Privacy and data protection

DMLY gives you the tools to handle personal data responsibly. This page explains DMLY’s privacy posture and, just as importantly, where DMLY’s responsibility ends and yours begins.

​

Who is responsible for what

When you use DMLY to message and manage your own customers, you are the data controller for those contacts: you decide what to collect and why. DMLY is the processor, storing and handling that data on your behalf so the platform can work. That split matters: DMLY secures the platform and provides the controls, but decisions like what consent you have, how long you keep a record, and how you answer a customer’s data request are yours to make. If you resell DMLY as an agency, your own clients are controllers for their contacts, and you sit in the processing chain between them and DMLY.

​

GDPR

DMLY is built to support your compliance with the GDPR and upholds its core principles: lawful processing, data minimisation, and a person’s right to access and to have their data deleted. The platform gives you the mechanisms to act on those rights; you decide when a given request is valid and act on it.

​

The data rights, in the product

​

Consent and opt-out

DMLY enforces opt-out across every automated send path and keeps a required Unsubscribe tag in step with it, so a contact who sends STOP is dropped from broadcasts, sequences, automations and reminders. Note that opt-out does not disable a manual reply from the inbox; for that, block the contact. The exact behaviour of each control is on Data, privacy and consent.

​

Third parties and sub-processors

DMLY relies on infrastructure providers to run the platform, and the channels and payment providers you connect (such as WhatsApp/Meta, Telegram, and your payment gateway) process the relevant data too when you send through them. Connecting a channel or a gateway means data flows to that provider under its own terms, which is inherent to using it.

​

Data retention

DMLY keeps the data in your workspace for as long as your account is active and you keep it there. Your CRM records (contacts, appointments, invoices, payments, and the messages in a conversation you have not archived) are not aged out on a schedule. They stay until you delete them, or until you close the account, after which they are removed in line with DMLY’s operational and legal requirements. A few things do age out on their own, and you should plan around them:

• An archived conversation is permanently deleted 30 days after you archive it, taking its messages and attachments with it, and the contact too if that was their only conversation. See Conversation status.
• Audit log entries are kept for 180 days. See Audit log.
• The Logs activity feed keeps only the newest 300 entries per workspace, and trims daily. See Logs.
• In-app alerts, and DMLY’s own internal delivery bookkeeping, are cleared on their own short cycles.

None of those windows can be changed from inside the app.

​

Making a privacy request

For a data request about your own account or business (a DPA, a data-residency question, or a formal privacy enquiry), contact DMLY. For a request from one of your customers about their data, you handle it yourself using the tools above, as the controller for that relationship.