1. Who we are
DM Closer Lab ("we", "us") is developing a messaging platform that will help businesses manage customer conversations on Instagram, Facebook Messenger and WhatsApp using AI-assisted replies, lead qualification, appointment booking and handoff to a human.
DM Closer Lab is operated by Eden Levitin, an individual carrying on business as a sole proprietor under the name DM Closer Lab. It is not an incorporated company.
You can contact us about this policy, or about your personal information, at dmcloserlab@gmail.com.
2. Who this policy covers
- Visitors to this website.
- Test participants who exchange messages with our test accounts during development.
- Businesses that use DM Closer Lab once it is available.
- People who message a business that uses DM Closer Lab once it is available.
3. Information we handle today
This website
This website does not use cookies, analytics, advertising trackers or third-party scripts. It has no forms and no accounts.
The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes technical information such as your IP address and browser details in order to deliver the pages and protect the site from abuse.
Development testing
The service is not connected to any customer's account and is not receiving real Instagram, Messenger or WhatsApp messages. Our app on Meta's platform is in development mode, and our systems have not received real message content from Meta.
We build and test the messaging features with simulated messaging events that we create ourselves. These are made-up test messages, not messages from real people.
Our systems store those simulated events in a database, in two forms:
- Raw incoming events. A copy of each event as it arrived, kept as a short-term safety and troubleshooting record. Completed raw events are deleted automatically after 30 days by default.
- Conversation records. The contact, conversation and message details the product works with, taken from each event. These are stored separately and are not covered by the 30-day rule. See how long we keep information.
What we have received from Meta so far is limited to the requests Meta sends to confirm our connection, and sample notifications containing placeholder data.
We also test with Instagram accounts that we control, and with accounts whose owners have agreed to act as testers. If a message from one of those accounts reaches our systems during testing, it would be stored in the same two forms and would include identifiers for the accounts involved, the content of the message and the time it was sent.
We hold the access credentials for our own test account so that we can test Meta's official APIs.
No AI model provider is connected to the service at this stage, and no message content is sent to one.
If you contact us
If you email us, we receive your email address and whatever you include in your message, and we use it to respond. Our mailbox is provided by Google (Gmail).
4. Information we plan to handle when the service is available
The following describes how the service is designed to work. None of it applies to customers yet, because the service has not launched.
From businesses that use the service
- Account details, such as name, email address and sign-in information.
- The messaging accounts a business chooses to connect, and the access credentials Meta issues when the business authorizes the connection through Meta's official authorization flow.
- The information a business gives its assistant: services, prices, policies, frequently asked questions, tone of voice and conversation settings.
- Usage and billing records. We expect payments to be handled by a third-party payment processor, so that we do not store full card details ourselves.
About people who message a business
- Messages exchanged with the business through a connected account, including attachments.
- Profile information the messaging platform makes available to the business, such as a username or display name.
- Details a person chooses to give in the conversation, such as their name, phone number, email address, what they are looking for, and appointment preferences.
- Records of appointments arranged through the conversation.
5. How we use information
We use information to:
- build, test and operate the service;
- receive messages sent to a connected account and send replies on the business's behalf;
- generate AI-assisted replies, collect the details a business asks for, and arrange appointments;
- pass a conversation to a person at the business and notify the business about new leads;
- keep the service secure, find and fix faults, and prevent misuse;
- measure usage for billing, once billing exists;
- meet legal obligations.
6. Our commitments
We have adopted the following policies:
- We do not sell personal information.
- We do not use conversation data from Meta's platforms to target or personalise advertising.
- We do not use customer conversations to train AI models.
These are commitments about how we handle information. They apply now and will continue to apply when the service is available.
At the current stage they are met by the way the service works: we show no advertising, no AI model provider is connected, and there are no customer conversations. Before the service becomes available we will put technical and contractual controls in place to uphold them, and this policy will describe those controls once they exist.
The third commitment covers our own use of conversations. How it will apply to the AI model providers we rely on is explained in the next section.
7. AI processing
The service is designed to use AI language models to understand incoming messages and draft replies. When that feature is active, the content of a conversation and the business's settings will be sent to an AI model provider so that a reply can be generated.
This feature is not active today. No AI model provider is connected, and we have not finalised which providers we will use.
Before any customer conversation is sent to an AI model provider, we will:
- use only providers whose terms and account settings, as they apply to our use, do not allow customer conversation content to be used to train their models;
- review how long each provider keeps the content it receives and what it logs;
- send a provider only the information needed to generate a reply;
- name the providers in this policy.
Until we have confirmed those points for a specific provider, we make no statement about how that provider handles information.
AI-generated replies can be wrong. Businesses will be able to have a person take over a conversation at any time, and to have conversations passed to a person automatically in situations they choose.
9. Information received from Meta
We access Instagram, Messenger and WhatsApp only through Meta's official APIs and with the permissions an account owner grants. We use the information we receive that way only to provide the messaging features described in this policy.
An account owner can withdraw that access at any time. Withdrawing access stops us from receiving anything further from the account. It does not delete information we already hold, which requires a separate deletion request. Our data deletion page explains both.
10. Security
What is in place today:
- We verify the cryptographic signature on every notification from Meta and reject anything that does not pass.
- Access credentials are kept out of our source code and are not written to our application logs.
- Our application logs are designed to record technical details about messages, not their content.
- Stored records are separated by business at the database level, so that one business's records cannot be read through another's access.
What we plan to have in place before businesses can connect their own accounts:
- Encryption of stored access credentials.
- Sign-in and role controls for business users.
- Controls that keep conversation content out of analytics and diagnostic logs.
These planned measures are not yet in place. We do not currently hold any security or privacy certification.
No system is perfectly secure, and we cannot guarantee the security of information.
11. How long we keep information
The service is in development and holds simulated test data. This is what applies today:
- Raw incoming events. Completed raw events are deleted automatically after 30 days. This is our current default and may change as the service develops.
- Conversation records. Contacts, conversations and messages are not deleted on an automatic schedule today. How long they are kept will be governed by a separate retention policy, which we will publish here before the service becomes available.
The controls that will let a business choose how long its customers' data is kept, and delete it, are still being developed. They are not available yet.
You can ask us to delete your information at any time; see our data deletion page. Where the law requires us to keep certain information, we will keep it for as long as the law requires.
12. Your choices
You can ask us what information we hold about you, ask us to correct it, or ask us to delete it, by emailing dmcloserlab@gmail.com. We may need to confirm your identity before acting on a request.
Depending on where you live, the law may give you additional rights over your personal information, including the right to complain to a privacy regulator. We will respond to requests in line with the law that applies to you.
Once the service is available: if you messaged a business that uses DM Closer Lab, that business decides how your conversation is used, and you can also contact the business directly. If you contact us, we will work with the business to respond.
13. Where information is processed
The providers we rely on may process information in countries other than the one you live in. Those countries may have different data protection rules.
14. Children
DM Closer Lab is a tool for businesses. It is not directed at children, and we do not knowingly collect information from children. If you believe a child has given us information, please contact us and we will delete it.
15. Changes to this policy
We will update this policy as the service develops, and in particular before it becomes available to customers. The date at the top of the page shows when it last changed.
16. Contact
Questions about this policy, privacy requests and deletion requests can be sent to dmcloserlab@gmail.com.