Privacy Policy

Data controller

Hoxigen is the controller of your account data: how you sign in, what you pay, and how you use the service. For anything in this policy — including access, correction and deletion requests — write to legal@hoxigen.app; workspace owners can also export or delete their workspace themselves (section 9).

For the content you connect and create in Hoxigen — your sites, posts, the comments on them, your leads and newsletter lists — you are the controller and we act as your processor. Our Data Processing Addendum, part of the Terms of Service, governs that relationship.

Information you give us

• Account details — name, email address and a hashed password. We never store your password in readable form. If you sign in with Google, we receive your name and email address from Google instead.
• Sign-in security — your authenticator secret or passkeys if you set up two-factor sign-in, and a marker for browsers you chose to trust.
• App profiles — the URL of the app or site you want marketed, and everything drafted or edited from it: description, audience, tone, keywords, brand colours and knowledge-base notes.
• Channel connections — access tokens and page or account identifiers for the platforms you connect, plus the webhook URL and signing secret for your own site.
• Billing details — your name, billing email and a customer reference from our payment provider. We never see or store your card number.
• Anything you write to us — support messages, contact-form submissions and their attachments.

Information generated by using the service

• Content — the posts, articles, images, video, voiceovers and schedules created for your apps, together with edits, approvals and rejections.
• Publishing records — what was published where and when, delivery attempts, retries and failures, and the activity log the dashboard shows you.
• Performance data — engagement figures returned by the platforms you connect, and, if you set it up with your own service account, Google Analytics 4 traffic for your site.
• Technical data — IP address, browser and device type, and timestamps, kept in server logs for security and debugging.

Purposes and legal bases

• To run the service — generating, scheduling and publishing your content, and showing you the queue, calendar and results. Basis: performance of our contract with you.
• To take payment — subscriptions, top-ups and invoices. Basis: contract, and our legal obligation to keep tax records.
• To keep the service safe and working — abuse prevention, rate limiting, debugging, error reports from your browser and our servers (PostHog, EU) and backups. Basis: our legitimate interest in a service that stays up and is not misused.
• To support you — answering what you write to us. Basis: contract and legitimate interest.
• To tell you about the service — operational email about your account (basis: contract). Marketing email only where you have opted in (basis: consent), and every one has an unsubscribe link.
• To improve our public pages — analytics and session recordings on the site, sign-in and sign-up pages, with everything you type masked. Basis: your consent, given in the bar at the bottom of those pages and withdrawable at any time from the Cookie settings link in the site footer. See the Cookie Policy.

We do not sell personal data or use it for third-party advertising.

How your content reaches the models

Text, images, speech and video are generated by sending your app profile, your instructions and relevant prior content to AI providers through OpenRouter, which routes each request to a model provider such as Google (Gemini), OpenAI, Anthropic or xAI. Presenter videos are made by HeyGen and the AI visibility check's Google engine searches the web through Exa, both reached through OpenRouter. The sub-processors page lists every one.

Your content is not used to train models by us, and we do not sell it. Text, image and speech requests go only to model endpoints that neither keep nor train on what we send (OpenRouter's zero data retention routing). Video generation and web search have no such endpoint; for those, the provider's own terms govern retention.

Hoxigen’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We explicitly affirm that Google user data is not used to train generalized or non-personalized AI or machine learning models.

AI output can be wrong, generic or unintentionally similar to something that already exists. That is why the queue exists — review anything you would not want published unread. Responsibility for what publishes under your name sits with you, as set out in the Terms.

Who else processes data, and for what

Our database and application are hosted by Railway in the EU (Amsterdam), and media is kept in EU-hosted storage. Card details are entered directly with SUMIT, our payment provider; we never see or store your card number. These providers process personal data for us:

Platforms you connect yourself — Meta, LinkedIn, X, Reddit, TikTok, Google (YouTube, Search Console, Analytics), Microsoft (Bing Webmaster Tools, Clarity), Notion, your CMS, Telegram and Slack — receive what you tell Hoxigen to send them, under their own terms with you. If you turn on instant indexing, the addresses of your published articles also go to the search engines you choose: Bing, Google (your sitemap), the IndexNow engines (Bing, Yandex, Naver, Seznam, Yep) and Baidu. The sub-processors page is the current list, and we update it before a new provider starts receiving data.

Tokens, permissions and revoking access

When you connect a platform — Facebook, Instagram, LinkedIn, X, Reddit, YouTube, Bing Webmaster Tools, Notion and the rest — you authorise Hoxigen on that platform’s own screen. We never see your platform password. We store the access token and the page or account identifiers needed to publish on your behalf and to read back engagement figures on posts we published.

We request only the permissions the features you use require, and we do not read your personal profile, your friends, or your direct messages. On the pages and accounts you connect we read the published posts and their comments and engagement — including posts you made yourself — to measure results and to keep Hoxigen from writing content that already exists there.

You can revoke access at any time — from Hoxigen by disconnecting the channel, or from the platform’s own settings (for Meta, Settings → Business Integrations; for Microsoft and Bing, your Microsoft account's app permissions; for Google, YouTube and Search Console, via the Google Security Settings page). Disconnecting in Hoxigen clears its stored channel credentials and stops publishing. Revoking at the platform prevents further authorised use; disconnect in Hoxigen as well to clear its stored credentials. The same applies to every other network you connect.

What we set in your browser

Signing in and connecting your accounts use first-party cookies that are strictly necessary, such as the session cookie hoxigen_session and one-time nonces for each sign-in or connection. The dashboard also remembers a few choices, like the app you last opened and your light or dark theme.

On our public pages, PostHog (EU) and Microsoft Clarity load only after you accept them in the consent bar, and your answer is kept in your browser's local storage so we do not ask again. Neither sets cookies on hoxigen.app; Microsoft's own domain may set its MUID cookie where your browser allows third-party cookies. Withdrawing consent from the Cookie settings link in the footer stops both at once. We do not use advertising cookies, and the dashboard runs no third-party analytics. When a page hits an error, on the site or in the dashboard, your browser sends an error report to PostHog (EU): the error, the page address without its query, your browser, and in the dashboard your user, workspace and app ids. It sets no cookies and stores nothing in your browser. The Cookie Policy lists every item by name.

Retention

• Content and publishing history — remain in your account until you delete an eligible item or your account is deleted. Published items and their history are not automatically removed at the media retention age.
• Media — unused assets can be removed after the plan’s media retention window (30 days on Starter, 90 on Business, 180 on Studio, 365 on Agency) or to meet its storage limit. Media attached to queued items, articles and other active content may remain longer.
• Account data — kept while your workspace exists. When a workspace is deleted, it waits out a 30-day grace period; after that the workspace and everything in it, payment history included, is permanently deleted.
• Receipts and tax records — SUMIT, our payment provider, keeps the receipts it issued for as long as Israeli tax law requires (currently about seven years). Our own copy of your payments is deleted with your account.
• AI cost records — a record of each AI request's model, size and cost is kept after account deletion for our accounting. It holds no content and nothing that identifies you.
• Short-lived records — application activity logs are pruned after 14 days, in-app notifications after 90 days, and public posts found by Listening after 90 days.
• Backups — roll off within about 30 days, so deleted data leaves them within that time.

Workspace owners delete their workspace themselves under Your data in Workspace settings. Anyone can also ask by writing to legal@hoxigen.app; we verify the request first, and the same 30-day grace period then applies. Deletion does not retract posts already published to platforms you connected — delete those from the platform.

What you can ask for

Subject to the law that applies to you — including the Israeli Privacy Protection Law and, where relevant, the GDPR — you may ask us to give you a copy of your personal data, correct it, delete it, export it in a portable format, restrict or object to a particular use, or withdraw a consent you gave. Where we rely on legitimate interests, you may object and we will stop unless we have compelling grounds not to.

Workspace owners can do the two most common ones themselves, under Your data in Workspace settings: request a full export, which arrives as a ZIP file behind a private link we email to you and which expires after 7 days, or delete the workspace (see section 8). For these or any other right, anyone can also write to legal@hoxigen.app and we will answer within 30 days. If you are in the EU or UK and are not satisfied, you may complain to your local supervisory authority; in Israel, to the Privacy Protection Authority.

How we protect it, and where it goes

Data is encrypted in transit with TLS. Passwords are hashed. Platform tokens, API keys and webhook secrets are encrypted at rest with AES-256-GCM. Two-factor sign-in is available to everyone, and workspace owners can require it. Each workspace is isolated from every other, and our staff enter yours only when its owner grants support access for a limited time. Outgoing webhooks are signed with HMAC-SHA256 so your site can verify they came from us. The Data Processing Addendum lists every measure.

No system is perfectly secure. If a breach affects your personal data, we email you without undue delay and in any case within 48 hours of becoming aware of it, and notify the relevant authority as the law requires.

Our database and application are in the EU, and we operate from Israel, which the European Commission recognises as providing adequate protection. Some providers process data in the United States; those transfers rely on Standard Contractual Clauses or, for certified providers, the EU-US Data Privacy Framework. The sub-processors page names the safeguard for each.

Age

Hoxigen is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.

Updates to this policy

If we change this policy we will update the date at the top, and for material changes we will tell account owners by email before the change takes effect. Continuing to use Hoxigen after that means the updated policy applies.