Privacy
Policy
Privacy Policy
Last Updated: January 2026
Summary of Key Points
What personal information do we process? We collect information you provide (account details, creator/brand profiles, payment information), automatically collected data (usage patterns, device information, cookies), and information from third parties (social media analytics, authentication providers).
Do we process sensitive information? We do not intentionally collect or process sensitive personal information.
Do we collect information from third parties? Yes, we collect analytics and profile information from social media platforms you connect, and authentication data from login providers (Google, Facebook, etc.).
How do we process your information? We use your information to provide our services, facilitate creator-brand connections, process payments, send communications, improve our platform, ensure security, and comply with legal obligations.
When do we share personal information? We share information with your consent, with service providers who help operate our platform, in business transfers, when required by law, and in aggregated anonymized form.
What are your privacy rights? Depending on your location, you have rights to access, correct, delete, port, and restrict processing of your personal data. You can also opt out of marketing communications and manage cookie preferences.
How do you exercise your rights? Contact us at privacy@8x.social to exercise your privacy rights or ask questions about our data practices.
Introduction
Welcome to 8x ("we," "our," or "us"). We are committed to protecting your privacy and ensuring transparency about how we collect, use, and share your information. This Privacy Policy explains how we handle your personal data when you use our platform at https://8x.social and https://app.8x.social.
By using our services, you confirm that you are at least 18 years of age and agree to the collection and use of information in accordance with this Privacy Policy.
Data Controller: Epistemy d.o.o. (trading as "8x"), a company registered in Slovenia at Leskoskova cesta 9E, 1000 Ljubljana, Slovenia (VAT ID: SI18830641), is the controller of your personal data.
Information We Collect
Information You Provide
We collect information that you provide directly to us, including:
- Account Information: Name, email address, username, password, and profile information
- Creator Information: Social media handles, analytics data, content performance metrics, and audience demographics
- Brand Information: Company details, campaign preferences, and marketing objectives
- Payment Information: Billing details and payment card information (processed securely through Stripe - see Stripe Privacy Policy)
- Communications: Messages, feedback, and support requests you send to us
- Content: Posts, comments, campaigns, and other content you create or share on our platform
Automatically Collected Information
When you use our services, we automatically collect:
- Usage Data: Pages viewed, features used, time spent on platform, click patterns, and interaction data
- Device Information: IP address, browser type, operating system, device identifiers, and mobile network information
- Location Data: General location based on IP address (we do not collect precise geolocation)
- Cookies and Tracking: We use cookies, web beacons, and similar technologies to track activity and store preferences (see Tracking Technologies section below)
Information from Third Parties
- Social Media Platforms: When you connect your social media accounts, we collect publicly available data and analytics from platforms like Instagram, TikTok, YouTube, and others
- Authentication Providers: Information from services like Google or Facebook when you use social login (see Social Login section below)
- Analytics Providers: Aggregated and anonymized data from third-party analytics services like Google Analytics and PostHog
Google Analytics Integration (for Brands)
Brand users can optionally connect their own Google Analytics 4 (GA4) properties to view website traffic data alongside campaign activity on 8x.
What we access (using the analytics.readonly scope):
- List of GA4 properties you have access to (so you can choose which to connect)
- Daily traffic metrics: users, sessions, pageviews, engagement rate
- Device breakdown: mobile, desktop, tablet visitors
- Geographic data: top countries by visitors
How we use this data:
- Display traffic trends on your brand dashboard
- Help you visualize how creator campaigns may correlate with website traffic changes
What we don't do:
- We never modify your GA4 configuration
- We use read-only access only
- We don't share your GA4 data with other users or third parties
Disconnecting: You can disconnect your GA4 account anytime in Settings → Integrations. This stops data syncing and removes stored metrics from our platform. You can also revoke access via Google Account Permissions.
How We Use Your Information
We use the information we collect to:
Provide and Improve Our Services
- Create and manage your account
- Facilitate connections between creators and brands
- Display analytics and performance metrics
- Process payments and transactions
- Send transactional emails and notifications
- Provide customer support
- Improve our platform features and user experience
Marketing and Communications
- Send promotional emails about new features, campaigns, and opportunities (you can opt out anytime)
- Personalize your experience and show relevant content
- Conduct surveys and gather feedback
Safety and Security
- Detect and prevent fraud, abuse, and security incidents
- Enforce our Terms of Service and other policies
- Comply with legal obligations and requests from authorities
- Protect the rights and safety of our users and the public
Analytics and Research
- Analyze usage patterns and trends
- Conduct research and development
- Create aggregated, anonymized statistics about our user base
Legal Bases for Processing (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds:
Consent
We process your data based on your consent when you:
- Sign up for our services and create an account
- Connect social media accounts to our platform
- Opt in to marketing communications
- Accept cookies through our cookie banner
You can withdraw consent at any time by contacting privacy@8x.social or updating your account settings.
Contractual Necessity
We process your data to fulfill our contract with you, including:
- Providing access to our platform and services
- Processing payments and transactions
- Delivering customer support
- Facilitating creator-brand collaborations
Legitimate Interests
We process your data based on our legitimate business interests, including:
- Improving and developing our platform
- Analyzing usage patterns and trends
- Detecting and preventing fraud and abuse
- Marketing our services to existing users
- Ensuring platform security and stability
We balance these interests against your privacy rights and will not process data where your rights override our legitimate interests.
Legal Obligations
We process your data to comply with legal requirements, such as:
- Tax and accounting obligations
- Responding to lawful requests from authorities
- Complying with data protection regulations
- Maintaining records as required by law
How We Share Your Information
We do not sell your personal information. We share your information only in the following circumstances:
With Your Consent
- When you explicitly authorize us to share information
- When you make your profile or content public
- When you connect with brands or creators on the platform
Service Providers
We share information with trusted third-party service providers who help us operate our platform, including providers for cloud hosting, payment processing, email delivery, analytics, customer support, and authentication services.
These providers are contractually obligated to protect your data and use it only for the services they provide to us.
Business Transfers
If 8x is involved in a merger, acquisition, bankruptcy, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our platform before your information is transferred and becomes subject to a different privacy policy.
Legal Requirements
We may disclose your information if required by law, legal process, or government request, or if we believe disclosure is necessary to:
- Comply with applicable laws and regulations
- Respond to valid legal requests (subpoenas, court orders, etc.)
- Protect our rights, property, or safety
- Prevent fraud or security threats
- Protect the rights and safety of our users and the public
Aggregated Data
We may share aggregated, anonymized data that does not identify you personally with partners, advertisers, and the public for research, marketing, and analytics purposes.
Tracking Technologies and Cookies
What Are Cookies?
Cookies are small text files placed on your device by websites you visit. They help websites remember your preferences and improve your browsing experience.
Types of Cookies We Use
Essential Cookies (Required)
- Authentication and session management
- Security and fraud prevention
- Load balancing and performance
Analytics Cookies (Optional)
- Google Analytics: Tracks user behavior and site usage
- PostHog: Product analytics and feature usage tracking
- These help us understand how users interact with our platform
Preference Cookies (Optional)
- Language and locale preferences
- Theme and display settings
- User interface customizations
Marketing Cookies (Optional)
- Conversion tracking
- Retargeting campaigns
- Email campaign effectiveness
Cookie Management
Browser Controls: You can manage cookies through your browser settings:
- Chrome: Settings → Privacy and Security → Cookies
- Firefox: Settings → Privacy & Security → Cookies
- Safari: Preferences → Privacy → Cookies
- Edge: Settings → Privacy → Cookies
Google Analytics Opt-Out: Install the Google Analytics Opt-out Browser Add-on
Note: Disabling essential cookies may prevent you from accessing certain features of our platform.
Do Not Track (DNT)
We do not currently respond to Do Not Track (DNT) browser signals, as there is no universal industry standard for how to interpret and implement DNT requests. We will reassess our DNT policy as standards evolve.
Social Login and Third-Party Authentication
What We Collect via Social Login
When you sign in using Google, Facebook, or other authentication providers, we collect:
From Google:
- Name
- Email address
- Profile picture
- Google user ID
From Facebook:
- Name
- Email address
- Profile picture
- Facebook user ID
How We Use Social Login Data
We use this information to:
- Create and authenticate your account
- Personalize your profile
- Send you important notifications
- Verify your identity
Your Control
You can revoke our access to your social media accounts at any time through the respective platform's settings:
- Google: Google Account Permissions
- Facebook: Facebook App Settings
Revoking access will not delete your 8x account, but you'll need to set up email/password authentication to continue using our services.
Your Rights and Choices
Access and Update
You can access and update your account information at any time through your account settings at app.8x.social.
Data Portability
You have the right to request a copy of your personal data in a structured, machine-readable format (JSON or CSV). Contact privacy@8x.social to request your data export.
Deletion and Right to Be Forgotten
You can request deletion of your account and personal data by:
- Logging into your account at app.8x.social
- Going to Settings → Account → Delete Account
- Or by emailing privacy@8x.social
Note that we may retain certain information as required by law or for legitimate business purposes (fraud prevention, financial records, etc.).
Marketing Communications
You can opt out of promotional emails by:
- Clicking the "unsubscribe" link in any marketing email
- Updating your email preferences in account settings
- Emailing privacy@8x.social with your request
You will continue to receive transactional emails (account notifications, payment receipts, etc.) even if you opt out of marketing.
Cookies and Tracking
See the "Tracking Technologies and Cookies" section above for detailed instructions on managing cookies and analytics tracking.
Regional Privacy Rights
EU/EEA, UK, and Switzerland (GDPR)
If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights:
- Right to Access: Request what personal data we hold about you
- Right to Rectification: Correct inaccurate or incomplete data
- Right to Erasure: Request deletion of your data ("right to be forgotten")
- Right to Restriction: Limit how we process your data
- Right to Data Portability: Receive your data in a portable format
- Right to Object: Object to processing based on legitimate interests
- Right to Withdraw Consent: Withdraw consent at any time
- Right to Lodge a Complaint: File a complaint with your local data protection authority
California, USA (CCPA/CPRA)
If you are a California resident, you have the following rights:
- Right to Know: What personal information we collect, use, and share
- Right to Delete: Request deletion of your personal information
- Right to Correct: Correct inaccurate personal information
- Right to Opt Out: Opt out of "sale" or "sharing" of personal information (Note: We do not sell personal information)
- Right to Limit Use of Sensitive Information: Limit use of sensitive data (if applicable)
- Right to Non-Discrimination: Not be discriminated against for exercising your rights
Other US State Privacy Rights
If you are a resident of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), or Utah (UCPA), you have similar rights to California residents, including:
- Right to access your personal data
- Right to delete your personal data
- Right to correct inaccuracies
- Right to opt out of targeted advertising
- Right to opt out of profiling for certain purposes
How to Exercise Your Rights
To exercise any of the above rights, please:
- Email us: privacy@8x.social with your request
- Include: Your name, email address, and specific right you wish to exercise
- Verify your identity: We may ask for additional information to confirm your identity
We will respond to your request within:
- 30 days for GDPR requests (may be extended by 60 days if complex)
- 45 days for US state privacy law requests (may be extended by 45 days if complex)
You may designate an authorized agent to make requests on your behalf. The agent must provide proof of authorization.
Data Retention
We retain your information for as long as your account is active or as needed to provide our services. After account deletion, we may retain certain information for a reasonable period as necessary for:
- Legal compliance and regulatory requirements
- Tax and accounting obligations
- Resolving disputes and enforcing agreements
- Preventing fraud and abuse
- Backup and disaster recovery purposes
Retention periods vary based on data type, purpose, and legal requirements in applicable jurisdictions. When data is no longer needed, we securely delete or anonymize it.
Security
We implement industry-standard technical and organizational security measures to protect your information, including encryption, access controls, secure development practices, and regular security assessments.
However, no system is completely secure. While we strive to protect your information using commercially reasonable means, we cannot guarantee absolute security. If you become aware of any security vulnerability, please report it to security@8x.social.
International Data Transfers
8x operates globally. Your information may be transferred to and processed in countries other than your own, including the United States and European Union. These countries may have different data protection laws than your country of residence.
Safeguards for International Transfers
When we transfer data internationally, we use appropriate safeguards:
- Standard Contractual Clauses (SCCs): EU Commission-approved clauses for transfers from EEA/UK to third countries
- Adequacy Decisions: We transfer to countries recognized by the EU Commission as providing adequate protection
- Data Processing Agreements: Contracts with service providers requiring GDPR-equivalent protection
- Additional Security Measures: Encryption, access controls, and monitoring for international transfers
If you have questions about international data transfers, contact privacy@8x.social.
Age Requirement
8x is for adults only. Our services are intended exclusively for users who are at least 18 years of age. We do not knowingly collect or process personal information from anyone under 18.
Third-Party Services and Links
Our platform may contain links to third-party websites, services, or social media platforms, including:
- Social media platforms (Instagram, TikTok, YouTube, etc.)
- Payment processors (Stripe)
- Analytics providers (Google Analytics)
- Other creator and brand tools
We are not responsible for the privacy practices of these third parties. These third-party services have their own privacy policies, and we encourage you to review them before providing any personal information.
Our integration with these services is limited to what is necessary to provide our platform functionality.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
When we make significant changes, we will:
- Update the "Last Updated" date at the top of this policy
- Notify you via email at the address associated with your account
- Display a prominent notice on our platform
- In some cases, request your explicit consent to the changes
Material changes (e.g., new data collection practices, sharing with new third parties) will be communicated with reasonable advance notice before taking effect.
Your continued use of our services after changes constitutes acceptance of the updated policy. If you do not agree to the updated policy, you must stop using our services and may delete your account.
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.
Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
- Privacy Email: privacy@8x.social
- Support Email: support@8x.social
- Security Issues: security@8x.social
- Mailing Address: Epistemy d.o.o. (trading as 8x), Leskoskova cesta 9E, 1000 Ljubljana, Slovenia
Response Time: We aim to respond to all privacy inquiries promptly.
For EU/EEA/UK Users
If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the right to lodge a complaint with your local data protection authority (also known as a supervisory authority) if you believe we have not addressed your privacy concerns adequately.
Find your data protection authority:
- EU: European Data Protection Board
- UK: Information Commissioner's Office (ICO)
- Switzerland: Federal Data Protection and Information Commissioner
Agreement
By using 8x, you acknowledge that you have read, understood, and agree to this Privacy Policy. You confirm that you are at least 18 years of age and have the legal capacity to enter into this agreement.
Thank you for trusting 8x with your information. We are committed to protecting your privacy and providing transparency about our practices.