Privacy Policy

Xicmo (xicmo.com) is operated by BUYBIZZ DIGITAL SOLUTION PVT LTD, a private limited company incorporated in India (“Xicmo”, “we”, “us”). We are the data controller (“data fiduciary” under India's Digital Personal Data Protection Act, 2023) for the personal data described in this policy.

When you use Xicmo to process information about other people, for example the contacts in your outreach lists or the senders of emails in a connected inbox, you decide why and how that data is processed. For that data you are the controller and we act as your processor.

Information you give us

• Account details: your name, email address and password. Passwords are stored only as a bcrypt hash. If you sign in with Google, we receive your name, email and Google account identifier instead.
• Workspace content: your website URL, brand and strategy notes, competitors, keywords, prompts, drafts, posts, outreach sequences, contact lists you upload and anything else you create in the product.
• Billing details: your plan, billing country, invoices and payment status. Card, UPI and bank details are entered directly with Razorpay or PayPal. We never see or store full card numbers.
• Messages to us: what you send to support, sales or this privacy address.

Information from accounts you connect

Agents only work with the accounts you choose to connect, and only within the permissions you grant. Depending on what you connect, this can include:

• Google: Search Console performance data, Google Analytics 4 reports and, if you connect an inbox for outreach, Gmail messages (see section 4).
• Reddit, X, LinkedIn, Hacker News, GitHub, YouTube: your profile, the posts and comments you publish or schedule through us, and public data about the communities, channels and people you target.
• Instagram: your account handle, the session you connect for DM automation, and the conversations those automations handle (see section 5).

Information collected automatically

• Usage and logs: agent runs, credits used, pages viewed in the app, errors, IP address, browser and device type.
• Cookies: strictly necessary cookies for sign-in and security, and Google Analytics only if you accept it. Every cookie is listed in our Cookie Policy.

Public web data

To audit sites and research competitors, our crawler reads public web pages, search results and public social posts. This can include names and handles that people have published openly.

• To provide the service, including running the agents you set up, generating drafts and publishing or sending only what you approve or schedule. Basis: performance of our contract with you.
• To bill you, manage credits, prevent fraud and keep tax records. Basis: contract and legal obligation.
• To keep Xicmo secure, for example rate limiting, abuse detection and debugging. Basis: legitimate interests.
• To communicate with you, through service emails, security notices and the optional weekly digest, which you can switch off in Settings. Basis: contract, and consent for the digest.
• To improve the product using aggregated usage statistics and, if you accept analytics cookies, Google Analytics. Basis: consent and legitimate interests.
• To comply with law and respond to valid legal requests. Basis: legal obligation.

We do not sell your personal data, we do not share it for cross-context behavioural advertising, and we do not use your workspace content or connected-account data to train AI models.

If you connect a Google account, we request only the scopes the feature you turn on needs:

• webmasters.readonly: read your Search Console performance and indexing data for the SEO agent.
• analytics.readonly: read your Google Analytics 4 reports for traffic and conversion insights.
• gmail.readonly, gmail.modify, gmail.send: read replies to your outreach, label and thread them, and send the outreach emails you approve or schedule, from the inbox you connect.

We use this data only to provide and improve the user-facing features you use in Xicmo. The content of a message or report may be sent to one of our AI providers only to produce the summary, classification or draft reply you asked for, under terms that forbid the provider from training on it.

Xicmo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We do not use Google user data for advertising, and we do not sell it or transfer it to data brokers.
• We do not use Google user data to develop, improve or train generalised AI or machine-learning models.
• No person at Xicmo reads your Gmail data unless you ask us to (for example in a support request), it is needed for security or abuse investigations, it is required by law, or it has been aggregated and anonymised for internal operations.
• We transfer Google user data to others only as needed to provide the features above, to comply with law, or as part of a merger or acquisition with notice to you.

You can disconnect Google at any time in Xicmo, or revoke access from your Google Account permissions. When you disconnect, we delete the stored tokens. YouTube creator search uses the YouTube API Services, so the Google Privacy Policy also applies to that data.

Some platforms do not offer an API for the actions our agents take, so we use your own signed-in session instead:

• Instagram. When you connect Instagram for DM automation, either by pasting your session cookies or with the Xicmo Instagram Connector extension (which reads the instagram.com cookies only when you click connect), we encrypt the session with AES-256-GCM before it is stored. It is used only to run the automations you configure, through our automation provider Apify, and is deleted when you disconnect Instagram or delete your workspace.
• LinkedIn. The Xicmo LinkedIn Agent extension carries out your outreach steps inside your own browser, on your own session. Your LinkedIn login and cookies never leave your computer. The extension sends us only the results of each step, such as “invitation sent” or a reply's text, so the sequence can continue.

Our extensions collect nothing beyond what is described here, do not track your browsing, and do not sell or share data for any purpose unrelated to the feature. You can remove them from your browser at any time.

We share personal data only with:

• Service providers (sub-processors) that help us run Xicmo, listed below, under contracts that limit their use of the data to providing their service to us.
• The platforms you connect, when an agent publishes, sends or reads on your behalf.
• Authorities or others when required by law, or to protect the rights, safety or property of our users, the public or us.
• A successor business if we are involved in a merger, acquisition or sale of assets. We will tell you before your data becomes subject to a different policy.

BUYBIZZ DIGITAL SOLUTION PVT LTD is based in India, and our servers are hosted by AWS in the United States. Your data may be processed in India, the United States and the other countries where our providers operate. Where data protection law requires it, for example for users in the EEA, the UK or Switzerland, we rely on safeguards such as the European Commission's Standard Contractual Clauses offered by our providers.

• Account and workspace data: for as long as your account is active. When you delete your account, your workspaces and their content are deleted from our live database straight away.
• Backups: deleted data drops out of our encrypted backups within 30 days.
• Server logs: kept for up to 30 days.
• Connected-account tokens and sessions: deleted when you disconnect the account or delete the workspace.
• Billing and tax records: kept for as long as Indian tax and company law requires (currently up to 8 years), even after account deletion.

Data is encrypted in transit (TLS) and at rest. Passwords are hashed with bcrypt, social sessions are encrypted with AES-256-GCM, and access to production systems is limited to the people who need it. No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

Depending on where you live, you have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate or incomplete data;
• delete your data, or ask us to;
• withdraw consent at any time, without affecting processing that has already happened;
• object to or restrict certain processing, and receive your data in a portable format;
• nominate someone to exercise your rights if you die or become incapacitated (India);
• not be discriminated against for using these rights (California).

How to use them: you can delete your account yourself from Settings → Danger zone, disconnect any integration from its agent page, switch off the digest in Settings, and change your cookie choice as described in the Cookie Policy. For anything else, including a copy of your data, email privacy@xicmo.com from your account email. We respond within 30 days. We may need to verify your identity first.

If you are unhappy with our answer, you can complain to your local data protection authority or, in India, to the Data Protection Board of India.

Xicmo is a business tool for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

In line with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, you can raise any complaint about how we handle your personal data with our Grievance Officer at privacy@xicmo.com. We acknowledge complaints within 24 hours and resolve them within 30 days.

If we change this policy, we will update the date at the top. If a change is material, we will also tell you by email or in the app before it takes effect.

BUYBIZZ DIGITAL SOLUTION PVT LTD, operator of Xicmo. Email privacy@xicmo.com for anything about privacy, or support@xicmo.com for general help.