Privacy Policy

This Privacy Policy applies to the 20X website, product, and related services. It supplements our regional notices for the EU GDPR, India DPDP Act, and EU AI Act.

Account data: name, work email, organization, role, password hash.
Billing data: billing address, tax IDs, and payment method tokens (card numbers are handled by our PCI-DSS-certified payment processors - we do not store them).
Usage data: IP address, device and browser metadata, pages visited, feature usage, timestamps.
Customer content: workflows, prompts, uploaded files, and data you send to integrated services through 20X.
Support data: messages and attachments you send us.
Connected social accounts: only if a customer connects Facebook or Instagram via OAuth — see section 3.

When a 20X customer connects a Facebook Page or Instagram professional account through OAuth, we collect the following only for those connected accounts:

• Page ID and Page name;
• Instagram account ID and username;
• access tokens, encrypted at rest with AES-256-GCM;
• inbound messages;
• public comment text;
• sender IDs (Facebook PSID and Instagram IGSID) and the sender’s profile name.

Purpose: to generate automated replies as the connected business — including replies that may be AI-generated — and to operate the workflows the customer configures. We do not use this data for 20X’s own advertising.

For this social-account data, the connecting business is the controller (or Data Fiduciary) and 20X acts as a processor on the business’s behalf. People who message or comment on the Page or Instagram account — not only the business’s admins — can request deletion; see Data deletion.

To provide and operate the Service; process payments; secure the platform; support you; generate automated replies on connected Facebook and Instagram accounts where the customer has enabled that; comply with legal obligations; and, with your consent where required, send product updates and marketing. We do not sell personal data.

We share personal data with sub-processors that host, secure, and operate the Service. Each is bound by data-processing terms. Named providers include:

• AI model providers — OpenAI and Google Gemini: they receive the text needed to generate agent replies, including replies sent via connected Facebook Pages and Instagram accounts. Under our current API terms they do not train their models on 20X customer data.
• Analytics and tag management — Google Tag Manager and Google Analytics 4: We use Google Tag Manager to manage website tags and Google Analytics 4 to measure website usage and product/website events. Advertising and conversion-measurement technologies, where enabled, are described in Section 11.
• Payment processors: Stripe, Paddle, and Razorpay where applicable.
• Cloud infrastructure, email delivery, and communications providers required to run the Service.

When a customer connects Facebook or Instagram, message content also flows through Meta Platforms under Meta’s terms with that customer. Meta is the platform the customer chose; 20X is not selling that data to Meta.

A current sub-processor list is available on request at privacy@20x.business.

Personal data may be processed outside your country. Where required, we rely on Standard Contractual Clauses, adequacy decisions, or equivalent safeguards. See our GDPR page for details.

Account data is deleted or anonymized within 90 days of account closure, subject to legal hold and billing records (retained per statutory requirements, typically 7 years). Social-account data follows the specific periods in section 8.

• Messages, public comments, transcripts, sender IDs, and profile names collected from a connected Facebook Page or Instagram account are retained for 90 days from the date we receive them, then deleted.
• Access tokens are stored encrypted (AES-256-GCM) and are deleted when the customer disconnects the account in 20X, when Meta sends an app deauthorization callback, or on a valid deletion request — whichever happens first.
• Page ID/name and Instagram account ID/username are kept only while the connection is active, then deleted with the connection.

End customers (people who messaged or commented), not only business admins, can request deletion of their data. Instructions: /legal/data-deletion. You can also email privacy@20x.business. We acknowledge requests within 2 business days and complete deletion within 30 days.

Encryption in transit (TLS 1.2+) and at rest (including AES-256-GCM for Facebook/Instagram access tokens), role-based access controls, audit logging, least-privilege administration, and regular vulnerability testing. Report suspected issues to security@20x.business.

Depending on your jurisdiction, you may have the right to access, correct, delete, port, or restrict processing of your personal data, and to withdraw consent. Contact privacy@20x.business or use Data deletion for Facebook/Instagram data. EU/EEA residents may also lodge a complaint with their supervisory authority; Indian residents may contact the Data Protection Board of India.

We use strictly necessary cookies and similar technologies that are required to operate and secure the website and Service, including authentication and session management.

Google Tag Manager

We use Google Tag Manager ("GTM"), provided by Google LLC, to manage and deploy tags and tracking technologies on our website. GTM is a tag-management service and primarily facilitates the deployment of other technologies. The information collected through tags deployed using GTM depends on the particular services configured in our GTM container.

Our current production website uses GTM to deploy Google Analytics 4 and, where applicable, advertising and conversion-measurement technologies described below. We do not load GTM or these analytics and advertising tags in our development, UAT, or local environments.

Google Analytics 4

We use Google Analytics 4 ("GA4") to understand how visitors use our website, measure website traffic and performance, and analyze product and website events. GA4 may collect information such as IP address, device and browser information, approximate location, online identifiers, pages viewed, and interactions with our website.

We configure our analytics implementation to avoid intentionally sending directly identifying information, such as email addresses, to Google Analytics.

Google Ads

We may use Google Ads and related Google measurement technologies to measure advertising and conversion performance and, where permitted by applicable law and your choices, support advertising activities.

Meta Pixel

We may use the Meta Pixel, provided by Meta Platforms, Inc., to measure the effectiveness of advertising campaigns, understand interactions with our website, and, where permitted by applicable law and your choices, support advertising and remarketing activities.

Consent and controls

Where applicable law requires consent for analytics, advertising, or other non-essential tracking technologies, we obtain consent before activating those technologies. We use Google Consent Mode to communicate applicable consent choices to Google's tags.

You may manage applicable cookie and tracking preferences through our consent mechanism where available. You may also control cookies through your browser settings. Disabling certain cookies or technologies may affect some website functionality.

We do not currently use session-replay technologies such as Microsoft Clarity. If we introduce additional analytics, advertising, or tracking technologies that materially affect personal-data processing, we will update this Privacy Policy and, where required, our consent mechanism before or when those technologies become active.

20X is not directed to children under 18 and we do not knowingly collect their data. If you believe a child has provided personal data, contact us and we will delete it.

Setoo Solutions Pvt Ltd, Grievance Officer - privacy@20x.business. Postal address available on request. Facebook/Instagram deletion: Data deletion.