सबसे बढ़िया जवाब
It is allowed, and there is nothing to keep quiet about, as long as the messages go out through Instagram's own Messaging API.
Meta built that API so businesses could answer people at scale. Using it is the supported path, not a loophole. The setup makes that obvious: your account has to be a Business or Creator account, it has to be linked to a Facebook Page, and you approve the tool on Meta's own login screen. Meta sees every send.
The grey area your freelancer is thinking about is a different practice that also gets called Instagram automation. Tools that ask for your Instagram password, log in as you, mass follow, or send DMs to people who never contacted you are breaking the platform terms. They are also the ones that get accounts restricted. The giveaway is the password: the official path never asks for it.
What the rules actually restrict on the supported path:
- The other person has to open the conversation first. A comment, a DM, a story reply, or a button tap counts.
- After their last message you get a 24 hour window for free form replies.
- Rate limits are per account and enforced by Meta, so an over limit send is refused rather than delivered quietly.
If you want to see what the approval screen asks for before you commit, the Connect Instagram walkthrough shows every permission and why it is needed.