Privacy Policy

Last updated: September 27, 2026

This Privacy Policy explains how XOPICX ("we", "our", "us") collects, uses and protects information in connection with the XO AI tool, the XOPICX Instagram AI Agent (an automated assistant that responds to Instagram Direct Messages sent to an XOPICX-operated Instagram account), and this website (together, the "Services").

1. Information we collect

Depending on how you use the Services, we may collect:

• Usage data — basic technical information such as browser type, approximate region, and pages visited. This is typically collected in aggregated form to understand how the Services are used.
• Chat input — the text you type into XO AI, which is processed by the model in order to generate responses.
• Contact information — only if you choose to contact us directly and provide an email or other details.
• Instagram DM data — if you message our connected Instagram account, we receive only what Meta includes in the standard Instagram Messaging webhook for that conversation: your Instagram-scoped sender/account identifier (an opaque ID assigned by Meta, not your public username), the text of your message, the conversation/thread identifier, and event metadata (timestamps and a Meta-issued event ID) used to route the message and prevent duplicate processing. We do not access your Instagram password, payment information, precise location, contacts, followers, posts, or stories.

2. How we use information

We may use the information above to:

• Provide and operate XO AI and other tools
• Monitor basic usage and performance
• Improve features, safety and reliability
• Respond to support or feedback messages
• Receive and reply to Instagram Direct Messages sent to our account via the Meta/Instagram Messaging API, and maintain limited conversation context (recent message history scoped to your sender and conversation identifiers) so replies stay coherent within a conversation
• Generate automated replies by sending the verified message text to a configured third-party language model provider; the model receives only the current conversation's recent history and permitted reference material, never other users' conversations

3. Data storage and third-party services

• XO AI relies on third-party model providers and hosting platforms. Your prompts and responses may be processed by those providers in order to generate answers and keep the service running.
• The Instagram AI Agent relies on the Meta/Instagram Messaging API to receive and deliver messages, a configured third-party language model provider to generate reply text, and a hosting/infrastructure provider to run the application and database. Each processes data only as necessary to perform its function on our behalf.
• Instagram DM messages (sender ID, conversation ID, and text) are stored in a private, access-controlled database solely to maintain conversational context for future replies, and are scoped so one user's conversation can never be read as part of another's.
• Records used only to detect duplicate message delivery are retained briefly on a rolling basis (typically 24 hours) and then automatically purged.
• We do not sell your personal data to third parties, and we do not use your DM content to train third-party foundation models beyond the single inference call required to generate your reply.
• We generally aim to keep only the minimum data needed to operate and improve the Services, and retain it only as long as necessary or as required by law.
• Your use of Instagram itself remains governed by Instagram's own Privacy Policy and Meta's Privacy Policy.

4. Cookies and analytics

The website may use basic cookies or analytics tools to understand overall traffic and usage patterns. This helps us see which pages are useful and where the experience can be improved.

5. Security

• Instagram webhook traffic is served over HTTPS/TLS.
• Incoming Instagram webhook requests are authenticated using a cryptographic signature check against Meta's app secret; requests that fail verification are rejected before any data is processed.
• Access to stored Instagram conversations is enforced by sender and conversation identity, so a conversation cannot be read outside its authenticated scope.
• Application logs redact secrets and access tokens automatically, and user identifiers are stored in logs only as one-way cryptographic fingerprints rather than raw identifiers.
• Credentials and API keys used by the Services (Meta app secret, page access tokens, model provider keys) are kept in server-side configuration only and are never included in messages, logs, or replies sent to users.
• Access to production systems and stored data is restricted to authorized XOPICX personnel.

6. Your choices

• You can choose not to provide optional information. If you do not agree with this policy, please do not use the Services.
• If you contact us and later want us to delete your messages, you can request removal where possible.
• Instagram AI Agent: you may stop messaging our Instagram account at any time to end processing, or block/restrict the account using Instagram's own controls. You may also request deletion of your stored Instagram conversation history by contacting us (see "Contact" below) with the Instagram handle you messaged us from; upon a verified request, we will delete the associated stored messages without undue delay. Duplicate-prevention event records are purged automatically regardless of any request.

7. Children

The Services are not specifically targeted at children under 13. If you are a parent or guardian and believe your child has provided personal information, please contact us so we can review and, where appropriate, remove the data.

8. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the Services after changes are posted means you accept the revised policy.

9. Contact

If you have any questions about this Privacy Policy, or wish to make a data deletion request regarding the Instagram AI Agent, you can reach us at privacy@xopicx.online or xrpbusinessx@gmail.com. For Instagram-related deletion requests, please include the Instagram handle you used to message us so we can locate and remove the associated conversation.

This Privacy Policy template is provided for general informational purposes only and does not constitute legal advice.