OgirDM Privacy Policy

Effective date: 1 September 2026  ·  Last updated: 1 September 2026

This policy covers the OgirDM product at dm.ogir.ai and the pages about it on ogir.ai. OgirDM is the Instagram-only edition of the OGIR platform. It is operated by the same company, on the same infrastructure and under the same rules as OGIR; this page exists so that a customer of OgirDM, and the people who message that customer on Instagram, can read exactly what happens to their data in one place, written only for Instagram.

1. Who we are

OgirDM is a product of Rigo International, a partnership firm registered in India. In this policy “OgirDM”, “we”, “us” and “our” mean Rigo International operating the OgirDM service. For the account data of businesses that sign up, Rigo International is the data controller.

2. Two kinds of people, two different roles

OgirDM is a tool that a business or creator uses to reply to the people who message their own Instagram account. So there are two groups of people in this policy, and our responsibilities to each are different.

• Businesses and creators who use OgirDM. They sign up, connect their own Instagram professional account and build the automated replies. For their account data, we are the controller.
• People who message those businesses on Instagram. If you sent an Instagram DM to, or commented on a post of, a business that uses OgirDM, your message is stored in that business’s OgirDM workspace. For your data the business is the controller and we are its processor: we hold it on the business’s instructions, only to provide the service, and we never use it for our own purposes or sell it.

Practically: if you want your data removed, ask the business first. They can do it themselves in seconds. Our data deletion page explains the route if you cannot reach them.

3. Information we collect from businesses using OgirDM

• Account details — name, email address, business or creator name, and the team members invited into the workspace.
• Connection credentials — the access token Meta issues when a business connects its Instagram professional account through Instagram Login. It is held server-side only, is never shown in the dashboard or sent to a browser, and is renewed automatically so the connection keeps working.
• Configuration — automated flows, keyword triggers, comment automations, canned replies and settings.
• Billing details — handled by our payment provider (Razorpay). We store the invoice details you enter (such as a GSTIN) and never a full card number.
• Usage records — message counts and delivery outcomes, for billing and for showing the business how its automations performed.
• Technical information — log data, IP address, browser type and the cookies needed to keep you signed in.

4. Information we store on behalf of businesses Instagram

When someone messages or comments on a business that uses OgirDM, we store:

• Their Instagram-scoped user id, which Meta provides. This id is specific to that one business’s account; it is not a username and cannot be used to find the person elsewhere on Instagram.
• Their profile name and username, where Meta provides them.
• Message content in both directions, including text, quick-reply choices and links to media that were sent.
• Comments on the business’s posts that triggered an automation, and the public and private replies the business configured.
• Anything an automated flow captured, such as a name, city or email address typed in reply to a question the business set up.
• Timing and delivery records: when a message arrived, whether it was delivered, and the reason if it failed.

We do not store Instagram story media. Meta prohibits caching it and we do not. We do not build advertising profiles, we do not sell any of this data, and we never use one business’s customer data to benefit another business.

5. Why we hold it, and on what basis

To provide the service the business asked for: receiving and sending Instagram messages, keeping a conversation history, running the automations the business configured, and letting a human take over a conversation. For a business’s own account data, our basis is performance of our contract with it and our legitimate interest in running and securing the platform.

For the people messaging those businesses, the lawful basis is the business’s to establish — normally its legitimate interest in answering a customer who contacted it, or that customer’s consent. Businesses using OgirDM agree in our Terms that they have a lawful basis for everyone they message.

6. Meta platform data

OgirDM is built on Meta’s official Instagram API with Instagram Login. Data we receive from Instagram is handled in line with Meta’s Platform Terms and Developer Policies in addition to this policy. Specifically:

• we request only the permissions the product needs — reading the connected account’s basic profile, and managing its messages and comments — and use them only for the features described here;
• we do not transfer Instagram data to data brokers, advertising networks or anyone building advertising profiles;
• we do not use it to make decisions about eligibility for credit, employment, housing, insurance or similar;
• the access token is used only to send and receive messages and reply to comments for the business that granted it, and is deleted as soon as that business disconnects.

7. Who we share it with

Only the suppliers needed to run the service. Each is bound to use the data only to provide its service to us.

We will also disclose data where the law requires it, and we will tell the affected business unless we are prohibited from doing so.

8. How long we keep it

• While the account is active — for as long as the business keeps it, since the point of the product is a conversation history it can look back on.
• After an account is deleted — removed within 30 days, and from routine backups within a further 30 days.
• On disconnecting Instagram — the access token is deleted immediately and Meta is told to stop sending us that account’s messages.
• Billing records — kept as long as Indian tax law requires.

Full detail, and how to ask: our Data Deletion page.

9. Security

Access tokens and other secrets are held server-side only and are never returned to a browser, rendered in the dashboard or written to logs. Data travels encrypted in transit. Access to production data is restricted to the people who need it to operate the service, and each business’s data is isolated from every other business’s at the database level. No system is perfectly secure; if a breach affects your data we will notify you and the relevant authority as the law requires.

10. Your rights

Depending on where you live you may have the right to see a copy of your data, correct it, delete it, restrict or object to how it is used, take it elsewhere in a portable format, and complain to a data protection authority.

• If you are a business using OgirDM, write to contact@ogir.ai and we will handle it directly.
• If you messaged a business that uses OgirDM, ask that business — it holds your data and is responsible for answering. If you cannot reach it, write to contact@ogir.ai and we will pass the request on and act where we are permitted to.

11. International users and Indian law

OgirDM is operated from India and handles personal data in accordance with India’s Digital Personal Data Protection Act, 2023 and other applicable law. If you use the service from outside India, your information is processed in India.

12. Children

OgirDM is a business tool and is not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child’s data has reached us, write to contact@ogir.ai and we will delete it.

13. Automated conversations

Many messages sent through OgirDM are automated. Businesses using OgirDM are responsible for disclosing that where the law or Meta’s policies require it, and the platform sends that disclosure for them at the start of an automated conversation.

14. Changes to this policy

We may update this policy from time to time. When we do, we revise the “Last updated” date above, and material changes are communicated in the product or by email.

15. Contact us

Questions about this policy or your data: contact@ogir.ai, or by post to Rigo International (OgirDM), A-19, Ground Floor, Suite 1379, Okhla Industrial Area Phase-2, New Delhi, South East Delhi, Delhi 110020, India.

See also our Terms of Service and Data Deletion Instructions. The policy for the full OGIR platform is at ogir.ai/privacy-policy.

OgirDM legal: Privacy Policy · Terms of Service · Data Deletion · Product page: ogir.ai/ogirdm