Privacy Policy

How BuzzBit X collects, uses, and protects your data.

Effective: February 16, 2026   |   Last Updated: February 16, 2026

1. Information We Collect

1.1 Information You Provide

When you create an account, subscribe to a plan, or use our services, we collect information you directly provide:

• Account Information: Name, email address, password, company name, and job title.
• Billing Information: Payment card details, billing address, and transaction history (processed securely via Cardcom).
• Profile Information: Profile photo, timezone, language preferences, and notification settings.
• Marketing Content: Campaign content, templates, images, and audience lists you upload.
• Communications: Messages you send to our support team, feedback, and survey responses.

1.2 Information Collected Automatically

When you use BuzzBit X, we automatically collect certain technical and usage data:

• Device Information: Browser type, operating system, device identifiers, and screen resolution.
• Usage Data: Pages visited, features used, clicks, session duration, and navigation patterns.
• Log Data: IP address, access times, referring URLs, and error logs.
• Performance Data: Page load times, API response times, and application errors.

1.3 Information from Third Parties

We may receive information from third-party integrations you connect, such as Shopify, WooCommerce, Meta (Facebook/Instagram), WhatsApp Business API, TikTok, and Google Analytics. The data collected depends on the permissions you grant during integration setup.

1.4 Meta Platform Data (Facebook & Instagram)

When you connect your Facebook or Instagram account, we collect the following data based on the permissions you grant:

• Account Information: Your Meta user ID, name, and email address (for identification purposes only).
• Page Data: Facebook Pages you manage, including page names, IDs, and access tokens (encrypted at rest).
• Instagram Business Account: Connected Instagram business profile, follower count, and profile information.
• Messages: Facebook Messenger and Instagram Direct messages sent to your business pages, used to power AI-assisted responses.
• Webhook Events: Real-time notifications about messages, comments, and page interactions.

How to disconnect: You can disconnect your Facebook/Instagram account at any time from Settings → Integrations → Meta, or by removing BuzzBit from your Facebook App Settings. When you disconnect, we immediately revoke access tokens and stop receiving new data. Existing data is retained per our retention schedule (see Section 4) unless you request deletion.

Data deletion: You can request complete deletion of your Meta-related data through our Privacy Center, or by removing BuzzBit from your Facebook settings (which triggers an automatic deletion request). We process deletion requests within 30 days.

1.5 TikTok Platform Data

When you connect a TikTok account, we receive only the data necessary for the BuzzBit X Direct Post feature:

• Creator Identity: Your TikTok open_id and display nickname, used to identify which TikTok account a post will be published to.
• Creator Posting Capabilities: The values returned by TikTok's creator_info/query endpoint (privacy options, interaction toggle states, max video duration). These are read live before each post and never persisted long-term.
• OAuth Tokens: Access and refresh tokens, encrypted at rest with AES-256-GCM. These are used only to make publish and status-fetch calls on your behalf when you compose a post.
• Publish Identifiers: After a successful publish, we store the publish_id returned by TikTok and, once the post is moderated and live, the publicly_available_post_id. These let you see which BuzzBit X post corresponds to which TikTok video.

The video and photo files you upload are streamed to TikTok via the Direct Post PULL_FROM_URL pipeline and are NOT modified by BuzzBit X. The bytes TikTok receives are identical to the bytes you uploaded. We do not add watermarks, overlays, or branding to your content.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To provide, maintain, and improve BuzzBit X and its features.
• Campaign Execution: To send marketing messages on your behalf across email, WhatsApp, and social media channels (including publishing posts to TikTok at your direction).
• Analytics: To provide you with campaign performance metrics, insights, and recommendations.
• AI Features: To power content generation, send-time optimization, segmentation, and predictive analytics.
• Security: To detect, prevent, and respond to fraud, abuse, and security threats.
• Communication: To send you service announcements, billing notifications, and support responses.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.
• Product Improvement: To analyze usage patterns and improve the Platform (using aggregated, anonymized data).

3. How We Share Your Information

We do not sell your personal information. We share your data only in the following circumstances:

Recipient	Purpose	Data Shared
Cardcom	Payment processing	Billing information, transaction details
Resend	Email delivery	Recipient addresses, message content
Meta (WhatsApp)	WhatsApp messaging	Phone numbers, message content
TikTok	Publishing your content to your own TikTok account	Caption text, video/photo file (transferred via Direct Post API), the privacy + interaction settings you select
OpenAI	AI content generation	Prompts and context (no PII by default)
Supabase	Database hosting	All stored data (encrypted at rest)
Sentry	Error monitoring	Error logs, stack traces (no PII)

We may also disclose your information if required by law, court order, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Specific retention periods:

Data Type	Retention Period
Account information	Duration of account + 30 days
Campaign data & analytics	Duration of account + 30 days
Billing records	7 years (legal requirement)
Server logs	90 days
Support conversations	3 years
Cookie data	Up to 12 months
TikTok OAuth tokens	Until you disconnect (then revoked at TikTok and removed locally)

After account deletion, we permanently erase your personal data within 30 days, except where longer retention is required by law (e.g., billing records for tax purposes).

5. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data ("right to be forgotten").
• Right to Portability: Receive your data in a structured, machine-readable format (JSON or CSV).
• Right to Restrict Processing: Request limitation of how we process your data.
• Right to Object: Object to processing of your data for specific purposes.
• Right to Withdraw Consent: Withdraw previously given consent at any time.

For GDPR (EU/EEA/UK): You may exercise these rights by contacting our Data Protection Officer at support@buzzbitx.com.

For CCPA (California): You have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell your personal information.

We will respond to all valid requests within 30 days. To protect your privacy, we may verify your identity before processing your request.

6. AI Training Opt-Out

BuzzBit X uses AI features including content generation, send-time optimization, and audience segmentation. By default, your workspace data is not used to train our AI models.

We use only anonymized, aggregated data to improve our AI capabilities. However, you may control your AI data preferences:

• Opt In: Allow your anonymized data to contribute to model improvement (Settings → Privacy → AI Data Sharing).
• Opt Out: Ensure none of your data is used for any AI training purposes, even in anonymized form.
• Disable AI: Turn off all AI-powered features for your workspace entirely.

When you use AI content generation, your prompts are sent to our AI providers (e.g., OpenAI) for processing. We strip personally identifiable information from prompts by default. Our AI providers are contractually prohibited from using your data to train their models.

7. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3.
• Encryption at Rest: All stored data is encrypted using AES-256 encryption. OAuth tokens (including TikTok) use AES-256-GCM.
• Access Controls: Role-based access controls (RBAC) with workspace-level isolation.
• Password Security: Passwords are hashed using bcrypt with a minimum cost factor of 12.
• Infrastructure: Hosted on SOC 2 Type II certified infrastructure with regular security audits.
• Monitoring: 24/7 intrusion detection, anomaly monitoring, and automated threat response.
• Backups: Daily encrypted backups with point-in-time recovery capability.

While we take comprehensive measures to secure your data, no method of electronic transmission or storage is 100% secure. If you discover a security vulnerability, please report it to security@buzzbitx.com.

8. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to provide and improve our services:

• Essential Cookies: Required for authentication, security, and core functionality. Cannot be disabled.
• Analytics Cookies: Help us understand how you use the Platform. Can be disabled.
• Preference Cookies: Remember your settings like language, timezone, and theme. Can be disabled.

We do not use third-party advertising cookies or cross-site tracking technologies. You can manage your cookie preferences through your browser settings or the cookie banner displayed on first visit.

We honor Do Not Track (DNT) browser signals and Global Privacy Control (GPC) signals.

9. Children's Privacy

BuzzBit X is not intended for children under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will take immediate steps to delete that information.

If you believe a child has provided us with personal information, please contact us at support@buzzbitx.com.

10. International Data Transfers

BuzzBit X operates globally and may transfer your data across international borders. We ensure appropriate safeguards for all transfers:

Transfer Mechanism	Applicable Region
EU-U.S. Data Privacy Framework	EU/EEA to US transfers
Standard Contractual Clauses (SCCs)	EU/EEA, UK, and Switzerland
Adequacy Decisions	Countries recognized by the EU Commission

All sub-processors are required to maintain equivalent data protection standards through contractual obligations and regular compliance reviews.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes:

• We will update the "Last Updated" date at the top of this page.
• We will notify you via email at least 30 days before changes take effect.
• We will display a notice within the Platform.

We encourage you to review this Privacy Policy periodically. Your continued use of BuzzBit X after the effective date constitutes acceptance of the updated policy.

12. MCP & OAuth Connector Data

When you connect a third-party AI assistant (such as Anthropic's Claude Desktop, Claude.ai, or Claude Code) or your own application to BuzzBit X via the Model Context Protocol (MCP) or OAuth 2.0, the following data-handling practices apply:

12.1 Authentication & Token Storage

• Bearer API keys (format bz_live_…) are bcrypt-hashed at rest. Plaintext is shown to you exactly once at issuance and never logged.
• OAuth access & refresh tokens are stored as SHA-256 hashes. The plaintext is returned only in the /oauth/token response body and never persisted.
• OAuth client secrets (issued via Dynamic Client Registration) are bcrypt-hashed, same threat model as passwords.

12.2 Scope & Workspace Isolation

• OAuth access tokens carry a granular scope (read, write, or execute) chosen by you on the consent screen. The scope limits what data and what mutations the connected application can perform on your behalf.
• Every token is scoped to a single BuzzBit X workspace. A token issued for Workspace A cannot read or write data in Workspace B under any circumstance — enforced at the database query layer on every operation.

12.3 What We Share with the Connected Application

Only the data the application requests via a specific MCP tool call, filtered by your workspace and the token's scope. We do not proactively send your data to any third party. The connected application receives the response to each tool call and is independently responsible for its handling and retention.

12.4 What We Log

Each tool call is logged with: timestamp, tool name, workspace ID, token ID, and outcome (success/error). We do not log the contents of returned data. Logs are retained for 90 days for security audit and abuse detection, then deleted.

12.5 Token Lifecycle & Revocation

• OAuth access tokens expire in 1 hour. Refresh tokens expire in 30 days and rotate on every use (per RFC 6819) — reusing a rotated refresh token revokes the entire token family.
• Bearer API keys have no expiration unless you set one explicitly.
• You can revoke any token at any time from Settings → Integrations → API Keys, or by calling POST /oauth/revoke for OAuth tokens (RFC 7009).

12.6 Anthropic-Listed Connector

If you connect BuzzBit X through Anthropic's official Claude Connectors directory, Anthropic operates the user-facing consent and token management. BuzzBit X receives the same tokens described above; we do not receive your Anthropic account information beyond what's needed to provision the connection. Anthropic's own privacy policy governs the AI assistant's handling of data returned by BuzzBit X — see anthropic.com/privacy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out:

For EU/EEA residents, if you are not satisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority (DPA).