Privacy Policy

This Privacy Policy explains how Alexandre Larzilliere ("Xboost", "we", "us") collects, uses, and protects your personal data when you use the Xboost website and service (the "Service"). We are the controller of your personal data. We design the Service to collect as little as possible.

1. Data we collect

• Account data: your email address and, if you sign in with Google, the name and profile information Google shares with us.
• X (Twitter) data: when you connect your X account, we receive the access and permissions needed to schedule and publish posts on your behalf, such as your handle and authorisation tokens.
• Your content: the prompts, inputs, generated drafts, calendars, and posts you create or schedule through the Service.
• Billing data: payments are processed by Stripe. We do not store your full card number. We may keep a record of your subscription and transactions.
• Usage and technical data: information such as device, browser, IP address, and how you interact with the Service, used for security, stability, and improvement.

2. How we use your data

• To provide, operate, and maintain the Service;
• To generate drafts and schedule or publish posts to your connected X account;
• To process payments and manage your subscription;
• To send service messages (account, security, billing) and, with your consent, optional product updates;
• To detect, prevent, and address fraud, abuse, and security issues;
• To comply with legal obligations.

3. Legal bases (GDPR)

Where the EU/UK GDPR applies, we process your personal data on the following bases: to perform our contract with you (providing the Service), to comply with legal obligations, on the basis of your consent (which you can withdraw at any time), and for our legitimate interests (such as security, fraud prevention, and improving the Service), balanced against your rights.

4. Sharing your data

We do not sell your personal data. We share it only as needed to operate the Service, with processors acting on our behalf under appropriate agreements:

• Stripe — payment processing;
• Google — sign-in;
• Email delivery (Resend) — sending sign-in links and messages;
• AI providers — generating draft content based on your inputs;
• X (Twitter) — to schedule and publish posts to your account;
• Hosting and infrastructure — to run and secure the Service.

We may also disclose data when required by law or to protect the rights, safety, or property of Xboost, our users, or others.

5. International data transfers

Some of the providers listed above process data outside your country, including outside the EU/EEA. We rely on appropriate safeguards (such as standard contractual clauses) and require our processors to protect your data in line with this policy.

6. Data retention

We keep your personal data only for as long as needed to provide the Service and meet legal obligations. Scheduling and authorisation tokens for your X account are kept while your account is active; you can revoke X access at any time from your X account settings, and you can delete your Xboost account to remove your data.

7. Cookies and local storage

We use essential cookies and local storage to keep you signed in and to make the Service work. We do not use cookies to sell your data. You can control or delete cookies through your browser settings; some features may not work if they are disabled.

8. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Request deletion of your personal data;
• Restrict or object to certain processing;
• Receive a copy of your data in a portable format;
• Withdraw consent at any time (without affecting prior processing);
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email us at the address below. We will respond within the timeframe required by applicable law.

9. Children's privacy

The Service is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Security

We take reasonable technical and organisational measures to protect your data, including limiting access and using secure infrastructure. However, no system is completely secure, and we cannot guarantee absolute security.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the "Last updated" date. For material changes, we will also try to notify you in the Service or by email.

12. Contact

For privacy questions or requests, email lrzalexandre@gmail.com. If you are in the EU, you also have the right to complain to your local data-protection authority.