Privacy notice

1. Controller

ReposterX. Contact for data questions: contact@reposterx.com. Company registration and registered-office details are available on request.

2. Data we collect

• Account: email, password (stored hashed by our authentication provider), name.
• Profile: X handle, follower range and count, number of groups, creator page link, creator code, age and content confirmations, marketing choice.
• X account access: your X username and an X session token (the auth_token, ct0 and, if given, twid cookies), plus an optional note. We never collect your X password or two-factor codes. Encrypted with AES-256 before storage, never displayed again, deleted when your subscription ends, when you remove it or when you delete your account.
• Service: the names and direct chat links of your groups, the links of the posts you add, activity on your groups (reposts and time spent per day), reports, subscription status.
• Billing: handled by Stripe. We store your Stripe customer reference and subscription status, never your card details.
• Contact form: the fields you fill in.
• Security: a hashed identifier of your connection, kept for at most 24 hours, to limit abuse (rate limiting).

3. Why we use it and on what legal basis

• Creating your account and running the service, including signing in to your X account to act in your groups: performance of the contract, on your explicit authorization.
• Account review (18+, own content): legitimate interests and contract.
• Invoices and accounting: legal obligation.
• Security and fraud prevention: legitimate interests.
• News and offers: your consent, only if you ticked the box. You can withdraw it at any time.

4. Who we share it with (processors)

• Supabase (database and authentication)
• Stripe (payments)
• Netlify (hosting)
• Resend (transactional email)
• Cloudflare Turnstile (bot protection on forms), if enabled

Your data, and your X session token in particular, is strictly confidential: we never sell it, never share it with anyone other than the processors above, and never use it for any purpose other than running your groups.

5. International transfers

Our processors may store data outside your country. Each provider documents its storage locations and transfer safeguards; where required, transfers rely on an adequacy decision or standard contractual clauses. Contact us at contact@reposterx.com for details.

6. How long we keep it

X session tokens are deleted as soon as the subscription ends or on request. Unanswered contact requests are kept for up to 12 months. Client data is kept for the length of the subscription plus 12 months, unless a longer period is required by law. Invoices are kept for the legal accounting period.

7. Security

X session tokens are encrypted (AES-256-GCM) with a key kept outside the database, access is restricted and logged, every table is protected by row-level security. In case of a breach affecting your data, we notify the regulator and you as the law requires. See our security page.

8. Your rights and how to use them

Access, rectification, erasure, restriction, objection, portability, and the right to complain to the supervisory authority in your country (for example the ICO in the UK or the CNIL in France).

Signed-in clients can download all their data and delete their account directly from the account page. You can also email contact@reposterx.com or use the contact form ("Data access or deletion request"). We answer within one month, free of charge.

9. Cookies

Only one strictly necessary cookie, to keep you signed in. See our cookie policy.

10. Emails

Service emails (replies, account review, trial, reports, renewal reminders, billing) are part of the service. News and offers are only sent if you opted in, with an unsubscribe link in every email.