NNaduk Studio

Privacy Policy

Last updated 4 November 2026

This policy covers CommentDM, a mobile app operated by Naduk Studio ("we", "us"), a sole proprietorship registered in India (Udyam, Ministry of MSME), Kozhikode, Kerala. CommentDM sends an automatic Instagram direct message when someone comments on a post or reel, replies to or mentions the account in a story, or sends a DM with a keyword the account owner has chosen.

There are two kinds of people in this policy: account owners, who install CommentDM and connect their Instagram professional account, and people who interact with an account owner's posts, stories or messages.

Information from Instagram

An account owner connects through Meta's official login. We never see or store an Instagram password. With the owner's permission, CommentDM uses these Instagram permissions, only for the purposes listed:

  • Basic profile (instagram_basic): the account's id, username, profile picture and recent posts, so the owner can pick which post an automation runs on.
  • Comments (instagram_manage_comments): to read new comments on the owner's posts, check them against the owner's keywords, post an optional public reply, and hide comments when the owner turns on the comment shield.
  • Messages (instagram_manage_messages): to send the DM the owner wrote, read replies to it (for example a requested email address), and receive story replies and mentions.

We use Instagram data only to provide CommentDM to the account owner. We don't use it for advertising, sell it, or combine it with data from other sources.

What we store

  • Account owner: the Instagram account id, username and picture, the business portfolio id, and an encrypted access token.
  • Automations: the chosen post, keywords, DM text, buttons and images the owner attaches.
  • For matching comments and messages only: the person's Instagram id and username, the comment or message text, and the delivery result.
  • Leads: if the owner asks for it, the email address or phone number a person sends in reply. It is shared only with that account owner, who is responsible for how they use it.
  • Link taps: that a link in a DM was opened, and when. We don't store the person's IP address or device.
  • Comment shield: comments it hides (the text, the commenter's username and the reason), so the owner can review and unhide them.
  • Follow check: if an automation only sends to followers, we ask Instagram whether that person follows the account. We keep the delivery result, not a history of the answers.
  • Device: a push notification token for the owner's phone, so the app can tell them when something needs attention.
  • Subscription: the plan and its status, from the App Store or Google Play through RevenueCat. We never see card details.
  • Early-access list: if you join it on our website, your email, language and the page you signed up on.

Comments and messages that match no automation and aren't hidden by the shield are not stored. Other message replies are read only to find a requested email or phone number and are not stored.

Services that process data for us

  • Meta Platforms (Instagram API): receives and delivers the comments and messages. Meta's own privacy policy applies to Instagram.
  • Cloudflare: hosts our servers, database and images.
  • Google Firebase Cloud Messaging: delivers push notifications to the owner's phone.
  • RevenueCat, with Apple and Google: process subscriptions and tell us which plan is active.

Each processes data only to provide its service to us. We don't sell or rent personal data to anyone.

How long we keep it

  • Delivery records and hidden comments: 90 days, then deleted automatically.
  • Account, automations, leads, link-tap counts and images: until the owner deletes the account or disconnects and asks us to delete it.
  • Login sessions: until the owner signs out or deletes the account.
  • Early-access list: until CommentDM is available to you, or until you ask us to remove you.

Your choices and rights

  • Account owners can delete everything at once in the app (Settings, Delete account), or remove one Instagram account. Removing CommentDM in Instagram's settings also disconnects it and stops all automations.
  • Anyone can ask us for a copy of their data, to correct it, or to delete it, by emailing hello@nadukstudio.com. If you messaged an account that uses CommentDM, you can also ask that account owner directly.
  • We reply within 30 days. See also how to delete your data.

Security

Access tokens are encrypted, connections use HTTPS, and each account's data is visible only to its owner's login.

Children

CommentDM is for businesses and creators, and is not meant for anyone under 13 (or the minimum age in their country). We don't knowingly collect data from children.

Changes

If we change this policy, we update the date at the top. If the change is significant, we tell account owners in the app.

Contact

Naduk Studio (proprietor: Fathima Fida M), Kozhikode, Kerala, India · hello@nadukstudio.com