Privacy Policy

1. Who We Are

DMly (“we”, “us”, “our”) is a product operated by Client Path, LLC, registered in the United States.

Controller Contact: hello@dmly.io
Website: https://dmly.io

2. Information We Collect

2.1 Information You Provide

We may collect information you provide such as:

• Full name
• Email address
• Phone number
• Business/organization name
• Account credentials
• Billing/subscription information
• Support communications
• Message templates, automation rules, and content you upload

2.2 Information Collected Automatically

We may automatically collect:

• IP address
• Device/browser type
• Operating system
• Log data and timestamps
• Usage activity and feature interactions
• Cookies and similar tracking technologies

2.3 Data from Connected Platforms

When you connect third-party platforms, we may process data permitted by those platforms, including:

• WhatsApp Business account details
• Facebook Pages and Messenger data
• Instagram professional account and messaging data
• TikTok business and messaging account data (including TikTok Messaging interactions)
• Telegram bot and chat metadata
• SMS sender IDs, phone numbers, and delivery metadata processed via carriers/aggregators such as Twilio and Plivo
• Live Chat website-widget sessions, visitor identifiers, and messages
• Google Business Profile data, including Google Business Messages, reviews, and Q&A
• Shopify store, customer, order, checkout, product and fulfillment data, for a store connected through the DMly Shopify app
• Contact identifiers, tags, notes, and conversation events
• Message delivery and interaction metrics

We only access data explicitly authorized by you and allowed under each platform’s policies.

2.4 Mobile Application

The DMly mobile app for Android and iOS collects the following in addition to the categories above. Each item below is tied to a specific feature, is requested only the first time you use that feature, and can be declined or later withdrawn in your device settings; the rest of the app continues to work without it.

• Microphone and voice recordings. Used only when you choose to record a voice note to send in a conversation. Recording runs only while you are actively recording in the app, the app does not record audio in the background or while it is closed. The resulting audio file is uploaded so it can be delivered on the channel you selected, and is stored with that conversation.
• Photos and videos. Used only when you attach media to a message, or set an image on your profile or content. You select each file from your device’s photo library, and we access only the items you select, the app does not scan, index, or upload your photo library.
• Push notifications. We store a push token issued by Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android) against your account, so we can notify you about new messages, bookings, and payments. Notifications may include a sender name and message preview; you can disable notifications, or their content, in your device settings at any time.

Voice notes and media you send are transmitted to the messaging platform you send them on, for example WhatsApp, Instagram, or Messenger, so that the message can be delivered to the recipient. Once delivered, that content is also governed by the receiving platform’s own privacy policy. See 9. Data Sharing & Disclosure.

The mobile app does not collect precise or background location, does not access your device’s camera or contact list, and does not use microphone, photo, or video data for advertising or profiling. Voice notes and media are retained with the conversation they belong to, and are deleted in line with 11. Retention & Deletion, including when you delete your account.

3. How We Use Your Data

We use your information to:

• Provide and operate the DMly platform
• Enable omnichannel messaging automation
• Deliver AI-powered responses and workflows
• Process payments and subscriptions
• Authenticate users and secure accounts
• Improve performance, reliability, and features
• Provide support and service communications
• Comply with legal and regulatory obligations

4. Controller vs Processor (Important)

Depending on how you use DMly, Client Path, LLC may act as:

• Data Controller for account, billing, and platform usage data
• Data Processor for messages, contacts, and conversations you process through DMly on behalf of your end-users

Where we act as Processor, you remain the Controller of end-user data and we process it only on your documented instructions.

5. Messaging Platform Compliance

DMly is designed to comply with:

• WhatsApp Business Platform policies
• Meta Platform Policies (Messenger, Instagram)
• TikTok Business and Messaging policies
• Telegram Bot API policies
• SMS/carrier requirements, including TCPA, CTIA guidelines, and US 10DLC registration where applicable (via aggregators such as Twilio and Plivo)
• Google Business Profile and Google Business Messages policies
• Live Chat / website-widget use governed by our website terms and applicable law

We do not:

• Sell message content or contact data
• Use messaging data for advertising
• Access private messages without authorization
• Initiate messages outside your configured automations

You are responsible for lawful opt-in/consent and compliance with applicable laws and platform requirements (including WhatsApp/Meta, TikTok, Telegram, SMS (TCPA/CTIA/10DLC), Google Business Messages, and Live Chat requirements).

The following per-channel disclosures describe the data DMly accesses from each connected channel and the platform policies you agree to comply with when you use it. You are responsible for maintaining the approvals, opt-ins and permissions each platform requires.

5.1 WhatsApp (WhatsApp Business Platform)

Through the WhatsApp Business Platform we process your WhatsApp Business Account and business phone number details, contact phone numbers and profile names, message content and approved templates, and delivery, read and opt-in status. You must comply with the WhatsApp Business Messaging Policy and Meta Business and Commerce policies, obtain valid opt-in before messaging, use approved templates for business-initiated messages, and respect the 24-hour customer service window.

5.2 Instagram

For connected Instagram professional accounts we process Instagram-scoped user identifiers, direct messages, story replies, comments and related media metadata. Use of Instagram messaging is governed by the Meta Platform Policies and Instagram Platform terms, including the Meta messaging windows.

5.3 Facebook Messenger

For connected Facebook Pages we process Page-scoped user identifiers, Messenger conversations and Page comments. Use is governed by the Meta Platform Policies and the Messenger Platform Policy, including the standard 24-hour messaging window and the approved message tags for messages sent outside it.

5.4 TikTok

For connected TikTok business accounts we process TikTok-scoped account identifiers and, where the API permits, direct messages, comments and interaction metadata. You must comply with the TikTok Developer Terms and TikTok business and platform policies, and obtain consent for outreach.

5.5 Telegram

Through the Telegram Bot API we process your bot token and metadata, chat identifiers, message content and group or channel metadata. Use is governed by the Telegram Bot API Terms, and you are responsible for lawful use and consent.

5.6 SMS

SMS is delivered through carriers and aggregators such as Twilio and Plivo. We process sender identifiers and numbers, recipient phone numbers, message content and delivery status. You must comply with the US TCPA, the CTIA Messaging Principles, applicable carrier terms, and complete 10DLC / A2P registration where required. You must obtain documented opt-in and honour opt-out keywords such as STOP at all times.

5.7 Live Chat (website widget)

When you deploy the DMly live-chat widget on your website we process visitor messages, the page and URL context, browser and device information, session identifiers and cookies, together with any details a visitor chooses to share. You are responsible for disclosing the widget in your own website privacy notice and obtaining cookie consent where required.

5.8 Google Business Profile

For a connected Google Business Profile we process your business and location details and, where enabled, customer messages, reviews, questions and answers, and reviewer display names. Use is governed by the Google Business Profile policies and the Google API Services User Data Policy.

5.9 Shopify

DMly publishes a Shopify app, DMLY: WhatsApp Marketing & AI, which runs embedded inside your Shopify admin. Installing it lets events in your store start messaging automations, and lets us match the customers in your store to the people you talk to on WhatsApp and your other channels.

At install the app requests these Shopify Admin API permissions, and no others:

• Read orders and read checkouts. So that an order placed, paid, fulfilled, cancelled or refunded, or an abandoned checkout, can trigger a message.
• Read customers. To match a Shopify customer to an existing DMly contact, or create one.
• Write customers. To write a customer’s WhatsApp marketing consent decision back to your store, so both systems agree on it.
• Write orders. To add notes to an order, for example to record that a recovery message was sent.
• Read products. For product cards and back-in-stock messages.
• Read fulfillments. For shipping and delivery updates.
• Write discounts. To create the discount code a cart-recovery automation offers.

We do not request inventory permissions, and we do not request access to your Shopify staff accounts, payouts or financial reports.

From those permissions we process customer names, email addresses, phone numbers, marketing consent status, order and checkout contents, fulfillment status, and product details. We use it only to run the automations you switch on, to show you the value those automations produced, and to keep one customer record across your store and your messaging channels. We do not sell it, and we do not use your store’s data to market to your customers on our own behalf.

The app signs requests with Shopify session tokens rather than cookies, and holds an offline access token for your store so that scheduled automations can still run when nobody is signed in.

When you uninstall. Your store’s access token is deleted from our systems immediately, so we can no longer call your store. The store record and the data synced from it are then purged after a seven-day grace period, which exists so that an accidental uninstall followed by a reinstall does not lose your history. That purge runs on a schedule of ours and does not depend on a notification arriving from Shopify.

Data that remains on Shopify’s side is governed by Shopify’s own terms and privacy policy.

6. Payments & Billing

Payments are processed securely by Stripe and other supported payment providers.

DMly does not store full card numbers or CVV codes. Billing data retained may include transaction IDs, subscription plan, payment status, invoices, and receipts.

7. AI & Automated Processing

DMly uses AI services (including OpenAI) to provide features such as AI-generated replies and automation assistance.

Key principles:

• Data is processed only to provide requested functionality
• Your private data is not used to train public AI models
• We do not use your data for advertising or profiling
• Avoid submitting highly sensitive data into automated flows

8. Cookies & Tracking Technologies

We use cookies to:

• Maintain secure sessions
• Remember preferences
• Analyze platform performance
• Improve user experience

You can manage cookies via your browser settings. Some features may not work correctly without cookies.

9. Data Sharing & Disclosure

We may share data only with:

• Cloud hosting and infrastructure providers
• Messaging and channel platform APIs you connect (Meta, TikTok, Telegram, Google Business Profile, and SMS carriers/aggregators such as Twilio and Plivo)
• Live Chat / website-widget infrastructure providers
• Payment processors (e.g., Stripe)
• AI providers (e.g., OpenAI)
• Monitoring/analytics services
• Authorities when required by law

We never sell personal data.

10. Security

The controls below are the ones we actually operate. No method of transmission or storage is completely secure, and we do not claim otherwise.

• Encrypted connections. The dashboard, the API and this site are served over HTTPS, and plain HTTP requests are redirected to it.
• Encrypted credentials. The access tokens, API keys and bot tokens for the platforms you connect are encrypted in our database, and are never shown back to you once saved.
• Workspace isolation. Every query is scoped to your workspace at the data layer rather than by convention, and that isolation is covered by automated tests that stop a release if they fail.
• Role-based access. Team member permissions are enforced on the server and deny by default, so a screen nobody has been granted is closed to everyone. Seeing a contact’s full phone number or email address is its own permission; without it those fields are masked.
• Account security. Passwords are stored hashed, never in readable form. Changing or resetting a password signs out every other browser session, mobile sign-in and remembered device. Two-factor authentication using an authenticator app, with recovery codes, is available to every user.
• Audit log. Administrative and destructive actions are written to an append-only log recording who did it, what changed, the IP address and the time. There is no edit path. Entries are kept for 180 days. Where an agency signs in to a client workspace, the real person behind that session is recorded.
• Test data. Our automated test suite runs against a separate throwaway database and cannot reach live customer data.
• Incident response. We maintain a written incident response policy with defined severity levels and response times. If a personal data breach affects your data, we will notify you without undue delay, telling you what we know and what we are doing about it.

11. Retention & Deletion

Records you control. Contacts, open conversations, invoices, payments and bookings are kept for as long as your account is open, because they are your working records and only you know when they stop being useful. We do not delete them on a timer. You can delete any of them at any time, and deletion is immediate and permanent: there is no trash, no undo and no hidden copy.

Records on a fixed schedule. Some data is removed automatically:

• Archived conversations are permanently deleted 30 days after you archive them, along with their messages and attachments.
• Audit log entries are deleted after 180 days.
• In-app notifications are deleted 30 days after being read, and after 90 days in any case.
• Duplicate-delivery records used to stop a webhook being processed twice are deleted after 30 days.
• MCP request records are deleted after 7 days, and broadcast previews after 90 days.
• For a connected Shopify store, the access token is deleted the moment you uninstall, and the synced store record is purged 7 days later.

Closing your account. You can request deletion from your dashboard. We remove your workspace data from our live systems, and residual copies in backups are removed on our normal backup rotation. We keep only what we are legally required to keep, such as invoices and payment records for tax purposes, and anything we must hold to resolve an open dispute.

12. Your Rights (UK GDPR, EU GDPR, CCPA/CPRA)

Depending on your location, you may have rights to:

• Access and correct data
• Request deletion
• Restrict or object to processing
• Export your data
• Withdraw consent

Requests: hello@dmly.io

13. International Data Transfers

We may process/store data in the UK, EU, US, and other regions where providers operate. Appropriate safeguards are applied for international transfers.

14. Children’s Privacy

DMly is not intended for individuals under 18. We do not knowingly collect data from minors.

15. Changes to This Policy

We may update this policy periodically. Material changes may be communicated via email or platform notices. Continued use constitutes acceptance.

16. Contact

Client Path, LLC (DMly)
Email: hello@dmly.io
Website: https://dmly.io

Data Processing Agreement (DPA)

This DPA forms part of the agreement between:

• Customer (Controller): The business using DMly
• Client Path, LLC (Processor): Operator of DMly

1. Scope and Roles

The Customer is the Controller of end-user Personal Data. Client Path, LLC is the Processor when processing Customer Data on the Customer’s behalf.

2. Processing Details

Client Path, LLC processes Personal Data to provide the Services, including omnichannel messaging automation, workflow execution, analytics, routing, and support.

3. Types of Data and Data Subjects

Data Types: names, phone numbers, emails, messages, metadata, tags, notes, automation variables.
Data Subjects: Customer’s users, clients, leads, and contacts.

4. Customer Responsibilities

Customer warrants it has lawful basis, required notices, and opt-ins/consents for collecting and using end-user data and sending messages via connected channels (including WhatsApp Business API, Instagram, Facebook Messenger, TikTok, Telegram, SMS, Live Chat, and Google Business Profile).

5. Processor Obligations

Client Path, LLC will:

• Process data only on documented instructions
• Maintain confidentiality and security controls
• Support data subject requests as applicable
• Notify Customer of personal data breaches without undue delay
• Not sell or monetize Customer Data

6. Sub-processors

Customer authorizes DMly to engage sub-processors. Those in the processing path include:

• Messaging platforms: Meta Platforms (WhatsApp Business Platform, Messenger, Instagram), Telegram, TikTok, and Google (Business Profile).
• Commerce platforms: Shopify, for a store connected through the DMly Shopify app.
• SMS carriers and aggregators: Twilio, Plivo, or another gateway the Customer configures.
• Payment processors: Stripe and the other gateways the Customer enables to collect payments in chat.
• AI providers: Anthropic, OpenAI, Google and DeepSeek, used to generate AI replies and suggestions. Where the Customer has not supplied their own key, these requests run through DMly’s provider account.
• Push notification services: Apple Push Notification service, Google Firebase Cloud Messaging, and Expo, which carry a sender name and message preview to the Customer’s device.
• Infrastructure: our hosting and object storage providers, which hold the database and uploaded media.

Sub-processors are bound by confidentiality and data protection obligations. This list changes as the product changes, and the version published here is the current one.

7. International Transfers

Where transfers occur outside the UK/EEA, appropriate safeguards are applied.

8. Retention and Deletion

Upon account termination or deletion request, Customer Data will be deleted or anonymized unless legally required.

9. Audit and Compliance

Client Path, LLC will make reasonable information available to demonstrate compliance upon request.

10. Governing Law

This DPA is governed by the laws of England and Wales.

Meta / WhatsApp Privacy Addendum

This addendum supplements the Privacy Policy and DPA for Customers using Meta channels, including:

• WhatsApp Business Platform
• Facebook Messenger
• Instagram Messaging

Customers using other connected channels, including TikTok, Telegram, SMS (via carriers/aggregators such as Twilio and Plivo, subject to TCPA, CTIA guidelines, and US 10DLC registration), Live Chat, and Google Business Profile (Business Messages, reviews & Q&A), are subject to equivalent channel-specific requirements under those providers’ policies and applicable law, in addition to this Privacy Policy and DPA.

1. Data Ownership

Message content and contact data remain the Customer’s data. Client Path, LLC processes this data solely to provide the Services.

2. Customer Responsibilities (Meta Requirements)

Customer agrees to:

• Obtain lawful opt-in/consent from end-users
• Provide appropriate privacy notices
• Honor opt-out requests
• Comply with WhatsApp and Meta Platform Policies and applicable laws

3. Message Initiation and Automation

Client Path, LLC does not independently initiate messages. Automations are configured and controlled by the Customer.

4. WhatsApp Processing

Messages may be processed for delivery, automation, analytics, and (if enabled) AI-assisted responses. Data is not used for advertising or profiling.

5. AI Processing

If AI features are enabled, message content may be processed by AI providers (e.g., OpenAI) to generate responses. Data is not used to train public AI models.

6. Enforcement

Violations of Meta/WhatsApp policies may result in restriction, suspension, or termination of messaging features.

7. Order of Precedence

If there is a conflict:

• Meta/WhatsApp policies
• This Addendum
• DPA
• Privacy Policy
• Terms of Service