1. Who We Are
Xtensoft AI Studio ("we", "us", "our") is an AI-powered content production platform for the fashion and apparel industry, operated by Xtensoft. We serve as the data controller for the personal data processed through our platform.
Our registered contact for data protection matters is privacy@xtensoft.ai.
2. Information We Collect
We collect information you provide directly when you create an account, set up your workspace, connect integrations, or use our generation tools.
- Account data: name, email address, phone number (optional), organization name, role, password (hashed).
- Company profile data: business type, brand tone, CTA preferences, signature hashtags, alert contact details.
- Content data: reference images you upload, AI-generated outputs (photos, videos, captions, hashtags), brand kit assets (logo, watermark).
- Integration data: Instagram account ID, username, display name, profile picture, and an encrypted access token when you connect your Instagram account via Meta.
- Billing data: plan selections, credit balances, transaction history, GST/tax identifiers. Payment card details are processed by our payment gateway (Razorpay) and never stored on our servers.
- Usage data: generation volume, feature interactions, session timestamps, device type, browser, IP address, and diagnostic logs.
- Communication data: support requests, feedback, and in-app notification preferences.
3. How We Use Your Information
We process your data for the following purposes:
- Service delivery: to operate the studio, generate content, publish to Instagram, manage your calendar and billing.
- Account management: to authenticate sessions, manage team members, enforce role-based access and session limits.
- Communication: to send transactional emails (verification, password reset, alerts), in-app notifications, and optional digest summaries.
- Security: to detect fraud, enforce rate limits, log audit trails, and maintain platform integrity.
- Improvement: to analyze aggregated, anonymized usage patterns to improve output quality, performance, and user experience.
- Legal compliance: to fulfil tax, accounting, and regulatory obligations.
We do not sell your personal data. We do not use private customer content to train shared public AI models without your explicit opt-in consent.
4. Legal Basis for Processing
Depending on your jurisdiction, we process your personal data on one or more of these bases:
- Contract performance: processing necessary to deliver the service you signed up for.
- Legitimate interest: security, fraud prevention, platform improvement, and support.
- Consent: optional analytics, marketing communications, and any future data uses we ask your permission for.
- Legal obligation: tax records, invoices, and regulatory compliance.
5. Data We Receive From Meta (Instagram)
When you connect your Instagram account, we receive the following from Meta (Facebook/Instagram):
- Your Facebook Page ID and Page name.
- Your Instagram account ID, username, display name, and profile picture.
- An access token that allows us to publish posts on your behalf. This token is stored using AES-256-GCM encryption and is never visible to anyone, including our staff.
We use this data only to display your connected account, publish content you have approved, and retrieve post performance metrics. We never post anything you have not explicitly approved. When you disconnect your Instagram account, the access token is deleted immediately. If you request deletion of your Meta data, we remove the token and all profile details listed above within 30 days. You can delete this data by disconnecting in Settings → Integrations, or by removing Xtensoft AI Studio from your Facebook Business Integrations settings.
6. Third-Party Service Providers (Sub-processors)
We share data with the following categories of service providers, solely to operate the platform:
- AI generation providers: fal.ai (image/video generation) — receives reference images and prompts; outputs are returned to your workspace.
- AI language providers: Google Gemini (caption/hashtag generation) — receives product metadata and brand profile; no personal data is sent.
- Payment gateway: Razorpay — processes payment transactions; we never store card details.
- Email delivery: SMTP provider — delivers transactional emails (verification, alerts, digests).
- Infrastructure: hosting provider for servers, PostgreSQL database, Redis cache, and object storage.
- Meta (Facebook/Instagram): receives your approved content for publishing via the Instagram Graph API.
All sub-processors are contractually bound to process data only as instructed and to maintain appropriate security measures.
7. Data Storage and Security
Your data is protected by multiple layers of security:
- All data is encrypted in transit (TLS 1.2+) and sensitive data at rest (AES-256-GCM for tokens).
- Access is restricted to personnel who require it, and every access is logged in our audit trail.
- Authentication uses secure JWT tokens with HTTP-only cookies, session limits, and automatic token rotation.
- Rate limiting and brute-force protection are enforced on all endpoints.
- Production deployments require PostgreSQL (SQLite is refused), HTTPS, and secure cookie settings.
- Regular security reviews and dependency updates are performed.
8. Data Retention
We retain your data only as long as necessary for the purpose it was collected:
- Account and profile data: retained while your account is active, plus 30 days after deletion request (grace period).
- Generated content and media: 12 months after publishing; rejected or cancelled content is retained for 30 days.
- Analytics and insights: raw data retained for 30 days; aggregated metrics retained while your account is active.
- Audit logs: 24 months, then anonymized or deleted.
- Notifications and delivery logs: 90 days.
- Billing records and invoices: 7 years (legal/tax requirement).
- Login attempts and expired tokens: 1–7 days.
- Deletion receipts: retained permanently with a hashed (non-reversible) tenant identifier for compliance audit.
9. Your Rights
Depending on your jurisdiction (including under India's Digital Personal Data Protection Act 2023 and the EU GDPR), you have the following rights:
- Right to access: request a copy of your personal data. Use the Data Export feature in your account settings.
- Right to correction: update or correct inaccurate information via your Company Profile or account settings.
- Right to deletion: request permanent deletion of your account and all associated data. The account owner can initiate this from Settings → Privacy. A 30-day grace period applies, during which you can cancel.
- Right to data portability: export your data in a standard format (ZIP archive) using the Data Export feature.
- Right to withdraw consent: withdraw consent for optional processing (e.g., analytics cookies) at any time without affecting prior processing.
- Right to object: object to processing based on legitimate interest.
- Right to grievance redressal: if you are unsatisfied with our response, you may escalate to the relevant data protection authority in your jurisdiction.
To exercise any of these rights, email privacy@xtensoft.ai or use the in-app privacy tools. We will respond within 30 days.
10. Cookies
We use the following types of cookies:
- Essential cookies: authentication tokens, session identifiers, and CSRF protection. These are required for the platform to function and cannot be disabled.
- Preference cookies: remember your sidebar state, theme, and notification settings. Stored in your browser only.
- Analytics cookies (optional): if enabled in future, these would track anonymized usage patterns. You can decline them without losing any functionality.
We do not use advertising or tracking cookies, and we do not participate in cross-site tracking networks.
11. International Data Transfers
Your data may be processed in jurisdictions where our infrastructure providers operate. We ensure that any transfer of personal data outside your jurisdiction is protected by appropriate safeguards, including contractual obligations on our sub-processors to maintain equivalent data protection standards.
12. Children's Privacy
Xtensoft AI Studio is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will take steps to delete it.
13. Grievance Officer
In accordance with applicable data protection laws, including the Information Technology Act 2000 and the Digital Personal Data Protection Act 2023 (India), our Grievance Officer can be contacted at:
Email: grievance@xtensoft.ai
Response time: within 30 days of receiving your complaint.
14. Changes to This Policy
We may update this policy as the platform evolves. Material changes will be announced via in-app notification and email to account owners at least 15 days before they take effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.
The revision history of this policy is maintained and can be requested by emailing privacy@xtensoft.ai.
