Privacy Policy

1. Introduction

Welcome to the MooseDM Privacy Policy. This Privacy Policy describes how we may collect and use personal data, and the rights granted to our visitors, merchants and their shoppers regarding their respective data. By accessing or using this website or any of our apps or services, you signify your approval of the terms set out in this Privacy Policy and the other terms and policies posted on our website. If you do not agree to this Privacy Policy, you must leave this website and discontinue all use of our Services.

We may update this Privacy Policy from time to time to reflect, for example, changes to our privacy practices or for other operational, legal or regulatory reasons. If we make material changes, we will give you notice by posting the revised policy on this website and, where appropriate, by other means. By continuing to use our apps, this website or any of our services after these changes are posted, you agree to the revised policy.

2. Information collected from Merchants

When you install MooseDM, we access certain information from your Shopify store through the permissions you approve during installation, including your store name, store URL, store owner name, contact email, and time zone; your product and collection catalog; and orders placed in your store, which we use to attribute sales to MooseDM conversations. If you or a staff member use the app, Shopify also provides us with that user's name, email address, and language preference.

When you connect your Instagram professional account, we receive, through Meta's Instagram Platform, your Instagram account ID and username, and an access token that lets MooseDM reply to comments and send messages on your behalf. For the posts you choose to automate, we store the media ID, caption and thumbnail. Access tokens for Shopify and Instagram are stored encrypted.

We also store the automation settings you create, including trigger keywords, reply and message templates, and linked products or collections.

We collect this information to provide our services to you: for example, to run your automations, attribute orders to your automations, confirm your identity, check that your store and messages comply with Meta's and Shopify's platform policies (including an automated review of product titles, types and tags), contact you, provide customer support and, where permitted, send you product updates and marketing, which you can unsubscribe from at any time.

3. Information collected from Merchants' shoppers

To run your automations and report on their results, MooseDM processes information about the Instagram users who interact with your posts and messages ("shoppers"), including:

Instagram username and Instagram-scoped user ID;
the text of comments left on posts you have automated, and the public replies MooseDM posts to those comments;
the content of messages sent and received through your automations, and related delivery records (time sent, delivery status, message ID and conversation status, including the 24-hour messaging window);
whether the shopper follows your Instagram account, when you use follow-gated DMs;
clicks on links sent through MooseDM (time of first open and number of opens), and the orders attributed to those clicks (order ID, order value, currency and order date);
the IP address of requests to our attribution endpoint, used only temporarily to prevent abuse and not stored.

MooseDM does not collect shoppers' names, email addresses, phone numbers, payment details or shipping addresses.

4. Information collected when you visit our Website

When you visit our website, we collect certain information about your device, including information about your web browser, IP address, time zone and some of the cookies installed on your device. We collect this information using the following technologies:

"Cookies" are data files placed on your device or computer that often include an anonymous unique identifier. For more information about cookies, including how to disable them, visit allaboutcookies.org.
"Log files" track actions occurring on the site and collect data such as your IP address, browser type, Internet service provider, referring and exit pages, and date and time stamps.
"Web beacons", "tags", and "pixels" are electronic files used to record information about how you browse the site.

5. Instagram Messaging Policy

MooseDM sends replies and messages only through Meta's official Instagram Platform, and only in response to an action a shopper has taken, such as commenting on an automated post or replying to a message. Merchants must use MooseDM in line with Meta's Platform Terms, Instagram's Community Guidelines and applicable messaging rules. To protect shoppers and keep accounts in good standing, we may pause an automation that is reported as spam, is restricted by Meta, or breaks these rules.

We share your personal information with the following third parties to help us conduct our business and support our merchants:

Meta (Instagram) — to read comments and send replies and messages through the Instagram Platform. You can read how Meta handles data at facebook.com/privacy/policy.
Shopify — to access your catalog and attribute orders. See shopify.com/legal/privacy.
We use Google Analytics to help us understand how our customers use our website and our apps. You can read more about how Google uses your Personal Information at google.com/intl/en/policies/privacy. You can also opt out of Google Analytics at tools.google.com/dlpage/gaoptout.
We use Loops for email marketing and to maintain our customer lists. You can read more about how Loops uses your Personal Information at loops.so/privacy.
We use MooseDesk to communicate with you and provide customer support when you contact us via email. You can read more about how MooseDesk uses your Personal Information at moosedesk.com/docs/moosedesk-policy.
We use Crisp to communicate with you and provide customer support when you contact us via live chat. You can read more about how Crisp uses your Personal Information at crisp.chat/en/privacy/.

We may also share your personal information to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request, or to otherwise protect our rights.

We may use your personal information to provide you with targeted advertisements or marketing communications we believe could be of interest to you. You can opt out of Facebook and Google targeted advertising at facebook.com/settings/?tab=ads and google.com/settings/ads/anonymous.

Personal information may also be shared with a company that acquires our business, whether through merger, acquisition, bankruptcy, dissolution, reorganization or a similar transaction or proceeding. If this happens, we will post a notice on our home page.

7. Cross-border transfer

MooseDM processes and stores personal information using servers based in the United States. If you are located outside the United States, your personal information and other information we collect through this website and our apps may be transferred to the United States. By accepting this Privacy Policy, using our apps or this website, or providing us with any personal information, you agree to this transfer.

8. Use of MooseDM by Children

MooseDM is not intended for children. If you are under 13, you may use the site and services only with the supervision of your parent or guardian.

9. Your Rights

We understand that you have rights over your personal information, and we take reasonable steps to allow you to access, correct, amend, delete, port or limit the use of it. If you are a merchant and wish to exercise these rights, please contact us at help@moosedm.io. We may require acceptable verification of your identity before providing access to such information.

If you are a shopper and wish to exercise these rights, please contact the merchant you interacted with directly. We act as a processor on the merchant's behalf and can only forward your request to them so they can respond.

Deleting your data: merchants can stop all processing at any time by disconnecting their Instagram account in MooseDM or uninstalling the app. Anyone can request deletion of their data by emailing help@moosedm.io with the Instagram username concerned.

10. Retention

Your personal data and your store's data will be deleted within 48 hours after the app is uninstalled. If you would like your data removed immediately, whether you are a merchant or a shopper, please contact us at help@moosedm.io. We may require acceptable verification of your identity before acting on the request.

11. Security incident response policy

The purpose of this policy is to provide a structured approach to detecting, reporting, assessing and responding to security incidents, in order to minimise their impact on business operations, reputation and assets.

Incident severity scales

Level 1 (Low): incidents that have a minor impact and can be resolved quickly without causing significant damage.
Level 2 (Moderate): incidents that have a noticeable impact on the organisation and require immediate attention to avoid further damage.
Level 3 (High): incidents that have a severe impact on the organisation's operations and require immediate action to contain and resolve.

Roles and responsibilities

Incident Response Team (IRT): the team responsible for responding to security incidents, consisting of IT staff, security personnel and any other relevant stakeholders.
Incident Coordinator: the person responsible for managing the incident response process, including coordinating with the IRT and other stakeholders, assessing the severity of the incident and ensuring the response is effective.
IT/Security Staff: responsible for identifying, investigating, and resolving security incidents.

Escalation paths

Incident reporting: all incidents must be reported to the IRT as soon as they are identified, through a dedicated reporting system, email address, or phone number. The report should describe the incident, its impact, and any relevant evidence.
Initial assessment: the IRT conducts an initial assessment to determine severity and impact, and may escalate the incident to a higher level.
Level 1: the IRT may resolve the incident without further escalation, for example by applying temporary fixes, security patches, or policy updates.
Level 2: the IRT escalates to the Incident Coordinator, who determines the appropriate response, brings in additional resources if needed, and keeps management and legal informed.
Level 3: the IRT escalates to senior management or executive leadership. This may involve activating the emergency response plan or bringing in outside experts. The Incident Coordinator continues to coordinate the response, with additional oversight from leadership.

Evidence collection

As soon as an incident is detected or reported, all relevant systems, devices and logs are preserved to prevent further modification or deletion of data, including system logs, network traffic and application data.

Required actions

Identification: all employees are trained to identify and report security incidents as soon as they are detected, including suspicious activity, unauthorised access, data breaches and malware infections.
Categorisation: the IRT assesses and categorises the incident on the predefined severity scale to determine the level of response.
Containment: the IRT acts immediately to contain the incident, for example by isolating affected systems, disabling network connections or shutting down affected services.
Analysis: the IRT determines the root cause and identifies indicators of compromise, using system logs, network traffic and other relevant data.
Response: the IRT develops a response plan based on severity and impact, with clear procedures for communication and coordination.
Recovery: the IRT restores normal operations as soon as possible while keeping systems and data secure, for example by restoring from backups, patching vulnerabilities or rebuilding systems.
Review: after resolution, the IRT runs a post-incident review to capture lessons learned and update this policy and its procedures.

12. Contact information

If you have any questions about your personal data or this Privacy Policy, or would like to file a complaint about how we process your personal data, please contact us at help@moosedm.io.