Privacy Policy

Humxedge Technologies Inc. operates HumXreach and decides how the information described here is used.

Account information.

• Your email address and, if you provide it, your name.
• Sign-in credentials. Passwords are stored only as a one-way hash, or not at all where sign-in is handled by our authentication provider.
• The time you last signed in and were last active, used to expire idle sessions.
• Your role in a workspace, and who else is a member of it.

Business and brand information you give us.

• What your business does, who it serves, and how you want it to sound.
• Products and services you describe, and topics you want content about.
• Brand assets you upload, such as a logo, and brand colours.
• Website addresses you ask us to analyse, and what we extracted from those pages.

Content.

• Marketing content generated for you — post text, captions, hashtags, images and carousels.
• Approvals, edits and scheduling decisions you make about that content.
• Records of publishing attempts, including whether a platform accepted or rejected a post.

Connected social accounts.

• Which accounts you have connected and their display names.
• Access tokens for those accounts, which are encrypted before being stored. We use them only to publish what you have approved.

Usage and operational records.

• Counts of what you generate, used to apply plan allowances.
• Technical records of AI usage, such as which model ran and how much text it processed.
• An audit record of security-relevant and commercial actions in your workspace — who did what, and when.
• Server logs produced while operating the service.
• Error reports, sent when something fails in the application or in your browser. A report describes the fault: the type of error, where in our code it happened, which part of the service was involved, and technical details about the application, browser and device. Reports are configured to leave out the content you create, passwords, sign-in tokens, cookies and the contents of requests, and we do not record your screen or your session.

Subscription information.

• Your plan, its status, and the billing period it runs to.
• Identifiers linking your workspace to the payment provider's record of your subscription.
• Which version of these policies you accepted, and when.

We do not collect, process or store your card details. Card information is entered on a checkout page hosted by Stripe and never reaches our systems.

• To run the service: understanding your business, generating content, and publishing what you approve.
• To keep your account secure and to isolate your workspace from every other customer's.
• To apply plan allowances and manage subscriptions.
• To investigate faults, abuse and billing problems.
• To meet legal and accounting obligations.

We do not sell your information, and we do not use your business information or generated content to advertise to you.

HumXreach depends on the providers below. Apart from payment processing, they process information on our behalf so the service can work, and we do not share your data with anyone else for their own purposes. Payment processing is described under Stripe.

• Supabase — sign-in, the application database, and storage for images and brand assets, which are served from public addresses so social platforms can fetch them.
• OpenAI — generating post text and images from the business information and instructions you provide.
• Upstash (QStash) — scheduling, so posts publish at the time you chose.
• The social platforms you connect, such as Meta for Instagram — they receive the content you approve for publishing, and their own terms and privacy policies apply to it.
• Stripe — payment processing for paid subscriptions. Stripe collects payment details directly, on its own checkout and billing pages, and tells us only what we need to run your plan. We send it your email address and workspace name to set up your subscription. Stripe processes payment and payment-related information under its own privacy policy and its own legal obligations, and its terms and privacy policy apply to that processing.
• Sentry — error monitoring. It receives the error reports described above, so that we can find and fix faults.
• Google Cloud — hosting for the application programming interface, in the United States.
• Render and Cloudflare — hosting and delivery of the website you are reading.

These providers operate internationally, and our application servers run in the United States. Your information will therefore be processed outside the country you are in, including in the United States.

We do not offer a data-residency guarantee, and we would rather say so than imply a choice we cannot honour.

HumXreach does not use advertising or tracking cookies.

When you sign in, the application stores a session token and your current workspace identifier in your browser’s local storage so that you stay signed in between page loads. Clearing your browser storage signs you out. Our hosting and delivery providers may set cookies strictly necessary to serve the site.

• Account, business and content information is kept while your account exists, so that your work stays available to you.
• Cancelling a subscription, or the end of a free trial, does not delete your content — what you created stays in your account.
• Usage, audit and operational records are kept as long as needed for security, billing and legal obligations.
• When an account is deleted, we remove its data from our systems, other than records we are required to keep — for example, payment and invoice records kept in our Stripe account for tax and accounting purposes.

Logos you upload and images HumXreach generates are stored at their own long, unguessable web addresses. Those addresses are not listed anywhere and are not linked to from any public page, but they are not behind your sign-in either: anyone who has the exact address can open the file.

It works this way because Instagram and LinkedIn have to fetch a picture from a public address in order to publish it. We would rather say so than let you assume otherwise. Everything else — your business details, your drafts, your schedule and your account — is reachable only by members of your workspace.

• Access to your workspace is restricted to its members, and the database enforces that isolation independently of the application.
• Social account tokens are encrypted before they are stored.
• Passwords, where we hold them at all, are stored only as a one-way hash.
• Traffic to the service is encrypted in transit.

No service can promise perfect security, and we do not claim any security certification. See the section above for how images and brand assets are served.

Depending on where you live, you may have rights to access a copy of your information, to correct it, to have it deleted, to object to or restrict how it is used, and to complain to a data protection authority.

You can change most business and brand information yourself in the application at any time. For access or deletion of everything else, contact us using the details below and we will respond within the time your local law requires.

We will update this page as the service changes. The date at the top shows when it last changed.

See also our Terms & Conditions.