Privacy Policy

1. Information We Collect

When you use XCreator CRM, we collect:

• Your X (Twitter) username, user ID, and OAuth access token
• Subscriber data synced from your X account (usernames, engagement signals)
• Payment information processed by Stripe (we never store card details directly)
• Usage data such as login timestamps and feature interactions
• DM logs recording messages sent on your behalf and their delivery status

2. How We Use Your Information

We use the information we collect to:

• Provide and operate the Service
• Calculate subscriber health scores and churn risk
• Send win-back DMs on your behalf when you enable that feature
• Process payments and manage your subscription
• Send transactional emails (receipts, account notices)
• Improve the Service through aggregated, anonymised analytics

3. X API Data

We access your X account data solely to provide the features you request. We store your OAuth access token securely to perform background syncs and, if enabled, to send win-back DMs on your behalf. We do not sell, share, or use your X data for advertising or profiling purposes. You can revoke our access at any time from your X account's connected apps settings.

4. Data Storage and Security

Your data is stored in Supabase, hosted on AWS infrastructure in the EU. We use row-level security to ensure each user can only access their own data. OAuth tokens are stored encrypted. Payment data is handled entirely by Stripe and never touches our servers in raw form.

5. Data Sharing

We do not sell your personal data. We share data only with:

• Stripe — for payment processing
• Supabase — for database hosting
• Vercel — for application hosting
• X (Twitter) — to sync your subscriber data and send DMs

We may also disclose data when required by law or to protect our legal rights.

6. Cookies

We use a single session cookie (xcreator_session) to keep you logged in. It is httpOnly, secure, and contains no third-party tracking. We do not use advertising cookies or third-party analytics cookies.

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and all associated data
• Export your subscriber data
• Revoke X API access at any time

To exercise any of these rights, email hello@xcreatorcrm.com.

8. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or financial compliance purposes.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a prominent notice in the Service.

10. Contact

For privacy questions or data requests, contact hello@xcreatorcrm.com.