One Black Pixel

Privacy Policy

Effective date: February 24, 2026 · Last updated: June 16, 2026

One Black Pixel, LLC ("One Black Pixel," "we," "us," or "our") operates the VNDY platform and DM Agent service. This Privacy Policy explains how we collect, use, disclose, and protect personal information across all of our products and services (collectively, the "Services"). By using our Services, you agree to the practices described below.

If you are an Instagram user who received a message from a seller using DM Agent, please see Section 6 for information specific to you.

1. Who this policy covers

This policy applies to three groups:

Sellers — businesses and individuals who connect their Instagram account to DM Agent or use the VNDY platform to manage and sell products.
Buyers — individuals who purchase products through the VNDY platform or interact with a seller's Instagram account through our automated messaging system.
Visitors — anyone who visits our websites or accesses our Services without registering.

Individual merchants using the VNDY platform maintain separate privacy practices for their own customer relationships. When you purchase directly from a merchant, their privacy policy governs that relationship.

2. Information we collect

From sellers:

Name, email address, and account credentials for the seller dashboard
Instagram account information (username, account ID, connected Facebook Page) obtained via Meta's official OAuth authorization flow
Instagram media posts, captions, images, and videos from your connected account
Direct message content sent to and from your Instagram account while our automation is active
Business settings, inventory data, pricing, and negotiation parameters you configure
Banking and payout information processed through Stripe Connect

From buyers:

Instagram username and user ID (when interacting via direct message)
Message content sent to a seller's Instagram account
Name, email address, and shipping address provided during checkout
Payment card details — these are processed directly by Stripe and are never stored by One Black Pixel

Automatically collected:

Device type, browser type, and operating system
IP address and general location (country/region)
Pages visited, session duration, and feature usage within the seller dashboard
Service logs, error reports, and performance data

3. How we use your information

Operate and deliver the Services, including inventory management, automated messaging, and order processing
Parse Instagram post captions using AI to extract product details and create inventory listings
Route buyer direct messages to the appropriate seller account and generate automated responses
Process payments and manage seller payouts via Stripe
Provide customer support and respond to inquiries
Send transaction confirmations, service updates, and account notifications
Detect, prevent, and investigate fraud, abuse, security incidents, and illegal activity
Comply with legal obligations and enforce our Terms of Service
Improve the accuracy and performance of our AI-powered features

4. Instagram and Meta data

We access seller Instagram account data exclusively through Meta's official Graph API, using permissions explicitly granted by each seller. We request only the permissions necessary to operate the Service:

Permission	Why we need it
instagram_business_basic	Read your Instagram account profile and media posts to build and manage your inventory
instagram_business_manage_messages	Read incoming buyer direct messages and send automated responses on your behalf
instagram_business_manage_comments	Read and moderate comments on your product posts

We do not use Instagram data for advertising, audience targeting, or any purpose beyond operating the Service. We do not sell or share Instagram data with third parties for their own marketing purposes.

Instagram media URLs served by Meta's CDN expire after a short period. We download and store product images to Firebase Storage immediately upon receipt to ensure continued availability. We do not retain Meta CDN links.

Sellers may revoke our access to their Instagram account at any time through Instagram Settings → Apps and Websites. Revoking access will disable automated messaging and inventory injection for that account.

5. AI and automated processing

DM Agent uses artificial intelligence to perform two automated functions:

Caption parsing — Instagram post captions are analyzed by AI to extract product details (brand, size, condition, price, item code) and populate your inventory automatically.
Buyer messaging — Incoming buyer direct messages are processed by AI to generate appropriate automated responses, including checkout links and negotiated pricing.

Both functions use Anthropic's Claude API. Message and caption content is transmitted to Anthropic solely to generate responses and is governed by Anthropic's Privacy Policy. We do not permit Anthropic to use your data to train their models.

Automated responses are sent without human review of individual messages. Sellers can monitor all activity from their dashboard and may disable automation at any time. Floor prices and negotiation parameters set by sellers are never revealed to buyers — all negotiation logic runs on our servers.

6. Information about Instagram users (buyers)

If you sent a direct message to an Instagram seller account that uses DM Agent, your Instagram username, user ID, and message content were received by our system to generate an automated reply. We use this information only to facilitate the transaction you initiated. We do not build profiles of buyers, use buyer data for advertising, or share buyer data with third parties except as necessary to complete your order (e.g., passing your shipping address to the seller for fulfillment).

Buyer message content is retained for 180 days and then deleted. Order records are retained for 7 years for financial compliance purposes.

7. Sharing your information

We do not sell personal information. We share information only in the following circumstances:

With sellers — buyer shipping addresses and order details are shared with the seller responsible for fulfillment
With service providers — third parties who help us operate the Services (see Section 8) receive data only as necessary for their function
For legal compliance — we may disclose information if required by law, court order, or to protect the rights and safety of our users or the public
In a business transfer — if One Black Pixel is acquired or merges with another entity, your information may be transferred as part of that transaction, subject to equivalent privacy protections

8. Third-party service providers

Provider	Purpose	Privacy policy
Meta / Instagram	Instagram account access via Graph API	Meta Privacy Policy
Stripe	Payment processing and seller payouts	Stripe Privacy Policy
Google / Firebase	Database, file storage, authentication, cloud functions	Google Privacy Policy
Anthropic	AI-powered caption parsing and message generation	Anthropic Privacy Policy

9. Data retention

Seller account and profile data — retained for the duration of your subscription and deleted within 90 days of account closure upon written request
Order records — retained for 7 years to comply with financial and tax regulations
Instagram direct message content — retained for 180 days, then deleted
Product media files — retained until you remove the associated listing
Service logs — retained for 90 days

We may retain certain information longer where required by law, to resolve disputes, or to enforce our agreements.

10. Data security

We protect your information using industry-standard measures including:

Encryption in transit using TLS for all data transmission
Encryption at rest in Firebase Storage and Realtime Database
Role-based access controls enforced at the database level, with tenant isolation preventing any seller from accessing another seller's data
Secure secret management for all API credentials
Payment card details processed exclusively by Stripe — One Black Pixel never stores payment card numbers

No method of transmission over the internet or electronic storage is completely secure. If you believe your account has been compromised, contact us immediately at support@oneblackpixel.com.

11. Your rights and choices

Depending on your location, you may have the right to:

Access the personal data we hold about you
Request correction of inaccurate or incomplete data
Request deletion of your personal data, subject to legal retention requirements
Object to or restrict certain types of processing
Receive your data in a portable, machine-readable format
Withdraw consent at any time where processing is based on consent
Opt out of marketing communications using the unsubscribe link in any email we send

To exercise any of these rights, contact us at support@oneblackpixel.com. We will respond within 30 days. We may need to verify your identity before processing your request.

Sellers may also revoke Instagram access at any time through Instagram Settings → Apps and Websites → DM Agent.

12. Children's privacy

Our Services are not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and notify active users by email at least 14 days before the changes take effect. Your continued use of the Services after the effective date constitutes your acceptance of the updated policy.

14. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

One Black Pixel, LLC

Email: support@oneblackpixel.com

Website: oneblackpixel.com