Privacy Policy

Last updated: November 3, 2026

1. Who we are and our role

dmswift is operated by Noam Shmuel Nissan, a sole proprietor in Israel, trading as dmswift ("we"). Postal address: 4 HaKomemiut St., Shomron, Israel. Privacy contact: Noam Shmuel Nissan, privacy@dmswift.com.

We handle two kinds of personal data, in two different roles:

• Our customers' data - the people who sign up for dmswift and their team members. For this data we are the controller (under the Israeli Privacy Protection Law, the database owner).
• Data about our customers' audience - people who comment on, message, or click links from a customer's Facebook Page or Instagram account. We process it on the customer's behalf and on their instructions, as their processor (database holder). The customer is the controller and decides why it is processed. If you are one of those people, the business you interacted with is your first point of contact, but you can always write to us (see section 9).

This policy is written to meet the EU and UK GDPR and the Israeli Privacy Protection Law, 5741-1981, including Amendment 13.

2. What we collect

Customers and team members

• Account: name, email address, your Google account identifier (when you sign in with Google), a scrypt hash of your password if you use one, language and time zone, sign-up and sign-in times, and the date and version of the Terms you accepted.
• How you found us: when you create an account, the name of the website that sent you (for example google.com, never the full address) and the campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term) of the link you followed, if there were any, and your answer to "How did you hear about us?" if you give one. Nothing is stored in your browser for this, and nothing is kept about visitors who do not sign up.
• Connected channels: the IDs, names, usernames and profile picture links of the Facebook Pages and Instagram accounts you connect; the Page access token Meta issues (stored encrypted, AES-256-GCM); the permissions you granted; and the app-scoped ID Meta gives to the Facebook user who connected them, so we can act on Meta's deletion and deauthorization requests.
• What you create: campaigns, posts and scheduled posts, uploaded images and videos, replies and messages, broadcasts and sequences, links, knowledge-base entries, segments, settings.
• Team and access: team members and their roles, invitations, API keys (stored only as a hash), AI agent (OAuth) connections, approval requests, and webhook endpoints you add.
• Billing status: your plan, trial and renewal dates, subscription status and the Dodo Payments subscription reference. We never receive or store your card details - Dodo Payments handles payment.
• Security records: an activity log of actions in your account (kept 365 days) with a salted, one-way hash of the IP address, never the address itself.
• Browser notifications, if you turn them on: the push endpoint your browser gives us.
• Support emails you send us.

People who interact with our customers' Pages and Instagram accounts

• From Meta, when you comment on a post or reel, send a message, reply to a story or mention the account: your platform-scoped ID, public name or username, profile picture link, language if provided, the text and ID of the comment or message, and when it happened.
• The replies and messages the business sent you, and whether they were delivered.
• Notes, tags and fields the business adds about you, and whether you opted out of follow-up messages.
• If you open a tracked link or QR code from the business: the time, a salted one-way hash of your IP address, your browser's user agent and the referring page.
• If the business asks for your email address or phone number in a conversation and you choose to send it: that email address or phone number, saved on your contact record for that business.

We do not ask Meta for email addresses, phone numbers or passwords of these people, and we never store passwords. An email address or phone number is stored only when you send it yourself, as described above.

Visitors to our websites

We use no third-party analytics, advertising or tracking tools, and keep nothing about a visit unless you create an account (then only "How you found us", above). Our server keeps short technical logs (which can include an IP address or an email address on sign-in events) to keep the service secure; they are rotated automatically (at most about 150 MB is kept) and not archived.

3. How we use data and our legal bases

• To provide the service you signed up for (performance of a contract): your account, connecting your channels, running your automations, publishing, the inbox, insights, team access, the API and MCP.
• To keep it secure and prevent abuse (legitimate interests): sign-in protection, rate limits, the activity log, spam and misuse detection, enforcing our Terms and Meta's rules.
• Abuse prevention. To protect our shared Meta app, your audience and other customers, our systems check sending volume, opt-outs, failed deliveries, errors returned by Meta, link destinations and similar signals. When we investigate a report or a signal, authorized staff may review the relevant campaigns, messages, posts, links and activity log of the account involved. For this limited purpose we act as a controller for our own security, under our legitimate interests.
• Understanding how people find us (legitimate interests): the "How you found us" record, so we know which channels bring customers. It is kept with your account and deleted with it, and is never shared or used for advertising.
• Billing and tax (contract and legal obligation), together with Dodo Payments.
• Service emails such as address verification and password resets (contract), and browser notifications only if you enable them (consent, which you can withdraw in your browser or in Settings).
• Audience data only to provide the service to the business that connected the channel, on its instructions. The business is responsible for its own legal basis.

We do not sell personal data, do not use it for advertising or profiling, and do not use your data or your audience's data to train AI models.

4. Meta Platform Data

Data we receive from Facebook and Instagram is used only to provide dmswift's features to the Page or account owner who connected it, in line with Meta's Platform Terms and Developer Policies. We do not sell or license it, do not transfer it to data brokers or advertising networks, and do not use it to build profiles of people across businesses. Each business sees only data from its own connected channels.

5. AI features and AI agents

• Built-in AI features (such as AI replies and suggested replies) run on an AI provider that dmswift uses on its own account (Anthropic or Google), on plans that include them. Only the text needed for the task - for example the message being answered and the customer's knowledge-base entries - is sent to that provider, to produce the answer. If a customer instead adds their own key from an AI provider, that text goes to the provider the customer chose (Anthropic, OpenAI, Google, Groq or OpenRouter) under that provider's terms. When no AI feature is used, no data is sent to any AI provider.
• Customers' own AI agents: a customer can connect an AI agent (for example Claude or ChatGPT) to their account through our API, OAuth or MCP server. The agent can then read and act on the customer's data within the scopes, channels and caps the customer set. The customer chooses that agent and is responsible for it.

6. Who receives data

• Our service providers, listed with their purpose and location on our Subprocessors page - hosting (Oracle Cloud), DNS and email routing (Cloudflare), the marketing website (Firebase Hosting), sign-in (Google), transactional email (Resend), payments, and the AI provider behind the built-in AI features (Anthropic or Google).
• Dodo Payments, our Merchant of Record, which sells the subscription to you, handles payment, tax and invoices, and processes payment and tax data as an independent controller under its own privacy policy.
• Meta, when the service publishes, replies or sends messages on a customer's instruction.
• Meta, when it asks us about customers of our app (for example the customer's name and contact details) or about an account that may breach its rules; and Dodo Payments, to prevent payment fraud.
• Authorities or others when the law requires it, or to protect rights and safety; and a successor if the business is transferred, under this policy.

7. Where data is stored and international transfers

The application and its database run on Oracle Cloud Infrastructure, Israel Central (Jerusalem) region. Some providers process data in other countries, including the United States and the United Kingdom. Israel benefits from an EU adequacy decision. For transfers to countries without one, we rely on the safeguards our providers offer, such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, and on the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001.

8. How long we keep data

• Account and channel data: while your account exists. Deleting your account erases it immediately, except the channel record described below, and cancels your subscription.
• Channel record. We keep a minimal record of each Facebook Page and Instagram account ID ever connected to dmswift: which account first connected it, whether it has used a trial, and, if an account was closed for a breach of our Acceptable Use Policy or for fraud, the reason and the date. This record survives deletion so we can apply our one-trial rule and stop banned businesses from signing up again. We keep it for up to 3 years after the last connection. Nothing else is kept. Paused accounts are handled as described in our Terms (deleted after 12 months without a subscription, with 30 days' notice).
• A disconnected channel (or one whose admin removed our app in Facebook): its data is kept 90 days in case it is reconnected, then deleted automatically.
• Activity log: 365 days. Link-click and QR-open records: 365 days. AI usage records: 180 days. Comment de-duplication records: 180 days. Webhook delivery logs: 30 to 90 days. Records of your data exports: 365 days.
• Backups: database backups are kept 14 days on our server and up to 30 days off-site, then overwritten. Deleted data disappears from backups within that time.
• Dodo Payments keeps transaction records for as long as its legal obligations require.

9. Your rights and how to use them

Depending on where you live, you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, withdraw consent, and complain to a supervisory authority - in Israel the Privacy Protection Authority, in the EU or UK your local data protection authority.

• Customers can do most of this themselves: edit details in Settings › Account, download all their data in Settings › Data, and delete the account in Settings › Data › Delete account.
• Anyone can write to privacy@dmswift.com. If you interacted with a business that uses dmswift, tell us the business and your name or username on that platform. We may ask you to confirm it is you, and we answer within 30 days.

10. Facebook and Instagram data deletion

Instructions are on our Data deletion page (https://app.dmswift.com/data-deletion). If you remove dmswift in your Facebook settings (Settings & privacy › Settings › Apps and websites), Meta sends us a deletion request, we delete the data automatically and you receive a confirmation code you can check on that page.

11. Cookies and local storage

We use only what is strictly necessary for the service to work, so no consent banner is needed:

• session - keeps you signed in (up to 30 days).
• oauth_state and g_oauth - protect the Facebook and Google sign-in steps (10 minutes).
• In your browser's local storage: your language, theme, selected channel, chart range and, if you enable notifications, a device key.

We use no analytics or advertising cookies. The dashboard at app.dmswift.com loads fonts from Google Fonts (the marketing website does not), so your browser connects to Google's servers, which receive your IP address.

12. Security

Traffic is encrypted with TLS. Page access tokens and app secrets are encrypted at rest; passwords and API keys are stored only as hashes. Each business can reach only its own channels, team members get only the role they were given, and we keep the data we hold to what the features need. If a breach affects your data, we will notify you and the authorities as the law requires.

13. Children

dmswift is for businesses and people aged 18 or over, and is not directed at children.

14. Changes and contact

We will post changes here and, for material ones, tell customers by email or in the dashboard. Questions: privacy@dmswift.com. This policy is written in English; if the Hebrew translation below differs, the English version controls.