manage and grant members only necessary access. You are responsible for content, destination links, automation settings and lawful processing. When operating for a client, identify the actual controller/processor roles and enter into the required GDPR Article 28 agreement.

2. Meta and communication rules

You must comply with the current Meta Platform Terms and other applicable Instagram rules. Do not circumvent messaging windows, limits, permissions, app review or deduplication. DMFlow uses the official API and does not authorize conduct prohibited by Meta or law.

3. Prohibited use and spam

Spam, unlawful unsolicited commercial messages, or contacting purchased or otherwise unauthorized lists.
Deceptive links, phishing, malware, harassment, discrimination or unlawful content.
Scraping, collecting passwords, unauthorized access, token sharing or bypassing security controls.
Using a supplied email for further marketing without a separate lawful basis and the applicable compliance steps.

4. Availability and liability

Delivery depends on Meta, Cloudflare, permissions and network availability. Continuous availability, immediate delivery, commercial results and Meta approval are not guaranteed. The operator must review uncertain delivery and handle rights requests; automation does not replace that oversight.

To the extent permitted by law, the operator is not liable for outages or changes of independent platforms or misuse of the service. This does not exclude or limit liability that cannot lawfully be limited, including intentional conduct or gross negligence, harm to fundamental personal rights, mandatory consumer rights or GDPR Article 82 claims.

5. Privacy and ending use

Data practices and retention are described in the Privacy Policy, and requests in Data Deletion. Disconnecting Instagram stops further automated sending but does not itself erase all historical data. The owner may remove a member whose authority ends or who breaches these terms.

6. Governing law and contact

These terms are governed by the law of the Czech Republic. This choice does not remove mandatory consumer protection or other non-waivable rights under applicable EU or national law. Direct questions and claims to the operator identified above.

Disconnecting, opting out and human replies

You can disconnect Instagram in Settings or revoke the app’s permissions at Meta. A verified deauthorization callback disconnects the matching account, invalidates tokens, pauses live rules and cancels pending sends. Disconnecting does not erase historical data; use the erasure procedure above for full deletion.

A recipient can send STOP, ODHLÁSIT, ODHLASIT, UNSUBSCRIBE or STOP AUTOMATION, ignoring case and diacritics. We cancel their queued automated messages and private comment replies and may send one confirmation within the valid 24-hour window. Only a subsequent START or ZNOVU from that person re-enables automation. An owner’s manual resume does not override this opt-out.

When we detect a human message from the business account, automation pauses for that conversation for 24 hours by default; the owner can configure the duration. An authorized owner or editor can also pause or resume it manually. An outgoing message does not open a new 24-hour messaging window.

Phone numbers and optional webhooks

If you enable phone capture, a recipient may voluntarily send a phone number after the email step. We validate E.164 format, add +420 to a nine-digit Czech number and encrypt stored phone numbers. Authorized members can access them in Contacts, CSV and an export webhook you enable. The same purposes, lawful bases, necessity reviews and erasure rights apply as for other contact details. Sharing a phone number is not consent to advertising or an SMS campaign.

The owner can configure HTTPS webhooks for contact capture, conversation completion and opt-out. A captured contact may include a voluntarily supplied email and phone; an opt-out carries only a pseudonymous key and status. You choose the recipient, such as your Zapier or Make endpoint, and must check authorization, security, processing terms and any international transfers. Pending bodies and signing secrets are encrypted, requests are signed and history is limited to seven days. Deleting a contact stops pending transfers and removes their stored payload; you must arrange deletion of data already delivered to a recipient.

We do not sell data or use it for advertising. Use it only for an authorized purpose under the Meta Platform Terms, Instagram policies and applicable law. DMFlow does not replace those rules or any required consent.