Privacy Policy

1. Introduction

This Privacy Policy explains how ScaleUp Works LLC, doing business as SocialMedia DMs ("SocialMedia DMs," "we," "us," or "our"), collects, uses, discloses, and protects information in connection with the website at socialmediadms.com and any associated subdomains (the "Site"), the SocialMedia DMs web application, and the SocialMedia DMs browser extension for Google Chrome and other compatible browsers (the "Extension"). The Site, web application, and Extension are referred to together as the "Services."

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Services.

Note on platform status: Certain pages on the Site (including pricing and contact pages) are still under construction. Where this policy references information you can submit through such a page, that channel may not yet be live; in the interim, please use the contact details in Section 16.

2. Who we are

Email addresses on this page are shown in an obfuscated “name at domain” format to reduce automated spam collection. Replace “ at ” with the @ symbol when contacting us.

Key terms

To help you read this policy, some key terms are used as follows:

Personal information (personal data): any information relating to an identified or identifiable individual.

Sensitive personal information (special category data): information such as government identifiers, financial account or login credentials, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, trade union membership, genetic or biometric data, data concerning health, sex life, or sexual orientation, and the contents of communications where we are not the intended recipient.

Controller (business): the party that determines the purposes and means of processing personal information. Processor (service provider): a party that processes personal information on behalf of, and on the instructions of, a controller or business.

3. Scope and your role

SocialMedia DMs is a business tool used by professionals to manage outreach on social platforms. This policy distinguishes between two categories of individuals:

• Customers and visitors: people who create an account, subscribe to a plan, install the Extension, or visit the Site. For this information, SocialMedia DMs generally acts as a data controller.
• Recipients and prospects: third parties whose publicly available social profile information is surfaced through the Lead Finder feature, or who receive or exchange messages with our
• customers through the Services. For this information, the customer who operates the account directs the processing, and SocialMedia DMs generally acts as a data processor on that customer’s behalf (see Section 8).

4. Information we collect

4.1 Information you provide

• Account information: name, email address, business name, and login credentials when you register.
• Billing information: subscription tier and transaction records. Card and bank details are collected and processed directly by our payment processor, Stripe; we do not store full payment card numbers on our own systems.
• Communications: messages you send to support, sales, partnerships, or other inboxes, and your responses to our emails and surveys.
• Content you create: message sequences, templates, campaign settings, saved searches, notes, and other configuration you enter into the Services.
• Subscription and usage records: your plan tier, Lead Credit balances and usage history, billing history, and similar account records.
• If you do not provide personal information that is necessary to provide the Services, we may be unable to provide the Services, or certain features of them, to you.

4.2 Information about connected social accounts

To run outreach on your behalf, the Services connect to the social media account(s) you choose to link (for example, your Instagram account). Depending on the feature you use, this may involve:

• Account and session access: the Extension operates within your own logged-in browser session to act on your linked account. We process the information needed to send and sequence messages, detect replies, and report activity back to your dashboard.
• Conversation data: the content, timing, and status of messages sent, received, and queued through the Services, so you can manage conversations, track replies, and measure booked meetings.
• Profile and engagement signals: limited information about the accounts you target or that respond to you, used to personalize sequences and report performance.

We do not ask for or store the passwords of your linked social accounts. Your linked account remains

governed by that platform’s own terms and policies (see Section 11).

4.3 Lead Finder information

The Lead Finder feature helps you build prospect lists by searching publicly available social profile information using criteria such as keyword, hashtag, and location. Information surfaced through Lead Finder may include public profile fields (for example, username, display name, public bio, follower counts, and other openly visible details). Lead Finder returns information that is already publicly accessible on the relevant platform; it is provided to help you identify relevant business prospects.

You are responsible for using Lead Finder results lawfully and in accordance with applicable laws and platform terms, including any consent, anti-spam, and data-protection obligations that apply to your outreach (see Section 8 and our Terms & Conditions).

4.4 Information collected automatically

• Usage and device data: IP address, browser type, operating system, pages viewed, referring URLs, feature usage, and timestamps.
• Cookies and similar technologies: including analytics cookies, advertising pixels, and affiliate-referral cookies. See Section 9.

4.5 Help Center and AI support assistant

Our Help Center (the “SocialMedia DMs Help Center,” located at help.socialmediadms.com) includes an AI support assistant, the “SocialMedia DMs Help Assistant.” When you ask the Help Assistant a question, your question and the most relevant help-article content are sent to a third-party AI provider that generates a response on our behalf. Your conversation with the Help Assistant is stored only within your current browser tab and is cleared when you close that tab. Inputs you provide to the Help Assistant are not used to train general-purpose or third-party AI models. Please do not enter sensitive personal information into the Help Assistant; for account-specific issues, contact support at socialmediadms.com.

5. Browser extension privacy practices

To provide our services, the SocialMedia DMs browser extension (the “Extension”) operates within your active, logged-in Instagram session in your own browser. This section describes exactly what the Extension accesses, why, and how that information is used.

5.1 Single purpose

The Extension has one purpose: to power the SocialMedia DMs platform’s direct-message automation, sequencing, reply detection, and dashboard syncing features. Every permission it requests and every category of data it accesses exists to deliver that core functionality.

5.2 Personal communications and lists

To sync your activity to your SocialMedia DMs dashboard and manage your outreach, the Extension reads and transmits:

• Instagram Direct Messages: the full content of the direct-message conversations associated with your connected account — including both your own messages and the messages of the people you exchange messages with (your prospects and recipients), together with sender and recipient names, message text, and timestamps — so the platform can detect replies, manage conversations through your Inbox, and report results. These conversation threads are stored on our servers to power the Inbox and reporting features (see Sections 5.4 and 15).
• Follower and audience lists: your Instagram follower lists and related audience information, used to build and manage prospect lists and to target and sequence your outreach.

This information is transmitted to and stored on our servers so it can be displayed in your SocialMedia DMs Inbox and dashboard, where you manage conversations and campaigns in one place. The Inbox loads these conversations from our servers rather than live from Instagram.

5.3 Cookies and authentication

The Extension accesses your active Instagram session cookies (such as your session user-identifier and security-token cookies) solely to authenticate your existing logged-in session. These session cookies and tokens remain within your own browser and are not stored on our servers. This allows the Extension to act on your behalf within your active session, and to sync your data securely, without asking you to share or re-enter your Instagram password. We do not request, collect, or store your Instagram password.

5.4 Permissions and local operation

The Extension requests only the permissions it needs to function:

• Host permissions: to interact with supported social media websites while you are using them.
• Storage permission: to save your settings, preferences, and campaign data locally.
• Cookie access: to read your active session cookies for authentication, as described in Section 5.3.
• Additional permissions: requested only when required for a specific feature, and used solely to provide that feature.

How the Extension operates:

• Local vs. transmitted: the Extension runs in your own browser on your device. Session authentication is handled locally in your browser (see Section 5.3), while the conversation content, follower/audience lists, and the data needed for the Inbox, dashboards, reporting, and sequencing are transmitted to and stored on our servers.
• No unrelated browsing data: the Extension does not read or collect data from websites or browser activity unrelated to the SocialMedia DMs features you actively use.

5.5 How extension data is used — and not used

All data collected through the Extension is used exclusively to provide the core direct-message automation and syncing features of the SocialMedia DMs platform. We do not sell, rent, or share your personal communications or session data with data brokers or any third party for their own purposes. We do not use this data for third-party advertising, to build advertising profiles, or to determine creditworthiness or for lending purposes.

6. How we use information

We use information to:

• Provide, operate, secure, and maintain the Services;
• Authenticate users, process subscriptions, and deliver customer support;
• Run, sequence, and report on outreach campaigns you configure;
• Power the Lead Finder feature and other product functionality;
• Detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms;
• Improve and develop the Services, including analytics and product research;
• Communicate with you about updates, security, billing, and (where permitted) marketing; and
• Comply with legal obligations and enforce our agreements.

7. Legal bases for processing (EEA/UK users)

If you are in the European Economic Area or the United Kingdom, we process personal data under one or more of these legal bases: performance of a contract (to provide the Services you request); legitimate interests; consent (for certain cookies and marketing); and compliance with legal obligations. Where we rely on legitimate interests, those interests are: securing and protecting the Services and our users; preventing fraud and abuse; operating, improving, and developing our products; and promoting our Services to existing and prospective customers in a balanced way that respects your rights. Where we rely on consent, you may withdraw it at any time - for marketing, by using the unsubscribe link or contacting privacy at socialmediadms.com, and for cookies, through your browser settings or our cookie banner - without affecting processing already carried out. We will only process special category personal data with your explicit consent or where another Article 9 condition applies.

Your rights. If you are in the EEA or UK, you have the following rights, subject to conditions: access; rectification; erasure; restriction of processing; data portability; objection (including to processing based on legitimate interests and to direct marketing); withdrawal of consent; the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects; and the right to lodge a complaint with your supervisory authority. To exercise any right, contact privacy at socialmediadms.com.

Automated decision-making and profiling. We do not make decisions that produce legal or similarly significant effects concerning you based solely on automated processing, including profiling. Where profiling is used to personalize outreach sequences or measure performance, it does not have legal or similarly significant effects on the individuals concerned.

Notice to prospects and recipients (Article 14). Where personal data about prospects and recipients is processed through Lead Finder or the Extension, that data (such as public profile fields and message content) is obtained from the relevant social platform or from the customer's account rather than from the individual directly. For that activity the customer acts as controller, determines the purposes and lawful basis, and, where required, is responsible for providing Article 14 notice to the individuals concerned. Where SocialMedia DMs acts as controller of such data, we provide this policy as notice and will honor applicable data subject rights.

Your rights under the CCPA/CPRA (California and other U.S. states)

Categories, sources, and recipients. In the preceding 12 months, we have collected the categories of personal information described in Section 4 (identifiers; commercial and subscription information; internet or network activity; and content you provide). We collect this information from you directly, from your connected social accounts and their platforms, from cookies and similar technologies, from our service providers, and from publicly available sources surfaced through Lead Finder. We disclose these categories to the categories of recipients described in Section 10 (service providers/subprocessors; affiliates and partners; legal and safety recipients; and parties to a business transfer).

Sale, sharing, and opt-out. We do not sell your personal information for monetary consideration, and we do not sell your prospect lists. Certain advertising-related cookie activity described in Section 9 may constitute "sharing" or a "sale" under some U.S. state laws; where it does, the categories involved are online identifiers and internet or network activity, disclosed to advertising and analytics partners for targeted advertising and measurement. You have the right to opt out of such sale or sharing and of targeted advertising by visiting our "Do Not Sell or Share My Personal Information" page at https://socialmediadms.com/do-not-sell-or-share or by contacting privacy at socialmediadms.com. We also honor opt-out preference signals, such as the Global Privacy Control (GPC), transmitted by your browser. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

Sensitive personal information. To the extent we process any sensitive personal information, we use and disclose it only for the purposes permitted under the CCPA/CPRA, such as providing the Services you request, ensuring security and integrity, and performing services on our behalf. You have the right to limit the use and disclosure of your sensitive personal information; to exercise it, contact privacy at socialmediadms.com.

Rights to know, access, correct, and delete. Subject to applicable law, you may request to know and access the specific pieces and categories of personal information we have collected, the sources, the purposes, and the categories of third parties; to correct inaccurate information; and to delete your personal information. You may make access or data portability requests up to twice in a 12-month period.

Deletion exceptions. We may retain personal information despite a deletion request where reasonably necessary to: complete a transaction or provide a good or service you requested; ensure security and integrity; debug and repair errors; exercise or protect legal rights or free speech; comply with the California Electronic Communications Privacy Act; conduct public-interest research with your consent; enable internal uses aligned with your expectations; comply with a legal obligation; or otherwise lawfully use the information in a manner compatible with the context in which you provided it.

Non-discrimination and non-retaliation. We will not retaliate or discriminate against you for exercising your rights. We will not deny you goods or services, charge different prices or rates, or provide a different level or quality of goods or services because you exercised your rights, except where a difference is reasonably related to the value provided by your personal information or in connection with a lawful financial incentive or loyalty program offered consistent with applicable law.

Verification and authorized agents. To protect your information, we will verify your identity before responding, which may require you to provide sufficient information to identify you and, where appropriate, proof of identity. Information provided for verification is used only for that purpose. You may use an authorized agent where permitted by law. We will respond within the timeframes required by law.

Appeals (other U.S. states). If you are in a U.S. state that provides a right to appeal (such as Virginia, Colorado, Connecticut, Texas, Oregon, and Montana) and we decline to take action on your request, you may appeal that decision by contacting privacy at socialmediadms.com with the subject line "Privacy Appeal." The appeal process is as easy to use as our process for submitting the underlying request. We will respond in writing, describing any action taken or not taken and the reasons for it, within the timeframe required by applicable law (for example, 60 days in Virginia and 45 days in Colorado, subject to permitted extensions). If we deny your appeal, we will also provide information on how you may contact your state Attorney General to submit a complaint.

8. Customer-directed processing and prospect data

When you use the Services to find, contact, or message third parties, you determine who is contacted and what is sent. For that activity, you act as the controller of the relevant personal data, and SocialMedia DMs acts as your processor, handling the data only to provide the Services and on your instructions.

As a controller, you are responsible for having a lawful basis for your outreach and for honoring the rights of the people you contact. If a prospect or recipient contacts us directly about data processed on a customer’s behalf, we will refer them to the relevant customer or assist that customer in responding, as appropriate. Our processing of personal data on your behalf is governed by our data processing agreement, the terms of which are incorporated into and form part of the customer Terms & Conditions. You can review our data processing agreement at legal.socialmediadms.com/dpa.

9. Cookies and tracking technologies

We and our service providers use cookies, pixels, and similar technologies for the following purposes:

• Strictly necessary: authentication, security, and core functionality.
• Functional / session: to keep you signed in, maintain your dashboard session, and remember your preferences.
• Live chat support: to operate our “ScaleUp Works Live Chat” support widget, which lets you

reach us for assistance from within the Services.

• Analytics: to understand how the Site and product are used.
• Advertising: advertising and conversion pixels (for example, from major ad platforms) to measure and improve campaigns.
• Affiliate referral: our affiliate program uses referral cookies (with attribution windows of up to 90 or 180 days, depending on the campaign) to credit affiliates for referred sign-ups.

You can control cookies through your browser settings and, where offered, our cookie banner. Restricting some cookies may affect functionality.

10. How we share information

We do not sell, rent, or lease your account data or your prospect lists, and we do not sell your personal information for money. We share information only as described below:

• Service providers (“Sub Processors”): vendors that help us run the business under contract, in the following categories: payment processing (Stripe), customer-relationship management and marketing automation, transactional and marketing email delivery, affiliate payout processing, cloud hosting and infrastructure, the third-party technology that powers the Extension, Inbox, and direct-message automation features, analytics, our Help Center and AI support assistant, and the data layer that powers Lead Finder. These providers may process information only as needed to perform services for us and on our instructions.
• Affiliates and partners: limited information needed to administer our affiliate and partner programs.
• Legal and safety: where required by law, to respond to lawful requests, or to protect rights, safety, and the integrity of the Services.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

A current list of Sub Processors is available on request at privacy at socialmediadms.com. Some advertising-related sharing may be considered “sharing” or “sale” under certain U.S. state laws; see Section 9 for your opt-out rights.

11. Third-party platforms

The Services interact with third-party social media platforms (for example, Instagram, which is operated by Meta Platforms, Inc.). SocialMedia DMs is an independent product and is not endorsed by, sponsored by, affiliated with, or otherwise associated with Meta, Instagram, or any other third-party platform. Your use of those platforms remains subject to their own terms and privacy policies, and we are not responsible for their practices.

12. Data retention

We retain personal information for as long as your account is active and as needed to provide the Services, then for a limited period afterward to comply with legal, tax, accounting, and dispute-resolution obligations. Except where a longer period is required by law, our current retention periods are: account and billing records - 7 years after account closure; conversation threads and lead data - until you delete them or, if earlier, 24 months after collection; and usage and device logs - 12 months. You can delete your data, including your stored conversation threads and lead data, from within the Services; when you delete, the data is permanently removed (a hard delete, with no retained soft-deleted copy), subject to limited records we must keep by law. When it is no longer necessary to retain personal information, we delete or anonymize it.

13. Your privacy rights

13.1 All users

You may request to access, correct, or delete your account information, and you may opt out of marketing emails using the unsubscribe link or by contacting us.

13.2 EEA/UK (GDPR/UK GDPR)

If you are in the EEA or UK, your rights and how to exercise them are described in Section 7.

13.3 California and other U.S. states

If you are a California resident or in another U.S. state with applicable privacy laws, your rights and how to exercise them are described in Section 9.

14. International data transfers

We are based in the United States and may process information in the U.S. and other countries. Where we transfer personal data from the EEA, UK, or other regions, we use appropriate safeguards such as Standard Contractual Clauses or other lawful transfer mechanisms.

15. Security and children

We use administrative, technical, and organizational measures designed to protect personal information, and we limit access to authorized personnel who are subject to confidentiality obligations. All data is encrypted in transit using industry-standard TLS. Certain sensitive items — such as database credentials and payment-processor (Stripe) tokens — are also encrypted at rest. Direct-message conversation content stored to power the Inbox is currently held in our database and is being migrated to encryption at rest, which we expect to complete by January 1, 2027. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach, we will notify affected individuals and the applicable supervisory authority or regulator where we are legally required to do so, and within the timeframes required by applicable law.

The Services are intended for business users aged 18 and older and are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us so we can delete it.

16. Changes and contact

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the “Last updated” date and, where appropriate, by additional notice. Your continued use of the Services after an update constitutes acceptance of the revised policy.

Questions or requests:

• Privacy: privacy at socialmediadms.com
• Legal notices: legal at socialmediadms.com
• Mail: ScaleUp Works LLC, 2351 W Atlantic Blvd, Unit 668144, Pompano Beach, FL 33069, USA

Alternative formats: If you would like this policy in another format (for example, large print, audio, or braille), please contact us using the details above and we will do our best to accommodate your request.