Privacy Policy
Last updated: 15 September 2026
This Privacy Policy explains what personal data Liffio collects, how we use it, who we share it with, how long we keep it, and the rights you have. It covers our websites, the Liffio app, and the Instagram data we process through Meta's official Instagram API.
1. Who we are
Liffio is operated by Liffio Private Limited (CIN: U58200GJ2026PTC181271), a private limited company incorporated under the Companies Act, 2013, with its registered office at First Floor, Shreeji General Store, Sultanpura Naka Laheri Pura New Road, Vadodara - 390001, Gujarat, India ("Liffio", "we", "us", "our").
We play two different roles, depending on whose data it is:
- Our customers' own data (your account, billing, and how you use Liffio). We decide how this data is used. Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the data fiduciary for it.
- Our customers' audience data (the people who comment on, message, or interact with the Instagram accounts our customers connect). We process this data only on behalf of, and on the instructions of, the customer who connected that account. The customer decides why it is processed. We act as their service provider: a data processor under the DPDP Act, and a Tech Provider under Meta's Platform Terms.
2. Who this policy covers
- Customers: people and businesses who create a Liffio account, including agencies and their team members.
- Audience members: people who comment on, message, or interact with an Instagram account that a customer has connected to Liffio. You may never have signed up for Liffio yourself. Section 5 explains how we handle your data.
- Visitors: people who visit liffio.com, or open a bio link page or short link that we host.
- Creators Program applicants and members, and affiliates.
3. Information we collect
3.1 Information you give us
- Name, email address, and password, or your name, email address, and profile photo from Google if you sign in with Google
- The country you select for your account. We use it to decide your billing currency and your tax treatment. We do not infer your country from your IP address for this purpose.
- For Indian customers buying a paid plan, your state, which decides how GST applies. If you are registered for GST, your GSTIN and legal name for the invoice.
- Instagram username and profile link
- Billing details. Payments are processed by Razorpay. We never see or store your full card number.
- Content you create in Liffio, such as automations, message templates, links, bio link pages, and posts you schedule
- Details of team members you add to your workspace
- Messages you send to our support team
3.2 Information we collect automatically
- IP address, and approximate location based on it. We use this for security, fraud prevention and rough analytics, not to decide your prices or your tax treatment.
- Browser, device type, and operating system
- Pages visited, features used, time on site, and interaction events
- Referral source and UTM parameters
- Time zone and language settings
- Error and performance logs
3.3 Instagram data from your connected account
You connect an Instagram Professional account by logging in with Instagram and approving the permissions Liffio asks for. We never ask for or store your Instagram password. Once connected, we access the following through Meta's official Instagram API:
| Data | Instagram permission | What we use it for |
|---|---|---|
| Account ID, username, name, profile photo, account type, and follower count | instagram_business_basic | To identify your connected account and show it in your dashboard |
| Your posts and reels, with their captions | instagram_business_basic | To let you choose which posts your automations run on |
| Comments on your posts and live videos, including the commenter's username, Instagram-scoped ID, and comment text | instagram_business_manage_comments | To run the comment automations you set up, including sending replies |
| Direct messages sent to your account and messages sent through Liffio, including the sender's username, Instagram-scoped ID, message content, and whether they follow your account | instagram_business_manage_messages | To run the DM automations you set up, show conversations and leads in your inbox, and apply follow-before-DM rules if you turn them on |
| Account and post insights, such as reach, impressions, and engagement | instagram_business_manage_insights | To show you analytics about your own account and content |
| Posts and media you schedule or publish through Liffio | instagram_business_content_publish | To publish content to your account when you tell us to |
| Access tokens | All of the above | To connect to your account securely. We never share tokens except with the service providers that host our systems. |
3.4 Our rules for Instagram data
We handle Instagram data under Meta's Platform Terms, and we commit to the following:
- We use Instagram data only to provide the features you set up and ask us to run.
- We do not sell, rent, or license Instagram data to anyone.
- We do not use Instagram data, even in aggregated or anonymised form, for Liffio's own marketing or advertising.
- We do not send Liffio's own promotional messages to the people who contact you. Automated messages carry only what you configured.
- We do not use Instagram data to build profiles of people, to decide anyone's eligibility for anything, to discriminate against anyone, or for surveillance.
- We do not use Instagram data to train AI models.
- We delete Instagram data as described in Section 8.
3.5 AI features (Lyra)
If you use Lyra, our AI assistant, we process the content you give it, and any of your Liffio or Instagram content you ask it to work with, to generate results for you. Lyra runs on AI models hosted on our own servers. We do not send this content to third-party AI companies, and we do not use it to train models.
If we ever move Lyra to an external AI provider, we will update this policy and tell you before the change takes effect.
3.6 Creators Program and affiliates
- Creators Program applicants: the details in your application form (name, email, country, Instagram username and profile link, follower range, content niche, and your answers). A member of our team also reviews your public Instagram profile.
- Creators Program members: we keep metrics about your connected account, including follower count, post count and how consistently you post, and we use them in an automated score that informs program decisions. Section 8.3 of the Creators Program Policy explains this in full, including what we do not use.
- Affiliates: referral activity, payout details, and country of residence. For Indian residents, your PAN and bank account details when we need them to pay you and deduct tax. To prevent fraud we also use IP addresses, device and payment-method fingerprints, and referral and payment patterns.
4. How we use your information
For customers, visitors, creators, and affiliates, we use personal data to:
- Provide, maintain, secure, and improve Liffio
- Process payments, manage subscriptions, and issue tax invoices
- Send service emails such as receipts, alerts, and account notices
- Understand how our website and app are used, using Liffio's own usage data (not Instagram data)
- Send marketing emails from Liffio, if you agree. You can unsubscribe at any time.
- Detect and prevent fraud, abuse, and security threats
- Respond to support requests
- Run the Creators Program and the Affiliate Program
- Meet our legal, tax, and accounting obligations
Audience data is used only as described in Section 5.
5. If you interacted with a business that uses Liffio
If you commented on, messaged, or interacted with an Instagram account that uses Liffio, that business (our customer) decides how your data is used, and Liffio processes it on their behalf.
- What we process: your Instagram username and Instagram-scoped ID, the text of your comments and messages, whether you follow the business's account, and any details you choose to share in the conversation, such as an email address or phone number the business asks for.
- Why: only to run the automations the business has set up, such as replying to your comment or message, and to show the business its conversations and leads. We do not use your data to market Liffio to you.
- Who is responsible: the business is responsible for telling you how it uses your data. Questions about why a business messaged you, or what it does with your details, should go to that business first.
- Deletion: you can ask the business to delete your data, or email us at support@liffio.com with the subject "Data Deletion Request", your Instagram username, and the business account involved. We will delete your data from Liffio within 30 days and let the business know.
Bio link pages and short links: when you open a bio link page or short link that we host, we record the visit on our servers (time, referring site, device type, and approximate location based on IP address). We use this to show the page owner basic click analytics. See our Cookie Policy for cookies.
6. Legal basis for processing
India (DPDP Act). We process personal data either with your consent, which we ask for when you sign up and which you can withdraw at any time, or for a legitimate use the DPDP Act allows. For example, when you voluntarily give us data for a specific purpose, such as a support request, or when the law requires us to process it, such as keeping tax records. Withdrawing consent does not affect processing that already happened, and some features may stop working.
EU and UK (GDPR). If you are in the EU or UK, we rely on: performing our contract with you; our legitimate interests in securing and improving Liffio and preventing fraud, balanced against your rights; your consent, for marketing emails and non-essential cookies; and our legal obligations.
Audience data. The customer who connected the Instagram account is responsible for having a lawful basis to process their audience's data.
7. Who we share data with
7.1 Service providers
We share personal data only with service providers who help us run Liffio. They may use it only to provide their services to us.
| Provider | What they do |
|---|---|
| Meta (Instagram) | Instagram API access for the features you use |
| Razorpay | Payment processing |
| DigitalOcean | Hosting our app, API, and database (servers in India) |
| Vercel | Hosting our marketing website |
| Hostinger | Email hosting and supporting servers |
| Brevo | Service and marketing emails, and invoice delivery |
| Sign in with Google, if you choose it | |
| Sentry and New Relic | Error and performance monitoring |
| Umami | Website and product analytics |
7.2 The business you interacted with
Audience data is available to the customer who connected the Instagram account, inside their Liffio workspace. If an agency manages that workspace, the agency can see it too.
7.3 Legal requirements
We disclose personal data only when the law requires it, such as under a court order or a valid request from a government authority, and we keep a record of each request. We may also use or disclose customer account data (never Instagram data) where needed to prevent fraud or protect the safety of our users.
7.4 Business transfers
If Liffio is merged or acquired, customer data may transfer to the new owner, who must keep protecting it under this policy. Instagram data will only transfer as Meta's terms allow. We will tell you by email before this happens.
7.5 We do not sell personal data
We do not sell personal data, and we do not share it with advertisers.
8. How long we keep data
| Data | How long we keep it |
|---|---|
| Account data | While your account is open. Deleted within 30 days of closing it, except records we must keep by law. |
| Instagram data, including your audience's comments, messages, and leads | While your Instagram account is connected. When you disconnect, most of it is deleted immediately, and everything else, including your access token, within 30 days. The same applies if you remove Liffio in your Instagram settings, close your Liffio account, or ask us to delete it. |
| Creators Program records | While you are in the program, and up to 12 months after you leave. We keep a minimal record of past membership for longer so that leaving and rejoining cannot be used to reset program history. |
| Billing, tax invoices and GST records | As long as Indian company and tax law requires |
| Support conversations | Up to 3 years, for dispute resolution |
| Security, fraud, and access logs, including IP addresses | 1 year |
| Chargeback and fraud block list (account email and payment method identifiers only) | Up to 3 years |
| Affiliate payout and tax records, including PAN | As long as Indian tax law requires |
| Data involved in a legal dispute | Until the dispute is resolved |
We may keep anonymised data that can no longer identify anyone, but never anonymised or aggregated Instagram data for our own purposes.
9. Your rights
Depending on where you live, you have the right to:
- Access: get a summary of the personal data we hold about you and how we use it
- Correction: fix inaccurate or incomplete data
- Deletion: ask us to erase your data (see Section 10)
- Portability: where applicable, get your data in a machine-readable format
- Withdraw consent: at any time, including for marketing emails
- Grievance redressal: raise a complaint with our Grievance Officer (see Section 15)
- Nomination: name another person to exercise your rights if you die or become unable to
- Complain to a regulator: in India, to the Data Protection Board of India after using our grievance process first. In the EU or UK, to your local data protection authority.
To use any of these rights, email support@liffio.com. We may need to verify your identity first. We respond within 30 days.
If you are an audience member, you can use these rights with the business you interacted with, or with us.
10. Deleting your data
- Delete your Liffio account: email support@liffio.com from your account email with the subject "Data Deletion Request" and your registered name. We delete your data within 30 days, except what we must keep by law (see Section 8).
- Disconnect Instagram: disconnect your Instagram account inside Liffio, or remove Liffio's access from your Instagram settings under apps and websites. Either way we stop accessing your account immediately, delete your automations, leads, messages and link data straight away, and remove your access token and account identifiers within 30 days.
- Audience members: see Section 5.
11. Security
We use encryption in transit (HTTPS/TLS), encryption of stored access tokens, access controls, and restricted access to our production systems. No system is 100% secure. If a data breach affects your personal data, we will notify you and the relevant authorities, including the Data Protection Board of India, as the law requires.
Reporting a security issue: if you find a vulnerability in Liffio, email support@liffio.com with the subject "Security Report". We review every report.
12. Cookies
We use cookies and similar technologies. See our Cookie Policy for what we use and how to control them.
13. Children
Liffio accounts are only for people aged 18 or over. If we learn that a customer is under 18, we will close the account and delete their data.
Our customers' audiences may include people under 18. We process that data only on the customer's behalf to run their automations. Customers must not use Liffio to target children or collect their personal data (see our Acceptable Use Policy).
14. International transfers
Our main servers are in India. Some of the service providers in Section 7.1, such as Vercel, Brevo, Sentry, and New Relic, may process data outside India. We use providers that protect data to recognised standards, and we do not transfer personal data to any country the Government of India restricts.
15. Grievance Officer and contact
For any question, request, or complaint about your personal data, contact our Grievance Officer:
- Grievance Officer: The Liffio Privacy Team, Liffio Private Limited
- Email: support@liffio.com (subject: "Privacy")
- Address: Liffio Private Limited, First Floor, Shreeji General Store, Sultanpura Naka Laheri Pura New Road, Vadodara - 390001, Gujarat, India
We aim to resolve complaints within 30 days.
16. Changes to this policy
If we make a material change, we will tell you by email or in the app before it takes effect and, where the law requires, ask for your consent again. The date at the top of this page shows when this policy was last updated.
Frequently Asked Questions
Instagram DM automation
Yes. Instagram permits DM automation through its official API, which is part of Meta's developer platform. Tools that connect via the official API using OAuth, rather than scraping or using your password, are the path Instagram's platform policy allows. Liffio integrates exclusively through this official API using OAuth: you approve the permissions on Meta's consent screen when you connect, and you can revoke access at any time from your Instagram settings. Never passwords, scraping, or unofficial endpoints. The distinction matters practically: tools operating outside the official API (browser automation, credential scraping, or unofficial endpoints) work outside Meta's permitted use guidelines, which is where account risk comes from.
Comment-to-DM automation sends a direct message to someone automatically when they comment a specific keyword on your Instagram post or Reel. Here is how it works: you connect your Instagram account via the official API, choose a post, set a trigger keyword (such as LINK, PRICE, or GUIDE), and write a DM template. When any commenter types that keyword, the automation fires and sends your pre-written DM, after a short configurable delay of 10 to 60 seconds, without you doing anything manually. For example: you post a Reel about a digital product and tell viewers to comment FREE to get the download link. Every person who comments that word receives the link in their inbox automatically, even if you are asleep or offline. One limitation: comment-to-DM only fires on posts you explicitly enable it for. It does not apply to all posts on your account automatically.
Instagram's enforcement targets tools that access accounts by logging in with your password, simulating browser behavior, or using unofficial endpoints. The official Instagram API works differently. You authorize Liffio through Meta's own OAuth screen, the same login flow used by major apps like Hootsuite or Later. Your password is never entered into Liffio at any point, and Liffio never stores credentials. Meta issues an access token directly to Liffio, which you can revoke at any time from your Instagram settings under Apps and Websites. Liffio also adds a configurable 10 to 60 second delay between trigger and send, so each automated reply arrives at a natural conversational pace for the person receiving it rather than as an instant blast.
Yes. With keyword-trigger tools like Liffio, you can automate replies to incoming Instagram interactions such as comments on posts and Reels, story replies, and inbound DMs. Each automation type works through the same mechanism: you define a trigger condition (a keyword or a reply), write the message, and set a delay. When the trigger fires, Liffio sends the message automatically via Instagram's official API. For example: if you run a coaching business, you could set up a DM trigger so that anyone who sends you the word APPLY in a DM receives your application form link, without you checking your inbox. The delay is configurable between 10 and 60 seconds per automation, so replies arrive at a natural conversational pace for the recipient instead of landing the instant they comment.
Liffio. It has a free plan with no credit card required that runs comment-to-DM automation in production, not just as a demo. Paid plans start at $9/month. For comparison: since ManyChat's March 2026 pricing change, its free tier is capped at 25 Active Contacts per month, and paid plans start at $14/month for 250 contacts with per-contact overage fees as your audience grows. SendDM and LinkDM are simpler tools with focused feature sets; pricing varies. SuperProfile bundles bio-link storefronts with automation and prices accordingly. What makes Liffio structurally cheaper for Instagram-focused creators is that there are no per-contact fees. You pay the same $9/month whether you automate DMs to 100 people or 10,000 people. ManyChat charges based on how many people you interact with each month, which means a single viral Reel can trigger overage charges unexpectedly. The free plan includes unlimited DMs, 3 automation workflows, 2 live chatbots, comment keyword triggers, and overview analytics. That is enough to validate whether automation works for your use case before paying anything.
Auto DM tools
An auto DM tool (also called auto DM software or DM automation tool) sends Instagram direct messages automatically when a trigger fires - for example a keyword in a comment, a story reply, or an inbound DM. Liffio is an auto DM tool that lets you set delays (10 to 60 seconds), personalize messages, and run comment-to-DM flows without manual inbox work.
Auto DMs are automated direct messages sent by an auto DM tool when someone triggers a specific action - like commenting a keyword on your post, replying to your story, or sending you a DM. With Liffio's auto DMs, you set up the trigger once, and the tool sends your pre-written message automatically 24/7.
An auto comment tool (or auto comment reply tool) replies publicly under your Instagram post and can send a matching private DM. Liffio combines auto comment reply with comment-to-DM automation so one keyword trigger handles both the public reply and the automated DM - the signature workflow of tools like ManyChat.
The best auto DM tool depends on your needs. Liffio is ideal for creators and brands who want unlimited auto DMs on every plan, Free included, simple pricing, and chatbots as their own module. We offer comment-to-DM, auto comment reply and chatbots, like ManyChat, SendDM, and SuperProfile, without per-message or per-contact fees.
Yes! Liffio offers a free auto DM tool tier that lets you get started with Instagram DM automation without a credit card. The free plan includes comment-to-DM automation, auto comment reply, 2 live chatbots, unlimited DMs, and overview analytics, enough to test if auto DMs work for your business.
Like ManyChat, SendDM, LinkDM, and SuperProfile, Liffio supports keyword triggers, comment-to-DM, auto comment reply, and chatbots for Instagram. Liffio keeps comment to DM simple and puts full DM conversations in a separate chatbot module, with unlimited auto DMs on every plan, simple pricing, and a free tier with 2 live chatbots, making it a top ManyChat alternative.
Both terms describe the same workflow: automating Instagram DMs at scale. Liffio is a DM automation tool (also called a dming tool, auto DM software, or Instagram auto DM tool) for creators, coaches, and brands who want auto DMs from comments, stories, and the inbox.
Comment-to-DM is the core feature of any auto DM tool. You choose keywords (for example "LINK" or "GUIDE"). When someone comments that word on a post or Reel, Liffio sends your auto DM after your chosen delay and can post a public auto comment reply under their comment - the same pattern used by ManyChat, SendDM, and other Instagram auto DM tools.
Instagram auto reply refers to any automated response sent when someone interacts with your account - via comments, stories, or DMs. Liffio's auto reply features include auto DMs from comments, story reply automation, and DM auto responders. All powered by the same auto DM tool technology.
Yes, when you use a compliant auto DM tool like Liffio. We use official Instagram APIs, configurable send delays (10-60 seconds), and rate limiting. Unofficial bots that log in with your password or simulate a browser operate outside Meta's permitted use guidelines. Liffio connects only through Meta's OAuth consent flow.
Getting started
Go to your Liffio dashboard and click 'Connect Instagram'. You'll be redirected to Instagram's own login page. Authorize the app and your account will be connected in seconds.
Most creators connect Instagram and send their first automated DM in under five minutes. Pick a trigger, write your message, set your delay (10 to 60 seconds), and go live. No credit card required.
Keyword triggers are words or phrases in a comment that start an automation. If someone comments "LINK" on your post, Liffio can send them your link in DMs after your configured delay.
Automations & DMs
DMs send after your chosen delay - from 10 to 60 seconds after the trigger (comment, story reply, etc.). You control the timing so replies land at a natural conversational pace while staying on autopilot.
Each automated message sent to a unique user counts as one DM, and follow-up replies within the same conversation thread do not count again. Every plan, Free included, is uncapped: no monthly DM quota, no per-message fee, and no contact limits.
Liffio automates comment-to-DM, story replies and story mentions, inbound DM replies, ask for follow, follow-up sequences, and data collection. Each automation sends its DM after a delay you set between 10 and 60 seconds. The Free plan runs 3 automations, Starter 25, Growth 100, and Business 250. Chatbots are a separate module, with 2 live chatbots on Free.
Safety & compliance
Yes! Liffio is a Verified Meta Tech Provider and uses only official Instagram APIs, operating within Instagram's terms of service.
Each workspace connects one Instagram account, so managing several accounts means several workspaces. Free, Starter, Growth and Business include one workspace each; Agency includes 20, each one a complete Business workspace, on a single subscription, for managing client brands at scale.