Privacy, terms and data deletion

Privacy policy

This part explains what YallaDM receives, what it keeps, who else handles it, how long it is kept, and how to have it deleted. Each business that uses YallaDM decides which of its posts YallaDM answers and what it sends. YallaDM handles the data below only to do that.

Who this policy covers

• Businesses that connect an Instagram professional account or a Facebook Page to YallaDM.
• People who comment on or message those accounts.

What YallaDM keeps about a business

• The Instagram account id, and the access token Meta issues when the account connects, with the date it expires. The token is what lets YallaDM reply as that account.
• The email address of the person who connected the account. That address is who YallaDM treats as the owner of the account, and where YallaDM writes if the account needs reconnecting.
• The business's Instagram handle, so its account is named on screen instead of shown as a number.
• The date the account connected, and the date it disconnected if it has. The disconnect date is what starts the 30 day deletion below.
• The replies the business sets up: which posts they apply to, the keywords that trigger them, the wording of the private and public replies, and the links they send.
• Records about a business and the people who comment on its posts are tagged with the business they belong to, so one business's records are kept apart from another's.
• The numbers the business exported from the tool it used before YallaDM, for a post YallaDM now answers, so it can compare the two.

If a business connects Claude

A business can connect Claude, Anthropic's AI assistant, to YallaDM, so Claude can walk it through setup and copy its automations over from the tool it used before. When it does, YallaDM keeps:

• The email address of the person who approved the connection, as Cloudflare confirmed it at sign in. It decides which businesses Claude can see.
• Hashed copies of the codes and tokens issued to Claude, never the codes and tokens themselves. Each one expires within 30 days of its last use, and expired ones are deleted.

Through that connection Claude can read the business's connected accounts, its posts and their captions, its automations, counts of what YallaDM did, and the business's own public replies. It can save automations as drafts, and change the wording of a live automation after the person in the chat has read the new wording and said yes. It cannot put an automation live, send a message, disconnect an account or delete anything. It is never given an access token, and never told who commented or what they wrote: the most it receives from comments is a single word that at least three different people commented, offered as a guess at a keyword.

If a business connects a Facebook Page

YallaDM keeps the same kinds of records for a Facebook Page as for an Instagram account, with these differences:

• For the business: the Page's id and name, and the access token Meta issues for the Page, in place of the Instagram account id, handle and token.
• For a person who comments on the Page: the id Facebook gives YallaDM for you, which is specific to YallaDM, and the name Facebook shows with your comment, in place of an Instagram scoped id and username. Everything else under the next heading applies the same way.
• On a Page, YallaDM sends what you asked for straight away, in one Messenger message. There is no follow check and no button to tap.

What YallaDM keeps when you comment

YallaDM only reads comments on posts where the business has turned it on. Comments on other posts are not kept.

If your comment contains one of the business's keywords, YallaDM keeps:

• Your Instagram scoped id. This is a number Instagram gives YallaDM to tell people apart. It is not your account id, and other apps see a different number for you.
• Your Instagram username.
• The id of your comment, the id of the post, when you commented, and whether your comment was in Arabic or English, so the reply under it can be in your language. Not the words themselves.
• Whether YallaDM's reply to you was sent, is waiting to be sent, or failed, and how many times a send's outcome was unclear.

If your comment doesn't contain a keyword, YallaDM keeps only the first 80 characters of it and the comment's id, without your scoped id, so a keyword that should have matched can be spotted and added.

What YallaDM keeps once it has messaged you

Once YallaDM has messaged you, whether you tap a button in that message, write back, or do neither, YallaDM keeps:

• When you last wrote, which request is open, when YallaDM sent you what you asked for, and whether you got it by tapping a button, writing back, commenting again, or straight away in YallaDM's first reply to your comment.
• If the business asks people to follow it first, which step of that request you're on. YallaDM checks whether you follow when you tap, write back, or comment again while already talking with it, though a reply that arrives before YallaDM's last message gets no check. It doesn't keep the answer on your record, but the activity log below holds how each check turned out.
• The ids of the messages YallaDM sent you, so it can tell its own messages apart from a person's replies.
• Whether a person from the business replied to you, and when.

YallaDM reads each message to decide whether to answer, and doesn't keep what it says. Messages you send the business outside a conversation YallaDM started are not kept.

The activity log

YallaDM logs each step it takes, such as a reply sent or a reply that failed, so problems can be found and fixed. A log entry holds ids, the time, and Meta's error codes. It never holds the text of a comment or message, apart from the 80 character snippet described above.

Where a business asks people to follow it first, the log records the outcome of each follow check against your scoped id, with the time: that you were following, that you were not following yet and were asked again, that the check could not be made because Instagram returned an error, or that YallaDM sent you what you asked for anyway. So while your follow status is not kept on your record, the log does show what each check found.

What YallaDM never does

• It never stores photos, videos, links to Instagram media, profile pictures, or follower lists.
• It never keeps the text of private messages.
• It never reads anything from your profile before you tap a button or write to it.
• It never sells data, never uses it for advertising, and never builds advertising profiles.

Who else handles the data

• Cloudflare runs YallaDM and this website, stores YallaDM's database, forwards email sent to the contact address, sends YallaDM's emails to businesses, and keeps short-lived technical logs.
• Meta Platforms operates Instagram and Facebook and delivers the comments and messages. Meta handles them under its own privacy policy.
• Anthropic runs Claude. When a business connects Claude, what YallaDM tells Claude goes to Anthropic as part of that business's chat, under the business's own terms with Anthropic.
• Google hosts the inbox that email to the contact address is forwarded to.

How long it is kept

• Records about a person are deleted 12 months after their last comment or message.
• Comment snippets that matched no keyword are deleted after 30 days.
• A business's access token, replies and records are deleted within 30 days after it disconnects its account.
• Daily counts of how many comments and messages each automation handled are kept after a business disconnects, with nothing that identifies a person or the business, so we can plan and price the service.
• The codes and tokens issued to Claude expire within 30 days of their last use, and are then deleted.
• Emails are kept for as long as it takes to handle them.

Your choices

• To stop automated messages, block the business's account on Instagram, or the Page in Messenger.
• To reach a person, write back in the conversation. The business reads these messages.
• To see or delete what YallaDM keeps about you, follow the steps on the data deletion steps below.
• A business can end Claude's connection at any time by removing the YallaDM connector in Claude.
• A business can disconnect YallaDM at any time from Settings in its YallaDM dashboard, or in its Instagram settings.

This website

This website sets no cookies and runs no analytics. Its one script is the Copy button on the AI page, served from this website, and every page reads the same without it.

Children

YallaDM is not directed at children under 16. If you believe it holds a child's data, email hello@growwithazab.com and it will be deleted.

Terms of service

These terms apply to businesses that use YallaDM. By connecting an Instagram account or a Facebook Page to YallaDM, you agree to them.

What YallaDM does

YallaDM answers comments and messages on your Instagram professional account or Facebook Page. When someone comments with a keyword you choose, it sends them what you set up in a private message, and replies to their comment so they know to look. The privacy policy explains what it keeps.

Early access and fees

YallaDM is in private early access, by invitation, and free. If a fee is introduced, you will be told by email at least 30 days before you are charged, and you can disconnect before then.

Who can use it

You must own the Instagram professional account or Facebook Page you connect, or be authorised to manage it, and be old enough to enter a contract where you live.

How you must use it

• Follow Meta's Platform Terms, Instagram's Community Guidelines, and the laws that apply to you.
• Only use YallaDM to answer people who commented on or messaged your account first, and send them what they asked for.
• Keep the note that tells people a reply is automated, and let people reach a person on your side.
• Don't send anything misleading, harmful or illegal, or anything you don't have the right to share.
• Tell your own followers how you handle their data, for example in your own privacy notice.

Your content

The replies, links and files you set up stay yours. You allow YallaDM to send them on your behalf, only to run the service. You are responsible for what they say.

Instagram, Facebook and Meta

YallaDM works through Meta's Instagram and Facebook APIs. Meta can change, limit or end that access, and Meta limits how many private replies an account can send each hour, so replies can be delayed or not delivered. YallaDM is not made, endorsed or supported by Meta.

Ending

You can stop using YallaDM at any time by disconnecting your account from Settings in your YallaDM dashboard, or by removing it in your Instagram or Facebook settings and emailing us. YallaDM can suspend or end your access if you break these terms or put other people at risk. When your use ends, your account's data is deleted within 30 days, as the privacy policy describes.

No guarantees

YallaDM is provided as it is, without any promise that it will always be available, free of errors, or suited to a particular purpose.

Limit of liability

As far as the law allows, YallaDM's total liability for any claim is limited to the greater of the fees you paid in the 12 months before the claim or 100 US dollars, and YallaDM is not liable for indirect losses such as lost profits. Nothing in these terms limits liability that cannot lawfully be limited.

Governing law

These terms are governed by the laws of the Arab Republic of Egypt, and the courts of Egypt have jurisdiction over any dispute.

Data deletion

How to stop YallaDM's messages, and how to have the data it keeps deleted. The privacy policy above lists what that data is.

If you commented on or messaged an account that uses YallaDM

1. To stop automated messages now, block that account on Instagram, or the Page in Messenger.
2. To delete what YallaDM keeps about you, email hello@growwithazab.com with your Instagram username or Facebook name and the account or Page you commented on or messaged.

Everything YallaDM keeps that is linked to you is deleted within 30 days, and you get an email to confirm it's done. If you later comment asking for something again, YallaDM treats it as a new request.

If your business connected an Instagram account or a Facebook Page

1. In the Instagram app, open Settings and activity, then Website permissions, then Apps and websites. Under Active, remove YallaDM. Its access stops straight away. For a Facebook Page, open Settings and privacy, then Settings, then Business integrations, and remove YallaDM.
2. Email hello@growwithazab.com naming the Instagram account or Facebook Page, to have its access token, replies and records deleted. You may be asked to confirm you manage the account.

This is done within 30 days, and you get an email to confirm it.

Daily counts of how many comments and messages each automation handled are kept after a business disconnects, with nothing that identifies a person or the business, so we can plan and price the service.

What stays on Instagram and Facebook

Deleting YallaDM's data doesn't remove messages or comments from Instagram or Facebook. They stay in the conversation and on the post, under Instagram's privacy policy or Facebook's.

Changes

If this page changes, the date at the top changes too, and businesses using YallaDM are told about important changes by email before they apply.