Privacy Policy

1. About us and this policy

iZop AI is a product of Xethra LLC ("we," "us," "our"), a limited liability company registered in Montana, USA (1001 S Main St Ste 600, Kalispell, MT 59901). Xethra LLC is the data controller for the personal information described in this policy.

This Privacy Policy describes what data we collect when you use iZop AI (the "Service"), how we use and share it, and your rights. By using the Service you agree to this policy.

The Service integrates with Meta (Facebook and Instagram), TikTok, Google (YouTube), X (Twitter), and LinkedIn. When you connect an account we access and process data in accordance with each platform's policies and your authorizations. This policy is intended to satisfy disclosure requirements for app verification and review by those platforms.

2. Age restriction

The Service is not directed to children under the age of 16. We do not knowingly collect personal information from anyone under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@izop.ai and we will delete that information promptly.

3. Data we collect

We collect the following categories of information:

• Account information you provide: email address, name, and password (stored encrypted).
• Connected social account data from Instagram, YouTube, TikTok, Facebook, X, and LinkedIn: profile information, posts, comments on your posts, direct messages and conversations (for the unified inbox), and analytics (views, likes, followers, reach, etc.).
• Content and settings you create: scheduled posts, hashtag pools, brand context for the AI Assistant, and other configuration you save.
• Usage and technical data collected automatically: IP address, browser type, device identifiers, pages visited, and how you interact with the Service.
• Payment information: billing details processed by our payment provider (Stripe). We do not store full card numbers.

We do not sell your personal data.

4. Legal basis for processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on the following legal bases:

• Performance of a contract: to provide, maintain, and improve the Service you signed up for (scheduling posts, inbox, analytics, AI features).
• Legitimate interests: to ensure security, prevent fraud, communicate service updates, and improve our product using aggregated or anonymized data.
• Consent: for optional features such as marketing communications and non-essential cookies. You may withdraw consent at any time without affecting prior processing.
• Legal obligation: to comply with applicable laws and regulations.

5. How we use your data

We use your data to:

• Provide the Service: scheduling and publishing posts, displaying analytics, the unified inbox, replying to comments and messages, hashtag management, and AI Assistant features.
• Process payments and manage billing.
• Send you transactional and service-related communications (account updates, receipts, security alerts). You cannot opt out of these.
• Send you marketing communications about iZop AI (you can opt out at any time; see Section 10).
• Improve and develop the Service using aggregated or anonymized data.
• Ensure security, detect fraud, and prevent abuse.
• Comply with legal obligations.

Google User Data that we send to third-party AI providers is not used to train generalized AI or machine learning models.

6. Sharing and disclosure

We share your data only as described below. We do not sell or rent your personal information.

• Social platforms you connect (Meta, TikTok, Google, X, LinkedIn): we publish content, retrieve inbox data, and pull analytics on your behalf using the permissions you granted.
• Service providers: hosting (Vercel, Supabase), payments (Stripe), email delivery (Resend), and analytics (Google Analytics, Vercel Speed Insights). These providers process data only as instructed by us and under appropriate confidentiality obligations. See our full sub-processor list.
• AI processing (OpenAI): We use OpenAI's API to power optional AI-assisted features such as post captions, inbox and comment reply drafts, reel analysis, Planner ideas and inspiration analysis, and brand context synthesis. When you use these features we send only the minimal content necessary (e.g. your brand context, post topic, or message text) to OpenAI. We use a service configuration that guarantees your data is not used to train generalized AI or machine learning models. Under the Google API Services User Data Policy's Limited Use requirements, we ensure that any Google User Data shared with OpenAI is covered by these same restrictions.
• Legal requirements: We may disclose information when required by law, subpoena, or to protect the rights, property, or safety of Xethra LLC, our users, or the public.
• Business transfers: In the event of a merger, acquisition, sale of assets, or bankruptcy, your data may be transferred to a successor entity. We will notify you via email or a prominent notice on the Service if such a transfer results in a materially different use of your information.

7. International data transfers

Xethra LLC is based in the United States. Our infrastructure is distributed across multiple regions:

• Application hosting (Vercel): United States.
• Database (Supabase on AWS): Seoul, South Korea (ap-northeast-2). South Korea has received an EU adequacy decision, meaning transfers from the EEA are lawful without additional safeguards.
• Media storage (Cloudflare R2): United States with global CDN distribution.
• AI processing (OpenAI): United States. Covered by OpenAI's API Data Processing Addendum with the no-training guarantees described in Section 6.

For transfers to the United States (Vercel, Cloudflare, OpenAI, Resend, Stripe) from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs) or equivalent approved safeguards. Our full Data Processing Agreement documents these transfer mechanisms and is available to download and self-sign on our DPA page.

8. Data retention and security

We retain your data for as long as your account is active or as needed to provide the Service and comply with our legal obligations. When you delete your account or submit a valid deletion request, we delete or anonymize your personal data as described on our Data Deletion page.

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, alteration, or misuse. However, no system is completely secure. In the event of a personal data breach that is likely to pose a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware, and we will notify affected users without undue delay as required by applicable law.

9. Your rights

Depending on where you live, you may have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data. You can update most account details directly in Settings.
• Deletion: request deletion of your personal data. You can delete your account from Settings or submit a request as described on our Data Deletion page.
• Portability: receive your data in a structured, machine-readable format.
• Restriction or objection: restrict or object to certain processing, including processing based on legitimate interests.
• Withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at support@izop.ai. We will respond within 30 days. If you are in the EEA, UK, or Switzerland you also have the right to lodge a complaint with your local data protection supervisory authority.

10. Marketing communications and opt-out

We may send you marketing emails about new features, tips, and offers from iZop AI. You can opt out at any time by clicking the unsubscribe link in any marketing email, or by emailing support@izop.ai with "Unsubscribe" in the subject line. Even after opting out, you will continue to receive transactional messages (receipts, security alerts, service notices).

11. Cookies and analytics

We use cookies and similar technologies to keep you logged in, remember preferences, and understand how the Service is used. Specifically:

• Strictly necessary cookies: required for authentication and core Service features. These cannot be disabled.
• Analytics: we use Google Analytics and Vercel Speed Insights to understand how the Service is accessed and to improve performance. These tools may collect your IP address and usage patterns in aggregated form.

You can control or disable cookies through your browser settings. Disabling certain cookies may affect Service functionality. For EEA, UK, and Swiss users, we rely on your consent for non-essential cookies.

12. California residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information we collect and share, the right to delete your information, and the right to opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information for cross-context behavioral advertising. To exercise your California rights, contact us at support@izop.ai.

13. Agency and data processor relationship

This section applies to marketing agencies, social media managers, community managers, and other professionals ("Administrator") who use iZop AI to manage social media accounts on behalf of their clients ("Brands").

13.1 Roles

When you use iZop AI as an Administrator to manage Brand accounts, the following roles apply under GDPR and applicable data protection law:

• You (the Administrator) are the Data Controller for the personal data of the Brands you manage and their audiences. You decide what data is processed and for what purpose.
• Xethra LLC (iZop AI) is the Data Processor. We process personal data strictly as instructed by you, acting as your service provider, and not for our own purposes.

13.2 What data we process on your behalf

When you connect a Brand's social accounts to iZop AI, we access and process on your behalf: profile information, posts and captions, comments on posts, direct messages and conversations, analytics (views, likes, followers, reach), and any content you create or schedule through the platform.

13.3 Duration

We process Brand data for as long as the relevant social accounts are connected in iZop AI. When you disconnect an account or delete it from iZop AI, or when your iZop AI account is closed, we delete or anonymize the corresponding Brand data as described in our Data Deletion page.

13.4 Our obligations as Data Processor

As your Data Processor, Xethra LLC commits to:

• Process Brand personal data only as necessary to provide the iZop AI Service and only on your documented instructions.
• Not use Brand personal data for our own purposes, including product improvement, marketing, or AI model training.
• Ensure that all personnel with access to Brand data are bound by confidentiality obligations.
• Implement appropriate technical and organizational security measures to protect Brand data.
• Notify you without undue delay (and in any case within 72 hours of becoming aware) of any personal data breach affecting Brand data, including: the nature of the breach, categories and approximate number of affected individuals, likely consequences, and measures taken or proposed to address the breach.
• Assist you in responding to requests from data subjects (Brand audience members) exercising their rights under GDPR or other applicable law.
• Assist you in conducting data protection impact assessments (DPIAs) where required.
• Make available to you all information necessary to demonstrate our compliance with these obligations and cooperate with any reasonable audit you commission.
• Not engage a sub-processor (a third party to whom we further delegate processing) without your general authorization. Our current sub-processors relevant to Brand data include our hosting provider (Vercel/Supabase) and, for AI-assisted features, OpenAI. By using iZop AI you grant general authorization for these sub-processors. We will notify you of any new sub-processors and give you the opportunity to object.
• Where sub-processors are used, impose on them data protection obligations equivalent to those described here, and remain fully liable to you for their performance.
• Upon termination of the service relationship, cease accessing Brand data and delete or return it at your request, subject to any legal retention requirements.

13.5 Your obligations as Data Controller

As the Data Controller for Brand data, you are responsible for:

• Ensuring that you have a lawful basis to process Brand data and to share it with iZop AI.
• Providing appropriate privacy notices to Brand audiences explaining how their data is processed.
• Ensuring that connecting a Brand's social accounts to iZop AI is authorized by the Brand (e.g. through your client contract).
• Notifying supervisory authorities and affected individuals of data breaches as required by applicable law.
• Supervising our processing and notifying us promptly if any of our actions would violate applicable data protection law.

13.6 Data Processing Agreement (DPA)

If your jurisdiction or your clients require a formal Data Processing Agreement (DPA), or if you need Standard Contractual Clauses (SCCs) for cross-border transfers, download and self-sign our DPA at izop.ai/dpa. For questions, contact us at support@izop.ai.

15. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and update the "Last updated" date. If changes are material, we will notify you by email or by a prominent notice in the Service. Continued use of the Service after changes are posted constitutes acceptance.

16. Contact us

For privacy-related questions, to exercise your rights (access, deletion, export, correction), or to submit a data subject request, contact us at support@izop.ai. Use subject line "Privacy request" or "Data deletion request" so we can route it quickly.

We will respond to valid requests within 30 days. See our Data Deletion page for details on how to request deletion of your account and data.