Privacy Policy
Last updated November 4, 2026
This policy covers GlossHouse DM Bot, the comment-to-DM service run by Katie Co., LLC dba GlossHouse (“GlossHouse”, “we”). The service lets a creator’s Instagram account send one direct message, with a link, to someone who comments a campaign’s keyword on the creator’s reel.
If you’re a creator who connected your account
Through Instagram’s login, with the permissions you approved on Instagram’s screen, we receive and keep:
- Your Instagram account ID, username and account type.
- An access token, encrypted at rest, and the list of permissions you granted.
- Which campaign you connected to, and when.
- Counts: DMs sent, failed and expired.
We ask for two permissions: instagram_business_basic and instagram_business_manage_comments. We never ask for your password and we can’t read your DMs. We use the token to identify your account, to receive comments on your posts and to send the private reply, and for nothing else. We don’t post, or delete or hide comments.
The link in your DMs goes straight to the brand’s site and ends with your username, so the brand can see which visits came from you.
If you commented on a creator’s post
When a comment arrives, we check it for the campaign’s keyword and then discard its text. If it matches, we keep two things for up to 30 days, so we can send you one DM and not send it twice:
- The comment’s ID, which Instagram requires in order to send the reply.
- A one-way keyed hash of your Instagram-scoped ID. We don’t store the ID itself, your username or your comment. The hash is different for each creator and campaign, so it can’t be used to link you across them.
After 30 days, or as soon as the creator removes access, those are deleted. What remains is a count, by day. A DM goes only to someone who commented the keyword. It comes from the creator’s account and includes a disclosure line.
If you open the link in a DM
It goes straight to the brand’s site, not through us, so we don’t see or count the visit. The link ends with tags that tell the brand’s site which creator’s DM it came from. They name the creator, never you, and the link is the same for everyone who gets that creator’s DM. The site you land on has its own privacy policy.
How we use it, and who sees it
- We use this data only to run the service for the creator and campaign it belongs to. We keep each creator’s and campaign’s data separate and never pool it into a list.
- Brands get counts only. They never get commenters’ names, handles, IDs or comments.
- We don’t sell data, or use it to build advertising audiences.
- Service providers: Meta, which runs the Instagram API this service works through, and our database and hosting providers, who process data on our behalf.
- We’ll disclose information if the law requires it.
How long we keep it
- Commenter data: up to 30 days, as above.
- Creator tokens: until you remove access or ask us to delete your data. Removing access deletes the token at once.
- Creator account details and counts: until you ask us to delete them.
Your choices
- Creators: remove the app in Instagram’s settings under Apps and websites, or see how to delete your data.
- Commenters: you only get a DM in reply to your own comment with the keyword, and we don’t repeat it for the same creator and campaign while we hold the record. To ask about or delete your data, write to the address below.
- Depending on where you live, you may have rights to access, correct or delete your personal data. Write to us and we’ll help.
Security
Tokens are encrypted at rest. Access to the database is limited to our servers and the people who run them. No system is perfectly secure, and we’ll tell you if a breach affects you where the law requires it.
Children
The service isn’t meant for anyone under 13, and we don’t knowingly collect their data.
Changes
If this policy changes, we’ll update this page and the date above.
Contact
Katie Co., LLC dba GlossHouse, creators@glosshouse.co