Privacy Policy

01Who we are and what this covers

XocialAI (xocialai.com) is operated by Xubitar (xubitar.com). XocialAI helps a business plan, write, review, schedule and publish social media posts, with AI assistance. In this policy, “we” and “us” mean Xubitar.

This policy explains what personal information we collect when you use the XocialAI website, the app and the emails we send, why we collect it, who we share it with, and the choices you have. It does not cover the social platforms you connect or the other services named below, which have their own policies.

02Information we collect

• Account. Your name, email address and, if you sign up with a password, a hashed version of it (we never store the password itself). If you sign in with Google, we receive your Google account email, name and profile image.
• Business profile. What you tell us about your business: name, type, website, description, audience, country, region, time zone, language, and the tone of voice and words to avoid that guide the writing.
• Products and services. Names, descriptions, prices, links and photos you add to your catalog.
• Posts and media. Drafts, titles, text, images and video you write or upload, per account text changes, schedules, review decisions and rejection reasons.
• Connected social accounts. The name, picture and platform identifier of each Facebook Page, Instagram Business account, LinkedIn profile or organization, Threads profile, YouTube channel, Pinterest, X, TikTok or Bluesky account, or Google Business location you connect, the Pinterest boards you can pin to, the permissions granted, and an encrypted access token.
• Performance data. Impressions, reactions, comments, shares, clicks and follower counts that the platforms report for your connected accounts and for posts published through XocialAI.
• AI activity. For each generation: what it was for, the model used, token counts, estimated cost, timing and outcome. Also the topic ideas we suggest, your ratings and notes, how you edit AI drafts, and embeddings of your posts used to find your most relevant past writing.
• Billing. Your plan, subscription status, usage counts and the Dodo Payments customer and subscription identifiers. Card details go directly to Dodo Payments and are never stored by us.
• Email settings and delivery. Your notification preferences and digest schedule, and a log of whether each email we sent was delivered.
• Technical data. Cookies needed to keep you signed in and secure, and standard server logs such as IP address and request details.

03How we use information

• To provide XocialAI: create your account, write and store your posts, and publish them to the accounts you choose, at the time you choose.
• To generate text, images and topic ideas that fit your business, using your profile, catalog and past posts as context.
• To show you how your posts and accounts perform, and to notify you about results.
• To improve suggestions for you, using your ratings, edits and post performance.
• To send service emails: review requests and reminders, publishing results, topic digests, and notices about your plan and usage limits.
• To take payment, apply the limits of your plan and keep AI costs bounded.
• To secure the service, prevent abuse, fix problems and meet legal obligations.

We do not sell your personal information, and we do not use it for advertising.

04AI features and providers

XocialAI uses third party AI providers to write text, create images and compute embeddings. Depending on how the service is configured, these are Anthropic (Claude), OpenAI (GPT) and Google (Gemini). Requests are sent from our servers, never from your browser.

For each request we send only what it needs: typically parts of your business profile, your brief, product details, a few relevant examples from your own past posts and, when a product has photos, a small number of those photos as reference images. Each provider handles that data under its own terms. We do not use your content to train our own models.

05Who we share information with

We share information with these kinds of service providers, only to run XocialAI:

• AI providers named above, to generate text, images and embeddings.
• Google, if you choose to sign in with Google.
• An email delivery provider to send our emails: Resend, MailerSend, Amazon SES or an SMTP server, depending on configuration.
• Dodo Payments, our merchant of record, to process subscription payments, taxes and invoices.
• Cloudflare, and the measurement and advertising tools it loads for us through Zaraz, to count visits and sign-ups and see which pages and plans work.
• Our hosting and storage providers, for the database and for uploaded and generated media.
• PostProxy and Post for Me, publishing services, to connect your social accounts, publish your posts and receive their metrics and comments. If you connect Bluesky, the handle and app password you enter are sent to the publishing service to sign in, and we do not store the app password.
• Meta (including Threads), LinkedIn, Google (YouTube and Google Business), Pinterest, X, TikTok and Bluesky, to publish posts and read metrics for accounts you connect.

We may also disclose information when the law requires it, to protect the rights and safety of our users or of us, or as part of a business transfer such as a merger.

06Connected social accounts

When you connect an account, you sign in on Facebook, Instagram, LinkedIn, Threads, YouTube, Pinterest, X, TikTok or Google (or enter a Bluesky app password) and approve the permissions listed on their consent screen. Depending on the account, we ask to:

• Publish posts to Facebook Pages and read their engagement (pages_manage_posts, pages_read_engagement).
• Publish to your Instagram professional account and read its comments and insights.
• Read your basic LinkedIn profile, publish as you, and read and publish for the organizations you administer.
• Publish to your Threads profile and read its replies and insights. Threads is connected only through PostProxy.
• Upload videos to your YouTube channel, with the title, visibility, audience and thumbnail you choose, and read their views and likes. YouTube is connected only through PostProxy.
• Create Pins on the Pinterest boards you choose, list those boards, and read the Pins' insights. Pinterest is connected only through PostProxy.
• Publish posts to your X profile, TikTok account and Bluesky profile, and read their engagement where the platform shares it. Bluesky connects with an app password you make in Bluesky's settings, not your account password.
• Publish updates, with an optional image and button, to the Google Business locations you choose. Google Business is available on paid plans and is connected only through PostProxy.

Access tokens are encrypted before they are stored. If you remove an account on the Social accounts page, its tokens are deleted immediately (published posts stay in your history). You can also revoke access at any time from the platform's own settings.

07The anonymized content pool

To improve suggestions for everyone, XocialAI can use short, anonymized excerpts of posts that performed well as style references for businesses of the same type. An excerpt carries no account name, handle or link, and is only used once at least three separate businesses have contributed to that type.

This is on by default. You can turn it off at any time under Settings, then Learning.

08Cookies and local storage

• A session cookie that keeps you signed in, plus the security cookies of our sign-in system.
• Short-lived cookies while you connect a social account. They are deleted when the connection finishes.
• Your light or dark theme choice, kept in your browser's local storage.
• A short-lived cookie that carries a note of what you just did, such as signing up, to the next page so it can be measured once. The browser deletes it right after.
• Cookies and similar identifiers set by the measurement and advertising tools we load through Cloudflare Zaraz, which are named under who we share information with.

We measure how the website and app are used, and which plans and sign-up steps people choose, with tools loaded through Cloudflare Zaraz. They receive the pages viewed and events such as a plan chosen or an account created. While you are signed in, they also receive one-way hashes (SHA-256) of your email address and name, which let them recognise the same person across visits and match them to their own records, but cannot be turned back into the email address or name. They never receive your email address or name in readable form, your business details or posts. We do not measure the secret links in review, topic, password reset or data deletion emails, or the operator console. Where the law requires your consent, we ask for it before these tools run.

09How long we keep information

Your account, profile, catalog, posts, media, metrics and AI records are kept until you delete them or delete your account. Access tokens are removed as soon as you disconnect the account. Links in review and topic emails are stored only as hashes and expire after 7 days.

Dodo Payments may keep payment and invoice records as long as its own legal and tax duties require.

10Security

• Social access tokens are encrypted at rest with AES-256-GCM.
• Passwords are stored only as salted bcrypt hashes.
• Uploaded and generated media is kept private. Platforms and email clients receive short-lived signed links, not public addresses.
• AI provider keys stay on our servers and are never exposed to the browser.

11Your choices and rights

You can act on most of your data yourself, without asking us:

• Edit your profile, catalog and posts at any time.
• Download a copy of your data as one JSON file on your Profile page. It never includes passwords or platform tokens.
• Delete your account on your Profile page. Deletion is immediate and permanent.
• Remove any social account on the Social accounts page.
• Choose which emails you receive on the Notifications page. Service notices are sent regardless.
• Turn off the anonymized content pool under Settings, then Learning.

Depending on where you live, you may also have the right to access, correct, delete, port or restrict the use of your personal information, to object to certain processing, and to complain to your data protection authority.

12Children

XocialAI is built for businesses and is not directed to children under 16. We do not knowingly collect information from them. If you think a child has given us information, contact us and we will delete it.

13International transfers

We and the providers above may process information in countries other than your own. Where required, we rely on appropriate safeguards for such transfers.

14Changes to this policy

We may update this policy as XocialAI changes. The date at the top shows the latest revision. If a change materially affects how we use your information, we will make it visible in the app or by email before it takes effect.

15Contact

Questions or requests about this policy or your information can be sent to Xubitar through xubitar.com.