This policy explains how Xerxes (“we”, “us”) collects, uses, shares and protects information when you use XE Social at https://social.xerxes.ie (the “Service”), a tool to plan, schedule, publish and analyse posts on Facebook, Instagram and YouTube.
1. Information we collect
- Account information — your name, email address, password (stored only as a secure hash), workspace name, role and timezone.
- Connected social accounts — when you connect Facebook, Instagram or YouTube, we receive the account or page ID, name, username, profile picture and an access token from that platform. We never see or store your social media passwords.
- Content you create — captions, hashtags, scheduled dates, comments, and the images and videos you upload to the Media Library.
- Analytics — reach, impressions, engagement and follower figures that the platforms provide for your connected accounts.
- Billing — your plan and invoices. Card payments are handled by our payment provider (Stripe); we do not store full card numbers.
- Usage and security data — sign-in times, IP address, browser type and a log of actions taken in your workspace, used for security, support and the activity history.
2. How we use information
- To provide the Service: publish and schedule your posts, show your calendar, queue, media and analytics.
- To manage your account, team members, plan and invoices.
- To send service emails such as invitations, password resets and publishing alerts.
- To keep the Service secure, prevent abuse and fix problems.
We do not sell your personal information and we do not use your content or social account data for advertising.
3. Facebook, Instagram and YouTube data
We use data received from Meta (Facebook and Instagram) and Google (YouTube) only to provide the features you use in XE Social — publishing your posts and showing your accounts and analytics — and only for the accounts you choose to connect. You can disconnect an account at any time from Social Accounts, and you can also remove our access from your Facebook, Instagram or Google account settings.
XE Social’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. YouTube features are subject to the YouTube Terms of Service and the Google Privacy Policy.
4. Sharing
We share information only:
- with the social platforms you connect, to publish content on your behalf;
- with members of your own workspace, according to their role;
- with service providers that help us run the Service (hosting, email delivery, payments), under confidentiality obligations;
- when required by law, or to protect the rights and safety of our users and the Service.
5. Security
Access tokens for connected accounts are encrypted (AES-256). Passwords are hashed, connections use HTTPS, and access inside a workspace is limited by role. No method of storage or transmission is completely secure, but we work to protect your information.
6. Cookies
We use one essential session cookie to keep you signed in and protect your forms. We do not use advertising or third-party tracking cookies.
7. Data retention
We keep your information while your account is active. When a social account is disconnected, its access token is deleted. When an account or workspace is deleted, its posts, media and connected accounts are removed from our systems, except where we must keep records (such as invoices) by law.
8. Your rights and data deletion
You can view and edit your profile in Settings, export your workspace data, delete posts and media, and disconnect social accounts at any time.
To delete your data:
- Disconnect your accounts in Social Accounts — this deletes their stored access tokens.
- To delete your whole account and workspace, email us at the contact details on our website from your account email with the subject “Delete my data”. We will delete your account, connected accounts, posts and media within 30 days and confirm by email.
- You can also remove XE Social from Facebook (Settings → Apps and websites) or from your Google account (Security → Third-party access).
9. Children
The Service is not intended for anyone under 18, and we do not knowingly collect information from children.
10. Changes to this policy
We may update this policy. We will change the “Last updated” date above and, for significant changes, notify account owners by email or in the app.
11. Contact
Questions about privacy: the contact details on our website.