1. Purpose and scope
This Data Protection and Security Statement (“DPS”) describes how ContX.ai, Inc., a Delaware corporation (“ContX” or the “Company”, “we”) protects Customer Data processed through the ContX platform, websites, client portals and related services (the “Services”).
The DPS forms part of the Master Subscription Agreement (“MSA”) or other agreement between ContX and the customer (“Customer”). Where a Data Processing Addendum (“DPA”) applies, the DPA governs personal data processing and prevails over this DPS if they conflict.
2. Roles of the parties
For Customer Data, Customer is the controller (or a processor acting for its own clients) and ContX is the processor (or sub-processor). ContX processes Customer Data only on Customer’s documented instructions, which are given by the Agreement, Customer’s use and configuration of the Services, and any other written instructions agreed by the parties.
Channel Partners (agencies and MSPs) that use ContX to serve their own clients are responsible for having the rights and agreements needed to process their clients’ data in ContX, including any required notices and consents.
ContX is a controller only for account, billing and usage information it needs to run its business, which it handles under its Privacy Policy at contx.ai/privacy-policy.
3. Customer Data we process
Customer Data means data submitted to the Services by or for Customer, including: contact and company records; leads, deals, contracts and invoices; brand kits, briefs, content, images and video; team and client messages; files and approvals; and analytics about content, campaigns and customer health.
Data subjects may include Customer’s employees and contractors, Customer’s clients and their staff, prospects, leads and end customers.
The Services are not designed for special categories of personal data, government identifiers, payment card numbers or health information. Customer must not submit such data unless ContX has agreed to it in writing. The Services are not intended for individuals under the age of 18.
Connected platform data: when Customer connects a publishing account such as Google/YouTube or Meta (Facebook Pages, Instagram Business or Creator accounts), ContX stores only what the Privacy Policy describes: account identifiers and basic metadata, encrypted OAuth tokens, and metadata for content published through ContX. ContX does not collect private messages, viewing history, friend or follower lists, or analytics unless Customer grants additional scopes for that purpose.
4. How we use Customer Data
ContX uses Customer Data only to provide, secure, support and improve the Services for Customer, to prevent abuse, and to meet legal obligations. ContX does not sell Customer Data or use it for advertising, and does not sell, rent or transfer data obtained from Google APIs or Meta Platforms for advertising, marketing, profiling or any purpose unrelated to the features Customer authorized.
ContX does not use Customer Data to train generalized AI models that are shared across customers. ContX may use aggregated, de-identified usage data that does not identify Customer or any individual to operate and improve the Services.
5. AI features and model providers
AI features send the minimum Customer Data needed for the task (for example, the relevant brand kit, brief and prompt) to the AI model providers listed as subprocessors. ContX uses these providers under terms that do not allow them to train their models on Customer Data and that allow them to keep it only for a limited period for abuse and safety monitoring.
If Customer brings its own model API key, prompts and outputs for that key are also subject to Customer’s agreement with that provider.
AI outputs belong to Customer as set out in the MSA. Customer is responsible for reviewing outputs before publishing or sending them; the Services require approval before content reaches a customer unless Customer turns on automatic publishing for a channel.
6. Connected platforms (Google/YouTube and Meta)
ContX’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and to the YouTube API Services Terms and Developer Policies. ContX complies with the Meta Platform Terms, Developer Data Use Policy and Platform Policies.
ContX requests only the scopes and permissions needed to publish at Customer’s direction and to confirm publication, as listed in sections 5 and 6 of the Privacy Policy. Humans do not read data from these platforms except with consent, for security or abuse investigations, to comply with law, or in aggregated and anonymized form.
Customer can disconnect any connected account in ContX at any time, or revoke access in the platform’s own settings. ContX then revokes and deletes the stored tokens and connection record and stops API calls for that account. Signed deletion requests from Meta are verified (HMAC-SHA256) and answered with a confirmation code and status URL.
7. Security program
ContX maintains a written information security program, owned by the CTO, that is reviewed at least annually.
Personnel with access to Customer Data are bound by confidentiality obligations, receive security and privacy training at onboarding and annually, and are subject to background checks where permitted by law.
8. Technical and organizational measures
Encryption: Customer Data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 or equivalent. All third-party OAuth tokens, including Google/YouTube and Meta tokens, are stored encrypted. Encryption keys are managed through the key management services of ContX’s hosting providers.
Access control: production access follows least privilege, requires single sign-on and multi-factor authentication, is logged, and is reviewed quarterly. Row-level security policies separate Customer workspaces, and Channel Partner client workspaces, in the database.
In-product controls: role-based permissions, client-level access separation for agencies, SSO and audit logs (Enterprise plan) and admin controls for automatic publishing.
Secure development: peer code review, automated dependency and vulnerability scanning, separated environments, and change management for production.
Vulnerability management: critical vulnerabilities are remediated within 7 days and high within 30 days. ContX will complete its first independent penetration test by May 31, 2027, and will repeat it at least annually.
Monitoring and logging: security-relevant events are logged centrally, retained for 12 months and monitored for anomalies.
Resilience: Customer Data is backed up daily, backups are encrypted and tested, and the recovery point objective (RPO) and recovery time objective (RTO) are each 24 hours.
9. Subprocessors
ContX uses the following subprocessors. Each is bound by a data processing agreement, and none has independent access to Customer’s connected platform data. The same list appears in section 7 of the Privacy Policy.
Supabase: database hosting and encrypted storage of OAuth tokens, integration metadata and application data.
Vercel: application and website hosting and edge functions.
Lovable (Lovable AI Gateway): routing of requests from AI features to AI models.
Google (Gemini): AI models for content, image and video generation, and AI visibility checks.
OpenAI, Anthropic and xAI: AI models, including for AI visibility checks that ask ChatGPT, Claude and Grok how they describe a brand.
Perplexity: AI search engine queried for AI visibility checks.
Resend: transactional email, such as notifications and lead alerts.
Stripe: payment processing and billing.
Stripe processes billing information, which ContX handles as a controller. When Customer connects its own AI model key, requests made with that key go to that provider under Customer’s own agreement with it, as described in section 5.
ContX gives at least 30 days’ notice of a new subprocessor. Customer may object on reasonable data-protection grounds; the parties will discuss in good faith, and if unresolved Customer may terminate the affected Services and receive a refund of prepaid fees for the remaining term.
ContX imposes data-protection obligations on each subprocessor that are at least as protective as this DPS and remains responsible for their performance.
10. Data location and international transfers
Customer Data is hosted in the United States by Supabase and Vercel. Data may be processed in countries other than Customer’s own, with appropriate safeguards in place as described in the Privacy Policy. Where personal data is transferred from the EEA, UK or Switzerland, ContX relies on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss amendments, as set out in the DPA.
11. Security incidents
ContX will notify Customer without undue delay, and in any case within 48 hours, after confirming a breach of security that leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data.
The notice will describe what is known about the incident, the data and data subjects affected, likely consequences, and the steps taken. ContX will update Customer as more information becomes available and will reasonably cooperate with Customer’s own notification obligations.
12. Retention, return and deletion
Customer Data is retained for the term of the Agreement. Customer can export its data at any time using the export tools, and for 30 days after termination.
After that period ContX deletes Customer Data from active systems within 30 days and from backups within 90 days, unless the law requires longer retention.
OAuth tokens and integration metadata for connected accounts are kept only while the connection is active and are deleted when Customer disconnects or access is revoked at the platform. ContX keeps only minimal metadata about content already published through ContX (such as post or video IDs and publish times) for Customer’s records, unless Customer asks for that to be deleted too.
13. Assistance and data subject requests
The Services let Customer access, correct, export and delete personal data. If ContX receives a request from a data subject about Customer Data, it will refer the request to Customer and not respond directly unless required by law.
ContX will provide reasonable assistance with Customer’s data protection impact assessments and consultations with supervisory authorities, to the extent they relate to the Services.
For personal data ContX holds as a controller, anyone may request deletion at any time and free of charge, in the app (Delete Account or Disconnect), by emailing privacy@contx.ai with the subject “Data Deletion Request”, or at contx.ai/data-deletion for requests that start at Meta. ContX completes deletion requests within 30 days and confirms by email.
14. Audits and certifications
Current status: ContX does not yet hold a SOC 2 or ISO/IEC 27001 certification. Customer Data is stored with Supabase, which is SOC 2 certified. On request, and subject to confidentiality, ContX will share its subprocessors’ available audit reports, its penetration test summary once the first test is complete, and answers to a reasonable security questionnaire once per year.
Where required by applicable law or the DPA, Customer may conduct an audit on 30 days’ notice, at its own cost, during business hours, no more than once in any 12-month period.
15. Customer responsibilities
Customer is responsible for: managing user access and permissions; enabling SSO or multi-factor authentication where available; having a lawful basis and any notices or consents needed for the data it submits; deciding which channels may publish automatically; and keeping its own credentials and API keys secure.
16. Changes to this DPS
ContX may update this DPS to reflect changes in the Services, law or security practice. Updates will not materially reduce the protection of Customer Data during a paid subscription term. The current version is always available at this page.
17. Contact
Security questions and vulnerability reports: legal@contx.ai. Privacy and data protection questions, and data deletion requests: privacy@contx.ai (subject “Data Deletion Request”) or contx.ai/data-deletion. Postal address: ContX.ai, Inc., 6783 Flamenco Ct, Las Vegas, NV 89139, USA.