CMO AISign in

Privacy Policy

Last updated September 2026

What we collect

  • Your account details: name, email address, and a hashed password.
  • Material you give us to learn from: links you add, files you upload, and the text extracted from them.
  • Social account connections: the access tokens issued by each platform, plus your public profile details such as handle, display name, avatar, and follower count.
  • Content the service produces for you, your feedback on it, and the engagement figures the platforms report back.

How social account data is used

Access tokens are used for exactly two things: publishing the posts you approve, and reading the performance of posts we published. We do not read your inbox, your private messages, or content we did not publish.

Tokens are encrypted at rest with AES-256-GCM and are decrypted only for the duration of a single API call. They are never written to logs, never shown in the interface, and never shared with third parties.

Google user data

If you connect Google Analytics, you grant CMO AI read-only access through the analytics.readonly permission, and we receive the email address of the Google account you connect so we can show which account it is.

With that access we:

  • list the Google Analytics properties your account can already see, so you can choose which one measures your app;
  • read aggregated daily report figures for the property you choose — active users, new users, sessions, screen views, engagement time, and new and active users by acquisition channel — for the most recent 28 days.

We never read data about individual people, and the permission cannot change, create or delete anything in your Analytics account.

These figures are used for one purpose: to show you how your app is doing and to produce the marketing recommendations in your workspace. To write those recommendations, the aggregated figures are sent to our AI provider, which processes them only to generate your recommendations. We do not use Google user data to develop, improve, or train generalised AI or machine learning models, we do not sell it, we do not use it for advertising, and we do not share it with anyone else.

Google access tokens are encrypted at rest with AES-256-GCM, the same as every other connection. See How we protect your data for the full set of safeguards.

AI processing of Google user data

The aggregated figures described above are sent to a language model to write your recommendations. We name the services involved so you can check them yourself:

  • OpenRouter (openrouter.ai), a paid pay-as-you-go API gateway, is the only service we send these prompts to. It forwards them to the model provider.
  • OpenAI serves the text models we use for recommendations (gpt-5.1 and gpt-5-mini), reached through OpenRouter on its paid API tier.
  • Google serves the image model gemini-2.5-flash-image, also through OpenRouter. Image generation never receives Google Analytics data — it is used only for social post artwork.

Every request we send carries the routing restriction data_collection: "deny", which instructs OpenRouter to use only providers that do not retain or train on the contents of the request, and to fail the call rather than fall back to one that would. No Google user data — raw, aggregated or derived — is used to create, train or improve any foundational or generalised machine learning or AI model, by us or by anyone we send it to.

The use of raw or derived user data received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove this access at any time. Choosing Disconnect on the Google Analytics card in Accounts revokes our access with Google and immediately deletes the stored tokens and every figure we read from Analytics. You can also revoke access from your Google account at myaccount.google.com/permissions; collection stops at once, and you can ask us to delete the figures already stored.

CMO AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google Play Console reports

If you give our service account access in Play Console, we read the install, uninstall and rating report files Google writes to your reports storage bucket. That access is granted and removed in Play Console itself, and is separate from Google Analytics.

Who else sees your data

  • OpenRouter, and through it OpenAI and Google, process your brand material, drafts, and the aggregated performance figures behind your recommendations. None of them train on any of it — see AI processing of Google user data.
  • The social platforms you connect, when publishing to them at your instruction.
  • Nobody else. We do not sell data and we do not use it for advertising.

How we protect your data

Sensitive data — the access tokens for every connected account, your Google Analytics grant, and the figures read through it — is protected by the following measures:

  • In transit: every connection to the service and to each provider API uses TLS. The site is served over HTTPS only.
  • At rest: access and refresh tokens are encrypted with AES-256-GCM under a key held outside the database, so a copy of the database alone does not yield a usable token. Passwords are hashed with Argon2 and are never stored or recoverable in plain text.
  • In use: a token is decrypted only for the duration of a single API call. Tokens are never written to logs, never returned by the API, and never shown in the interface.
  • Access control: data is scoped to the workspace that owns it and is reachable only by members of that workspace, with administrator-only actions such as disconnecting an account or deleting a workspace restricted by role.
  • Infrastructure: the database is not exposed to the public internet and accepts connections only from allow-listed addresses. Application services run as an unprivileged user.
  • Deletion: disconnecting an account deletes its tokens immediately. Disconnecting Google Analytics additionally revokes the grant with Google and deletes every figure read through it. Deleting a workspace deletes everything belonging to it.

Keeping and deleting data

Your data is kept while your account is active. Disconnecting a social account deletes its tokens immediately. Deleting a workspace deletes its content, uploads, learned material, and analytics.

To delete everything, use Settings, or email us and we will action it within 30 days. If you remove the app from Facebook or Instagram, Meta notifies us and we delete the associated tokens automatically.

Your rights

You can request a copy of your data, correction of it, or its deletion at any time. Contact the address below.

Contact

support@xdrop.ai