Privacy Policy

This Privacy Policy explains how Lachlan Wainwright, operating HiddenDMs at hiddendm.com ("we", "us", "our"), collects, uses, stores, and shares information when you use our Service. We are based in Australia.

By using HiddenDMs, you acknowledge this Privacy Policy. If you do not agree, please do not use the Service.

1. Who this applies to

This policy applies to visitors and users of hiddendm.com worldwide, including people who run DM checks without creating an account and people who sign up for a dashboard. The Service is intended for users aged 18 and over only.

2. Information we collect

Instagram username. Your public @handle is required to run a DM check. We use it to assign test accounts, track pool usage, link activity to your account, and operate the dashboard.

Survey answers. Before your first check, we ask questions about your outreach (such as what you offer, DM volume, account type, and how long you have been doing outreach). Returning users with completed onboarding are not asked again unless we change the survey.

Test DM message content. When you send your test message to our assigned account, we read and process the message text and related metadata so we can detect whether it landed in Hidden Requests or normal Message Requests. We store the detection outcome and associated message data needed to operate and improve the Service.

Email and password (dashboard). If you create an account, we collect your email address and a hashed password through our authentication provider to secure your dashboard session.

Check and result data. We store assignment details, whether your test message was detected as hidden or normal, timestamps, status, and related technical metadata.

Referral data. If you arrive via a referral link or share your own, we store referral codes and whether a referred user completed their first check.

Communications. If you contact us by email or Instagram, we keep the information you send us so we can respond and maintain records of support or privacy requests.

Cookies and similar technologies. See our Cookie Policy for details on essential cookies (including Meta Pixel ad measurement) and optional cookies.

3. Information we do not collect

We never ask for your Instagram password or login credentials. You send your test DM yourself from your own Instagram account. We do not request government ID, payment card details for the current free Service, or access to your private Instagram inbox beyond what is needed to receive and process your test message to our test account.

4. How we use information

We use personal information to:

• run DM checks and deliver results to you
• send Instagram replies and follow-up messages related to your check
• enforce pool availability and referrals
• operate and secure the signed-in dashboard
• send service-related emails and, where permitted, marketing emails
• improve the Service, fix bugs, and develop new features
• conduct aggregated market research and analytics (not identifying you publicly)
• prevent abuse, fraud, and misuse
• comply with legal obligations and respond to requests

We may analyse survey responses and check outcomes in aggregate to understand outreach trends and improve HiddenDMs. We do not sell individual survey responses.

5. Legal bases (EEA, UK, and similar regions)

Where privacy laws such as the GDPR or UK GDPR apply, we rely on the following legal bases:

• Contract / steps at your request: to run your check, deliver results, operate your account, and provide the Service you ask for
• Legitimate interests: to improve the Service, prevent abuse, conduct aggregated research, and communicate about the Service in a proportionate way
• Consent: for optional cookies (unless rejected) and marketing emails where consent is required; you may withdraw consent at any time
• Legal obligation: where we must retain or disclose information to comply with law

6. How we share information

We use trusted service providers to host the website, store data, authenticate users, process check assignments, and detect incoming test messages. These providers process information on our instructions and only as needed to operate the Service. We do not name specific vendors publicly in this policy.

We may also share information if required by law, court order, or government request, or to protect the rights, safety, and security of HiddenDMs, our users, or others.

We do not sell your personal information. We do not share your personal information with third parties for their own independent marketing purposes.

7. International transfers

HiddenDMs is operated from Australia and may use service providers in Australia and other countries. If you access the Service from outside Australia, your information may be processed in countries with different data protection laws. Where required, we take reasonable steps to protect transferred information through contractual and organisational safeguards.

8. Retention

We keep check data, survey answers, message content, account information, and related records for as long as needed to operate the Service, maintain accurate history, enforce limits, and meet legal obligations. Generally, we retain information until you request deletion or close your account, subject to limited retention where we must keep certain records for security, dispute resolution, or legal compliance.

9. Security

We use reasonable technical and organisational measures to protect personal information, including access controls and secure infrastructure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or port your personal information, and to withdraw consent where processing is based on consent.

Australia: You may request access to or correction of personal information we hold about you, and complain to the Office of the Australian Information Commissioner (OAIC) if you believe we have handled your information improperly.

EEA / UK: You may lodge a complaint with your local data protection authority. Our contact details are below if you wish to exercise your rights.

California: We do not sell personal information. California residents may have rights to know, delete, and correct personal information, and to limit certain uses of sensitive personal information where applicable. We will not discriminate against you for exercising privacy rights.

Marketing emails: You can unsubscribe using the link in any marketing email or by contacting us.

Cookies: You can accept or reject optional cookies via our cookie banner. See the Cookie Policy for more.

11. Account and data deletion

Self-serve account deletion is not yet available in the dashboard. To request deletion of personal information tied to your account or checks, contact us using the details below. We will make reasonable efforts to action verified requests promptly, subject to any information we must retain by law or for legitimate operational needs (such as fraud prevention).

12. Internal access

Access to user check history, survey responses, and stored message content is limited to Lachlan Wainwright and team members or contractors who need access to operate, support, or secure the Service, under confidentiality obligations.

13. Children

HiddenDMs is not directed to anyone under 18. We do not knowingly collect personal information from minors. If you believe a person under 18 has provided us information, contact us and we will take reasonable steps to delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will change when we do. Material changes may be communicated through the Service or by email where appropriate. Continued use after changes take effect means you acknowledge the updated policy.

15. Contact

Privacy questions, rights requests, or complaints:

• Email: lachie@hiddendm.com
• Instagram: @usehiddendms

Operator: Lachlan Wainwright, Australia.