Privacy Policy

This policy explains what personal data Exoconnect collects, why, who we share it with, how long we keep it, and how you can have it deleted. Exoconnect is operated from India. Questions go to privacy@exoconnect.in.

Two kinds of data, two roles

Exoconnect handles personal data in two different capacities, and the difference decides who is responsible for it.

• Data about you, our customer. Your account, billing, settings and how you use the product. We decide how this is used, and this policy describes it.
• Data you bring into Exoconnect about other people. Your contacts, the people who message or comment on your accounts, your form respondents, your audience and anyone you research. You decide what is collected and why; we process it on your behalf and only to provide the service to you. You are responsible for having a lawful basis for it and for giving those people any notice the law requires, as set out in our Terms of Service. If you are one of those people and want to exercise a right, please contact the business that holds your data first; we will help them respond.

The one exception is the public account library described below, which we run ourselves.

What we collect

Your account. Your name, email address and sign-in details, handled by our identity provider, WorkOS. If you sign in with Google, we receive your name and email address from Google. We do not receive or store your password.

Connected accounts. When you connect Instagram, Facebook or WhatsApp, we receive from Meta the account and Page identifiers, names, the permissions you granted, and access tokens, which we store encrypted. Through those connections we receive and store the comments, direct messages and WhatsApp messages sent to your accounts, the names and profile pictures of the people who sent them, the content you publish, and your account insights.

What you create. Contacts, tags and notes in your CRM; forms, their published sites and their submissions; posts and scheduled posts; automations and their run history; media you upload; and your conversations with the Assistant.

Form respondents. When someone fills in a form you publish, we store their answers for you and may send them a one-time code by email or WhatsApp to confirm their address or number.

AI features. When you use the Assistant, media analysis or research, the text, images, audio and video involved are sent to the AI provider that serves the request, and the results are stored in your workspace. AI requests on our accounts go only to providers under zero data retention: they do not keep your content after answering and do not use it to train their models. If you add your own AI key, we store it encrypted and use it only for your requests, and that provider’s own terms decide what it keeps.

Billing. Payments are processed by Dodo Payments, our merchant of record. Dodo collects your name, email, billing address and payment details; we never see your card number. We keep a record linking your account to your Dodo customer and a record of your usage and its cost.

Usage and diagnostics. Pages you view and what you click (with on-screen text masked), errors, and session replays in which all text and input values are masked and images are left out. We identify you in these only by an internal user ID. When you send a bug report we receive what you wrote and the last few pages you visited. Server logs record identifiers and error types, never message contents.

Cookies and local storage. We use a cookie to keep you signed in, cookies for short sign-in steps and your display preferences (theme and sidebar), and, only if you accept them in our cookie banner, cookies and local storage for product analytics. If you decline, we count visits anonymously without storing anything on your device. You can change your choice at any time from Cookie preferences at the bottom of our website. We do not use advertising cookies or sell data to advertisers.

The public account library

To answer research and competitor questions without paying to collect the same data again for every customer, Exoconnect keeps one shared library of public Instagram and Facebook business and creator accounts: the profile (name, handle, biography, website, follower and post counts) and its public posts with their public engagement counts, observed over time.

• We collect this through Meta’s official APIs first. When Meta cannot provide it, we use Apify, a third-party data collection service, to read the publicly visible profile.
• We never collect who commented on a post or what they wrote, private messages, or anything that is not publicly visible.
• The library holds no information about which customer asked for an account. Each customer’s research history stays in their own workspace.
• If an account in the library is yours, you can have it removed, whether or not you use Exoconnect, with our removal form. It needs no Exoconnect account: you sign in with the Facebook profile that manages your Facebook Page, or the Page your Instagram account is linked to, which shows us which accounts you control, and choose which to remove. We then delete them from the library and stop collecting them again. We keep only a record of each removed account’s identifier and username, so we can keep it out. If your Instagram account is not linked to a Facebook Page, email privacy@exoconnect.in. Removing an account from the library is separate from deleting an Exoconnect account, described below.

How we use data

• To provide the service you asked for: sign-in, connecting your accounts, your inbox, publishing, automations, forms, the Assistant, research and notifications.
• To bill you and enforce plan limits.
• To keep the service secure, prevent abuse, and investigate errors.
• To send you account emails, such as deletion notices. We do not send marketing email without your consent.
• To meet legal obligations.

We do not sell or license personal data. We do not use data received from Meta to decide anyone’s eligibility for housing, employment, insurance, education, credit or government benefits, for surveillance, or to discriminate against anyone. We do not train AI models on your data.

Who we share it with

We share personal data only with the service providers that run parts of Exoconnect, only as much as each needs, and under agreements that limit them to processing it for us:

• WorkOS (United States): sign-in, sessions, organizations.
• Meta (Instagram, Facebook, WhatsApp): sending and receiving messages and comments, publishing, insights and account lookups you ask for.
• Apify (Czech Republic): collecting public profiles and posts for research.
• Cloudflare (global): web hosting, file storage, email delivery, background jobs and the Assistant’s runtime.
• Railway (servers in Singapore) and PlanetScale (databases in Singapore, on Amazon Web Services): application servers and the database.
• OpenRouter, which routes our requests to the model providers that serve them, among them Google (Gemini) and ElevenLabs: AI models, media analysis and transcription.
• Boat: isolated computers the Assistant uses to run tasks.
• Code.Storage: storing your automations and Assistant-built sites.
• Dodo Payments: payments, invoices, taxes and refunds, as merchant of record.
• PostHog (United States): product analytics, error tracking, session replays and logs.
• Better Stack: uptime monitoring and our status page. It receives no customer data.

If you add your own key for OpenAI, Anthropic, Google or OpenRouter, your requests go to that provider under your own agreement with them.

We may also disclose data when the law requires it, to protect people from harm, or as part of a merger or sale of the business, in which case this policy continues to apply.

Where data is stored

Our servers and database are in Singapore. Some providers above process data in the United States, the European Union and on Cloudflare’s global network. When data leaves your country, we rely on the provider’s contractual commitments to protect it.

How long we keep it

We keep your data for as long as your account exists, and delete it when it is no longer needed.

• Deleting your account. In Settings, choose Delete account. You have 30 days to change your mind: signing in during that time cancels the deletion. After 30 days we erase your personal workspace and everything in it (contacts, messages, forms and submissions, media, automations, Assistant conversations and connected accounts), your memberships in other workspaces, your saved AI keys, your Assistant’s computers, and your WorkOS account, and we unsubscribe our app from the Pages and WhatsApp accounts you connected.
• What we keep after deletion. Billing and usage records, for as long as tax and accounting law requires; a record that the account existed and was deleted, so it cannot be recreated by mistake; and the history of actions you took in workspaces owned by someone else, which then shows as a deleted person. Dodo keeps its own transaction records as merchant of record.
• Workspaces owned by an organization belong to that organization and are not deleted when you leave or delete your account.
• Disconnecting an account stops new data from arriving. Messages and comments already received stay in your workspace until you delete them or your workspace is erased.
• Logs, analytics and backups are kept for a limited period and then expire.

Deleting data received from Meta

You can have the data Exoconnect holds from your Facebook, Instagram or WhatsApp accounts deleted at any time:

1. To delete everything, delete your Exoconnect account as described above.
2. To delete only one connection’s data, email privacy@exoconnect.in from your account’s email address, naming the connected account. We confirm the request and delete the data within 30 days.
3. To stop Exoconnect’s access, disconnect the account in Exoconnect under Connections, and remove Exoconnect in your Facebook settings under Business Integrations, or in Instagram under Apps and Websites.

If you are not an Exoconnect customer and want your messages or comments removed from a business’s inbox, contact that business. If your public profile is in our library, use the removal form described in “The public account library” above.

Your rights

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, or stop or limit certain processing, and you can withdraw consent you have given. You can make most changes yourself in Settings; for anything else, email privacy@exoconnect.in. We answer within 30 days. If you are not satisfied, you can complain to us (below) or to your data protection authority, including the Data Protection Board of India.

Age

Exoconnect is for people 18 and over. We do not knowingly collect data from anyone younger; if we learn we have, we delete it.

Security

We encrypt data in transit and encrypt access tokens and AI keys at rest, limit who can access production systems, record important actions in an audit history, and check permissions on every request. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Changes

We will post changes here and update the date at the top. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect.

Contact and grievances

For any question, request or complaint about your data or this policy, email privacy@exoconnect.in.

We acknowledge complaints within 24 hours and resolve them within 15 days.