Privacy Policy

1. Introduction

Welcome to ContX. ContX.ai, Inc., a Delaware corporation (“ContX” or the “Company,” also “we,” “our,” or “us”) is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services, including when you connect third-party services such as Google/YouTube and Meta (Facebook and Instagram) to ContX.

By accessing or using our services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our services.

2. Information we collect

Personal information

We collect personal information that you voluntarily provide to us when you register on the platform, express interest in obtaining information about us or our products and services, or otherwise contact us. This may include:

Name and contact information (email address, phone number)

Account credentials (username and password)

Billing and payment information

Company or organization details

Profile information and preferences

Usage data

We automatically collect certain information when you visit, use, or navigate our platform. This includes:

Device and browser information

IP address and location data

Pages visited and features used

Time spent on the platform

Referring URLs and search terms

Information from connected third-party services

When you connect a third-party service to ContX (such as Google/YouTube, Facebook, Instagram, or other social or publishing platforms), we receive information from that service as authorized by you through that service’s authentication flow. The specific information we receive from Google services is described in Section 5 below, and from Meta services in Section 6 below.

Cookies and tracking technologies

We use cookies and similar tracking technologies to collect and store information about your interactions with our platform. You can control cookie preferences through your browser settings.

3. How we use your information

We use the information we collect for various purposes, including:

Providing, operating, and maintaining our services

Processing transactions and sending related information

Sending administrative information, updates, and security alerts

Responding to inquiries and providing customer support

Analyzing usage patterns to improve our platform

Developing new products, services, and features

Publishing content to third-party platforms at your direction

Preventing fraudulent activity and ensuring security

Complying with legal obligations

4. Data sharing and disclosure

We may share your information in the following situations:

Service providers: We share data with third-party vendors who perform services on our behalf.

Connected platforms at your direction: When you use ContX to publish content or interact with a connected service (such as YouTube, Facebook, or Instagram), we transmit the content and metadata you specify to that platform on your behalf.

Business transfers: In connection with mergers, acquisitions, or asset sales.

Legal requirements: When required by law or to protect our rights.

With your consent: When you have given us explicit permission.

We do not sell your personal information to third parties for marketing purposes. We do not sell, rent, or transfer data obtained from Google APIs or Meta Platforms to any third party for advertising, marketing, profiling, or any other purpose unrelated to the user-facing features for which you authorized the connection.

5. Third-party platform integrations: Google and YouTube

ContX integrates with Google services, including YouTube, to enable you to publish and manage content on your own YouTube channel through the ContX platform. This section describes how ContX accesses, uses, stores, and shares information obtained through Google APIs, and applies in addition to the other terms of this Privacy Policy.

5.1 Google API Services compliance

ContX’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. ContX also complies with the YouTube API Services Terms of Service and YouTube API Services Developer Policies.

By using ContX features that connect to Google or YouTube, you also agree to be bound by the YouTube Terms of Service and acknowledge the Google Privacy Policy.

5.2 OAuth scopes requested

When you authorize ContX to connect to your YouTube account, we request the following OAuth scopes from Google:

youtube.upload: to upload videos to YouTube channels you own or manage on your behalf.

youtube.readonly: to view a list of YouTube channels associated with your Google account so you can select which channel to publish to, and to read back metadata (such as video ID, status, and URL) for content you have published through ContX.

You grant these permissions explicitly through Google’s OAuth consent screen at the time you connect your account. You can review and revoke these permissions at any time at myaccount.google.com/permissions.

5.3 Information we access and store

Through the Google APIs, ContX accesses and stores:

Channel identifiers and basic channel metadata (channel ID, channel title, channel thumbnail), used to display which channel is connected and let you select a destination channel.

OAuth access and refresh tokens, stored in encrypted form in our database, used to make API calls to YouTube on your behalf.

Video metadata for content published through ContX (video ID, title, description, privacy status, publish time, thumbnail URL), used to confirm successful publication, display status in ContX, and let you manage published content from within ContX.

Upload status information, to report progress and handle retries for resumable uploads.

We do not access, collect, or store:

Your YouTube viewing history

Your subscriptions or subscriber lists, except as needed to display the channels you have access to publish to

Analytics or performance data, unless you explicitly grant additional scopes for that purpose in the future

Content from channels you have not authorized ContX to manage

5.4 Limited Use disclosure

ContX’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We use Google user data only to provide or improve user-facing features that are prominent in the ContX user interface (namely, publishing video content to YouTube channels you have connected, and displaying the status of that published content within ContX).

We do not use Google user data to serve advertisements, including remarketing, personalized, or interest-based advertising.

We do not sell, rent, or transfer Google user data to data brokers, advertising platforms, information resellers, or any other third party for advertising or unrelated purposes.

We do not allow humans to read Google user data, except: (a) with your explicit affirmative consent for specific data; (b) where necessary for security purposes (such as investigating abuse); (c) to comply with applicable law; or (d) where the data has been aggregated and anonymized and is used for internal operations in accordance with the Limited Use requirements.

5.5 How to revoke access and delete data

You can disconnect ContX from your Google/YouTube account at any time by:

Using the “Disconnect” option within ContX under your integration settings, which will instruct ContX to delete the stored access and refresh tokens and channel metadata associated with that connection; or

Visiting myaccount.google.com/permissions and revoking ContX’s access from your Google account directly.

When you disconnect, ContX will:

Revoke the OAuth tokens with Google

Delete the stored access token, refresh token, and connection record from our systems

Retain only the minimum metadata necessary about content already published through ContX (such as the video ID and publish time) for your historical records within ContX, unless you also request deletion of that data

To request deletion of all data ContX holds related to your Google/YouTube integration, contact us at privacy@contx.ai or follow the process described in Section 9.

6. Third-party platform integrations: Meta (Facebook and Instagram)

ContX integrates with Meta Platforms, including Facebook Pages, Facebook Marketplace, and Instagram, to enable you to publish and manage content on Facebook Pages and Instagram Business or Creator accounts you own or manage. This section describes how ContX accesses, uses, stores, and shares information obtained through Meta APIs, and applies in addition to the other terms of this Privacy Policy.

6.1 Meta Platform compliance

ContX complies with the Meta Platform Terms, the Developer Data Use Policy, and the Meta Platform Policies. By using ContX features that connect to Facebook or Instagram, you also agree to be bound by Meta’s Terms of Service and acknowledge Meta’s Privacy Policy.

6.2 Account requirements

To use ContX’s Instagram publishing features, your Instagram account must be a Business or Creator account and must be linked to a Facebook Page you administer. ContX cannot publish to personal Instagram accounts because Meta does not permit programmatic publishing to personal accounts.

6.3 Permissions requested

When you authorize ContX to connect to your Facebook or Instagram account, we request the following permissions from Meta.

Facebook Pages:

pages_show_list: to display a list of Facebook Pages you administer so you can select which Page to publish to.

pages_read_engagement: to read basic Page metadata and confirm successful publication.

pages_manage_posts: to publish posts to Facebook Pages you have authorized.

Instagram:

instagram_basic: to read basic profile information about the Instagram Business or Creator account, including its associated Facebook Page.

instagram_content_publish: to publish photos, videos, Reels, and carousels to your Instagram account.

Facebook Marketplace (optional, only if you enable Marketplace features):

catalog_management: to create and manage product catalog entries.

commerce_account_manage_orders: to manage orders associated with your commerce account.

pages_show_list: to display Pages associated with your commerce account.

You grant these permissions explicitly through Meta’s OAuth consent screen at the time you connect your account. You can review and revoke these permissions at any time in your Facebook settings under Business Tools (for business integrations) or Applications (for legacy app permissions).

6.4 Information we access and store

Through Meta’s APIs, ContX accesses and stores:

Account identifiers and basic metadata: Facebook Page ID, Page name, Instagram Business Account ID, Instagram username, and profile image, used to display which accounts are connected and let you select a destination.

OAuth access tokens (including long-lived Page access tokens), stored in encrypted form in our database, used to make API calls to Facebook and Instagram on your behalf.

Post and media metadata for content published through ContX: post IDs, media IDs, publish time, and status, used to confirm successful publication and let you manage published content from within ContX.

For Marketplace integrations only: product catalog data and order metadata you direct ContX to manage on your behalf.

We do not access, collect, or store:

Your private messages, direct messages (DMs), or message threads

Your friend list, follower list (beyond aggregate counts where exposed by basic profile responses), or contacts

Posts, comments, or content from Pages or accounts you have not authorized ContX to manage

Personal account data from individuals who are not the authorizing user

Insights or analytics data, unless you explicitly grant additional permissions for that purpose in the future

6.5 How we use Meta data

We use information obtained from Meta APIs only to:

Publish content to Facebook Pages and Instagram Business/Creator accounts at your direction

Display the connection status and destination accounts within ContX

Confirm and track the status of content you publish through ContX

Support ContX features you have explicitly enabled (such as Marketplace catalog management)

We do not:

Use Meta data to serve advertisements, retargeting, or build advertising profiles

Sell, rent, lease, or transfer Meta data to data brokers, advertising networks, or any third party for advertising or unrelated purposes

Allow humans to access Meta data, except where necessary for security investigations, abuse prevention, compliance with applicable law, or with your explicit consent

Use Meta data to assess eligibility for credit, insurance, housing, employment, or other consequential decisions

6.6 How to revoke access and request data deletion

Disconnecting from within ContX: you can disconnect ContX from any Facebook or Instagram account at any time using the “Disconnect” option within ContX under your integration settings. This will revoke the OAuth tokens with Meta, delete the stored access tokens and connection metadata from our systems, and stop any further API calls on behalf of that account.

Revoking access from Meta directly: you can also remove ContX’s access from your Meta account at any time in Facebook settings under Business Tools, or on Instagram under Manage access.

Meta data deletion request callback: when you remove ContX from your Meta account through Meta’s interface, Meta sends ContX a signed deletion request. Upon receiving and cryptographically verifying this signed request, ContX will:

Revoke the stored OAuth tokens and delete them from our systems

Delete the associated connection record and basic account metadata

Return a confirmation code and a status URL where you can verify the deletion status

Requesting deletion directly: you may also request deletion of any data ContX holds about your Facebook or Instagram connection at any time, free of charge, regardless of your location, by following the process described in Section 9 of this Privacy Policy.

6.7 Sub-processors for Meta integrations

The sub-processors listed in Section 7 also apply to data obtained through Meta integrations. No third party other than the listed sub-processors has independent access to Meta user data held by ContX.

7. Sub-processors

We use the following sub-processors to support our platform, AI features and third-party integrations, including Google/YouTube and Meta integrations:

Supabase: database hosting and encrypted storage of OAuth tokens, integration metadata and application data.

Vercel: application and website hosting and edge functions.

Lovable (Lovable AI Gateway): routing of requests from AI features to AI models.

Google (Gemini): AI models for content, image and video generation, and AI visibility checks.

OpenAI, Anthropic and xAI: AI models, including for AI visibility checks that ask ChatGPT, Claude and Grok how they describe a brand.

Perplexity: AI search engine queried for AI visibility checks.

Resend: transactional email, such as notifications and lead alerts.

Stripe: payment processing and billing.

These sub-processors do not have independent access to your third-party platform data and are bound by data processing agreements. If you connect your own AI model key, requests made with that key go to that provider under your own agreement with it.

8. Data security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit (TLS) and at rest

Encrypted storage of all third-party OAuth tokens, including Google/YouTube and Meta tokens

Regular security assessments and audits

Access controls, authentication mechanisms, and row-level security policies

Employee training on data protection

Incident response procedures

Cryptographic verification (HMAC-SHA256) of signed deletion requests from Meta and other platforms that require it

However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

9. Your rights and choices, including data deletion

All ContX users, regardless of location, residency, or jurisdiction, have the right to request deletion of any personal data we hold about them, including data obtained through connected third-party platforms. This right applies at any time and at no cost.

Depending on your location, you may also have additional rights regarding your personal information:

Access: Request a copy of the personal information we hold about you.

Correction: Request correction of inaccurate or incomplete data.

Deletion: Request deletion of your personal information, including data obtained through connected Google/YouTube or Meta accounts.

Portability: Request transfer of your data to another service.

Restriction: Request limitation of how we process your data.

Objection: Object to certain processing activities.

Revoke third-party access: Disconnect any connected third-party service (including Google/YouTube and Meta) at any time, as described in Sections 5.5 and 6.6.

How to request deletion

To request deletion of your personal data:

In-app: Use the “Delete Account” option in your ContX account settings, or the “Disconnect” option to remove a specific third-party integration.

Email: Send a deletion request to privacy@contx.ai with the subject line “Data Deletion Request”.

Status page: For deletion requests originating from Meta, visit contx.ai/data-deletion and enter the confirmation code provided by ContX.

We will process deletion requests within 30 days and confirm completion via email. Deletion is free of charge and available to all users at any time.

10. Data retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. When determining retention periods, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use, and applicable legal requirements.

OAuth tokens and integration metadata for connected third-party accounts (including Google/YouTube and Meta) are retained only while the connection is active. When you disconnect a connected account or your access is revoked at the platform, these tokens and the associated account metadata are deleted in accordance with Sections 5.5 and 6.6.

11. Third-party services

Our platform may contain links to, or integrations with, third-party websites and services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through our platform, including:

Google Privacy Policy

YouTube Terms of Service

Meta Privacy Policy

Instagram Terms of Use

12. Children’s privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

13. International data transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with applicable data protection laws.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date. We encourage you to review this Privacy Policy periodically for any changes.

15. Contact us

If you have questions or concerns about this Privacy Policy or our data practices, including questions specific to our Google/YouTube or Meta (Facebook/Instagram) integrations, please contact us at privacy@contx.ai.

Data deletion requests: privacy@contx.ai (subject line: “Data Deletion Request”) or contx.ai/data-deletion.