XreplyAI Privacy Policy

Last Updated: October 9, 2026

This Privacy Policy describes how Red Green Solutions LLC, operating as XreplyAI ("we", "us", or "our"), collects, uses, and protects your personal information when you use the XreplyAI web dashboard, Chrome extension, API, and MCP server (the "Service"), and when you visit xreplyai.com. By using the Service, you agree to the practices described in this policy.

Cookies and similar technologies are covered in our Cookie Policy. The technical measures that protect your data are described on our Security page.

1. Definitions

• Personal Data: Any information that identifies or could reasonably identify you as an individual.
• Usage Data: Data collected automatically about how you interact with the Service (e.g., features used, session duration).
• Workspace: The account container that holds your connected social accounts, content, and team members. Each account has one workspace, owned by the person who pays for it.
• Data Controller: XreplyAI, the entity that determines the purposes and means of processing your personal data.
• Service Providers: Third-party companies that process data on our behalf to help us deliver the Service. They are listed in Section 5.

2. Information We Collect

We collect the following categories of information:

• Account information: Your email address, a password if you set one (stored only as a hash), and, if you sign in with Google, your name.
• Social platform data: When you connect a social account (X, LinkedIn, Instagram, Threads, Facebook, YouTube, TikTok, Pinterest, Bluesky, or Mastodon), we receive an OAuth token and your profile details. Depending on the platform and the features you use, we also read your public posts (for your voice profile), post performance metrics (for analytics and learning), comments on posts you published through us (for the comment inbox), and new-follower and comment events (for auto DM replies).
• Content you provide: Posts you write or approve, media you upload, brand assets, documents you upload for brand knowledge, custom writing rules, and settings such as posting schedules.
• Brand knowledge sources: Pages we read from your website, and content from sources you connect: GitHub releases and commits, Slack channels, an Intercom help center, Google Drive, or Canva. A connected Slack channel includes messages written by other people in that channel; we keep a short summary of what is usable for a post and delete the raw messages within 14 days.
• Generated content: The drafts, images, and replies the AI produces for you, and the text the AI originally wrote before you edited it. We keep the original so the Service can learn from your edits.
• Usage data and session replay: How you use the dashboard, including page views and interactions. Inside the dashboard we may record sessions to diagnose problems; text you type into inputs is masked in those recordings.
• Consent records: When you make a cookie choice on the marketing site, we record the choice, the policy version, your country, and a truncated IP address so we can show that consent was given or withdrawn.
• Payment information: Billing details processed by Stripe. We do not store your full card number. We keep a ledger of AI balance top-ups and spend.
• Team members: The email address of anyone a workspace owner invites, and the role they were given.
• Support communications: Emails and feedback you send us.

3. How We Use Your Information

We use your information for the following purposes:

• Service provision: Draft posts, replies, comments, images, and direct messages; schedule and publish them to your connected accounts; and maintain your account.
• Automated publishing: When you turn on an automation (such as "Post automatically" or auto DM replies), we publish to your connected accounts on your behalf under the settings you chose, without a per-post action from you. Content waits for your review by default.
• Brand and voice: Build your brand direction from your website and connected sources, and your voice profile from your existing posts, so generated content sounds like you and is grounded in your business.
• Learning: Use your approvals, edits, rejections, and post performance to improve future drafts for your workspace only.
• Billing: Process payments, run your trial, and manage your subscription and AI balance via Stripe.
• Communication: Send sign-in codes, service updates, billing notices, and onboarding or product emails. You may opt out of non-essential emails at any time.
• Security and abuse prevention: Detect, investigate, and prevent fraudulent, automated, or unauthorized activity.
• Service improvement: Analyze usage patterns and errors to improve performance and features.
• No advertising use: We do not use your social account data, OAuth tokens, voice profile, or content for advertising, retargeting, or interest-based ad targeting, by us or any third party.
• No AI model training: We do not use your posts, voice profile, content, or connected sources to train AI models, and our AI providers are used under terms that do not permit training on your data. Your data is used solely to generate content for you.

4. Legal Basis for Processing

Where the GDPR or UK GDPR applies, we process your personal data under the following legal bases:

• Contract performance: Processing necessary to provide the Service you have subscribed to (account management, billing, content generation, publishing).
• Legitimate interests: Processing necessary for our legitimate business interests, such as improving the Service, diagnosing errors, and preventing fraud, where those interests are not overridden by your rights.
• Consent: Where you have given explicit consent, such as for analytics and advertising cookies, and for optional marketing emails. You may withdraw consent at any time.
• Legal obligation: Retaining billing records where tax and accounting law require it.

5. Service Providers and Third Parties

We share data with the following service providers only to the extent necessary to deliver the Service. Each processes data under a contract that restricts its use to providing that service to us.

AI providers. To generate content we send the AI provider the material it needs for that request: the relevant post, your voice profile, brand knowledge snippets, and any document or image you asked it to work from. Requests use our own credentials. Standard generation runs on Google Gemini, and images are generated by Google Gemini or OpenAI. If you choose another model, the request goes either directly to OpenAI or through OpenRouter to that model's provider (Anthropic, OpenAI, DeepSeek, or xAI). We store the output the model returns, since it becomes your draft.

Social platforms. X, LinkedIn, Instagram, Threads, Facebook, YouTube, TikTok, Pinterest, Bluesky, and Mastodon receive the content you publish and provide the profile, post, metric, comment, and follower data described in Section 2. Each platform's own privacy policy governs how it handles your data on its side.

YouTube. XreplyAI uses YouTube API Services to read your channel details and upload videos you schedule. Google's use of that data is governed by the Google Privacy Policy. We store your channel name, ID, and OAuth tokens, and the metadata of videos you publish through us. Video files you upload are kept in our media storage so you can reuse them, until you delete them or your account. You can revoke our access at any time from your Google security settings.

Connected sources and integrations. GitHub, Slack, and Intercom provide the content described in Section 2 when you connect them. Canva and Google Drive let you import designs and files as media for your posts. HubSpot can be connected in Settings, but no content is currently read from it; we hold only the connection token until you disconnect.

MCP and API clients. If you connect an AI coding assistant or other tool through our API or MCP server, that tool sends requests to the Service on your behalf and receives the data those requests return. Data exchanged this way is subject to this Privacy Policy. We do not share your personal data with third-party clients beyond what is necessary to fulfill your requests.

We do not sell your personal data. Our use of advertising cookies on the marketing site (Google, Meta, and X) may constitute "sharing" for cross-context behavioral advertising under some US state laws. You can opt out at any time using the "Your Privacy Choices" link in our website footer or a Global Privacy Control (GPC) browser signal, which we honor automatically. See Section 14.

6. Cookies

We use strictly necessary cookies to run the site, and, with your consent where required, analytics cookies (Google Analytics, Microsoft Clarity, PostHog) and advertising cookies (Google Ads, Meta, X). Visitors in the EU, EEA, and UK see an opt-in banner and nothing non-essential loads until they choose; visitors elsewhere can opt out of advertising cookies with the footer link or a GPC signal.

The full list of cookies, what each does, and how to change your choice is in our Cookie Policy.

7. Chrome Extension Permissions

The XreplyAI Chrome extension requests the following browser permissions to deliver its functionality:

• Site access: The extension runs on x.com, linkedin.com, instagram.com, and reddit.com to add a reply button to posts you are viewing and to read the post you are replying to. It does not read or modify any other site.
• Storage: The extension stores your authentication token locally in your browser using Chrome's built-in storage API (chrome.storage.local). This data never leaves your device except as part of authenticated API requests to XreplyAI servers.
• Tabs: The extension opens new browser tabs for sign-in and onboarding. It does not read the content of tabs other than the sites listed above.
• Cookies: The extension sets a session cookie on the xreplyai.com domain to keep your login state in sync between the extension and the web dashboard. It does not read or modify cookies on any other domain.
• Identity: Used to support "Sign in with Google" authentication. No Google account data beyond your email address and name is accessed or stored.

When you generate a reply, the post you are replying to is sent to our servers so the AI can read it. Nothing is posted until you click send on the platform.

8. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service:

• Account, content, brand knowledge, and voice profile data: Retained until you delete your account.
• OAuth tokens and platform data for a connected account: Deleted immediately when you disconnect that account.
• Raw Slack messages: Deleted once judged for a post, and in any case within 14 days.
• Usage logs and error reports: Retained for up to 12 months for security and diagnostics.
• Cookie consent records: Retained for 3 years.
• AI balance ledger: Retained for 2 years, including after account deletion, so a billing dispute can be resolved.
• Billing records: Retained as required by applicable tax and financial regulations (typically 7 years).
• Database backups: Encrypted backups are kept for 30 days and then deleted, so deleted data leaves backups within that window.

9. International Data Transfers

We are based in the United States, and the providers in Section 5 process data there. If you are located outside the United States, your data will be transferred to and processed in the US, which may have different data protection laws than your country of residence.

Where the GDPR or UK GDPR applies, we transfer personal data under the European Commission's Standard Contractual Clauses (and the UK Addendum) included in our agreements with those providers, or to providers certified under the EU-US Data Privacy Framework. You can request a copy of the relevant safeguards by contacting us.

10. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: OAuth tokens, API keys, and other stored credentials are encrypted at rest with AES-256. All traffic uses HTTPS (TLS).
• Access controls: Workspace roles limit what team members can see and do, and strict internal access controls limit who at XreplyAI can access your data.
• Backups and monitoring: Nightly encrypted backups, error tracking, and infrastructure monitoring with alerting.

Our Security page describes these measures in more detail. No security system is impenetrable. If you discover a security vulnerability, please report it responsibly to john@xreplyai.com. We acknowledge valid reports within 2 business days.

11. Your Data Rights

Depending on where you live, you have some or all of the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (see Section 12).
• Portability: Request your data in a structured, machine-readable format.
• Restriction: Ask us to limit how we process your data while a request is being resolved.
• Objection: Object to processing based on our legitimate interests.
• Withdraw consent: Withdraw any consent you have given, without affecting processing that happened before withdrawal.
• Opt out of marketing: Unsubscribe from non-essential emails at any time via the unsubscribe link or by contacting us.
• Complain: Lodge a complaint with your local data protection authority if you believe we have not handled your data lawfully. We would appreciate the chance to address your concern first.

To exercise any of these rights, email john@xreplyai.com from the address on your account. We respond within 30 days.

12. How to Request Data Deletion

You may delete your account and all associated personal data at any time. The fastest way is to do it yourself:

1. Go to Settings → Account → Danger Zone and choose Delete Account
2. We email a 6-digit confirmation code to the address on your account
3. Enter the code to confirm. Your account and data are deleted immediately, and any active subscription is canceled

If you cannot sign in, email us at john@xreplyai.com with the subject line "Data Deletion Request" from the email address associated with your XreplyAI account. We will confirm receipt within 48 hours and complete deletion within 30 days.

Workspace owners: deleting the owner's account deletes the whole workspace, including posts, plans, and media created by other team members. Members are not notified and nothing is recoverable. If you own a workspace with other members, confirm with them first or ask us to transfer ownership.

Disconnecting a connected platform account from your settings immediately removes all stored OAuth tokens and platform-specific profile data for that platform. For Meta platforms (Instagram, Threads, and Facebook), we also process deletion requests automatically via Meta's data deletion callback.

Upon deletion, we remove your account, content, brand knowledge, voice profile, and all other personal information from our systems, except where retention is required by law (billing records) or described in Section 8 (the AI balance ledger). Deleted data leaves our backups within 30 days.

We delete our copy of your social platform access tokens, but we cannot remove the authorization on the platform's own side. After deleting your account, revoke XreplyAI in each connected platform's app or security settings to remove it there as well.

13. Children's Privacy

The Service is not directed to children under the age of 16. We do not knowingly collect personal data from anyone under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly. If you believe someone under 16 has provided us with personal data, please contact us at john@xreplyai.com.

14. California and Other US State Residents

If you are a resident of California or another US state with a comprehensive privacy law, you have the following rights:

• Right to know: Request disclosure of the categories and specific pieces of personal data we have collected about you, the sources, the purposes, and the third parties we share it with. Those are described in Sections 2, 3, and 5.
• Right to delete: Request deletion of your personal data, subject to certain exceptions.
• Right to correct: Request correction of inaccurate personal data.
• Right to opt out of the sale or sharing of personal information: We do not sell your personal information. Our use of advertising cookies on the marketing site (Google, Meta, and X) may constitute "sharing" for cross-context behavioral advertising. You may opt out at any time by using the "Your Privacy Choices" link in our website footer, or by enabling a Global Privacy Control (GPC) signal in your browser, which we honor automatically. Opting out disables advertising and cross-context personalization cookies; first-party analytics used solely to operate and measure our own site may continue.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

We do not use or disclose sensitive personal information for purposes that require a right to limit. To exercise these rights, contact us at john@xreplyai.com. You may designate an authorized agent to make a request on your behalf; we will ask for proof of that authorization.

15. Business Transfers

If XreplyAI is acquired, merged, or undergoes a substantial asset transfer, your personal data may be transferred as part of that transaction. We will notify you by email or a prominent notice within the Service before your data becomes subject to a different privacy policy.

16. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email and post a prominent notice within the Service at least 30 days before the changes take effect. Your continued use of the Service after that date constitutes your acceptance of the updated policy.

17. Contact Us

For privacy-related questions, data rights requests, or security vulnerability reports:

• Email: john@xreplyai.com
• Mail: Red Green Solutions LLC, New Jersey, United States
• X (Twitter): @_JohnBuilds_