Who we are
Repost21 is a platform for creating, scheduling, and publishing content to social networks, managing incoming messages, and automating social media work with AI. The service is operated by "XSOFT" LIMITED LIABILITY COMPANY (Tax ID 311262547), Obod Turmush MFY, 80-Dakha Street 19, office 48, Bekabad, Tashkent Region, Uzbekistan, contact [email protected]. "XSOFT" LLC is the data controller for the data described below. This policy explains what data we process when you use Repost21 and why.
Account data
When you create an account, we store your email address and password (hashed, never in plain text). You may optionally add your name, profile photo, phone number, and time zone. If you sign in with Google or Apple, we receive your email and name from them to create your account.
Connected social accounts
When you connect a social network (such as Instagram, Facebook, Threads, Telegram, LinkedIn, X, YouTube, TikTok, Reddit, or WhatsApp), we store the access tokens that let us act on your behalf. Tokens are kept encrypted, are never shown to you, and are never shared. Depending on the network, we access your profile information, the posts and metrics needed for analytics, and incoming direct messages when you enable the inbox.
Content you create
We store the content you produce in Repost21 — post drafts and published posts, generated and uploaded images and videos, hashtags, schedules, knowledge-base documents, brand assets, and automation flows. This content is used only to provide the service to you and your team.
Messages and contacts
If you use the unified inbox, we store incoming and outgoing messages from your connected channels, along with the contact details your customers share (such as name, username, and profile photo) so you can reply and keep conversation history. Voice messages may be transcribed to text to help you and AI agents respond.
How we use data
We use your data to publish and schedule your content; deliver and answer messages in the inbox; generate text, images, and video with AI when you ask; build analytics and recommendations; send service notifications; provide support; and keep the service secure. We never sell your data or share it for third-party advertising.
Data from social platforms
Data we receive from social networks — including the Meta platforms Instagram, Facebook, and Threads — is used solely to provide the features you turn on: publishing posts, reading your own metrics, and handling your direct messages. We do not use platform data for advertising, do not sell it, and handle it in line with each platform's terms. You can revoke our access at any time by disconnecting the account or removing Repost21 in the network's own settings.
Google user data
If you connect Google services, we request only the access each feature needs. Google Calendar: "calendar.events" lets us add a meeting to your primary calendar when you or your AI agent books one with a customer; "calendar.app.created" lets us create a separate "Repost21 — Content plan" calendar and keep your scheduled posts in it. Google Drive files: "drive.file" lets us create the spreadsheets and documents you export from Repost21 (leads, analytics, posts and plans) and read only the documents and spreadsheets you pick yourself in the Google window — to use as a knowledge base for your AI agent or to import a content plan; we cannot see any other files in your Drive. Your Google email identifies the connected account. YouTube: "youtube.upload" publishes the videos you schedule, "youtube.readonly" reads your channel name and video list, "yt-analytics.readonly" shows your channel analytics. We store the access tokens encrypted, the IDs of files you picked or we created, and — for knowledge-base documents — their text, so your agent can answer from it. When an AI feature uses a Google document, its text is sent to our AI providers only to produce the answer for you; it is not used to train AI models, ours or anyone else's. We never sell Google data, never use it for advertising, and our staff do not read it unless you ask us to, it is needed for security, or the law requires it. Repost21's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. By connecting YouTube you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms); Google's Privacy Policy is at https://policies.google.com/privacy. You can revoke access at any time: disconnect Google in Repost21 (Channels → Integrations, or remove the YouTube channel in Channels) or remove Repost21 at https://myaccount.google.com/permissions. On disconnect we delete the tokens immediately and the data received from Google within 30 days, or sooner on request to [email protected].
AI processing and subprocessors
To generate and analyze content, we send the relevant text — and where needed images — to AI providers (such as Anthropic, OpenAI, and Google) and use services for embeddings and speech-to-text. We use infrastructure and email providers to run the service and send transactional email. These providers process data only to perform their function for us and may not use it for their own purposes.
Payments
Payments for paid plans are processed by payment providers: ATMOS (JSC "NATIONAL INNOVATIVE PAYMENT TECHNOLOGIES") for cards issued in Uzbekistan and Lemon Squeezy for international payments — cards, PayPal, Apple Pay, and Google Pay. To start a payment, we pass the provider what is needed for the order — the selected plan, the amount, and your account ID or email; the provider collects your card details and any contact details it needs directly on its own secure payment page. The provider may share this data with banks, payment systems (UZCARD, HUMO, Visa, Mastercard, UnionPay), and wallet services (PayPal, Apple Pay, Google Pay) to complete the payment, prevent fraud, and comply with anti-money-laundering laws, and may verify your identity — including with biometric data where the law requires it. We never receive or store your full card number or security code: we only get the payment status, amount, date, and, for card payments, a masked card number. We keep payment records for as long as accounting and tax laws require. Details are in our Payment Policy.
Storage and security
Passwords are hashed, social access tokens are encrypted, and access to data is restricted. We keep your data for as long as your account is active or as needed to provide the service, and retain limited non-identifying logs for abuse prevention.
Deleting your data
You can delete your account and all associated data at any time from Settings or by emailing [email protected] — see our Data Deletion page for details. Disconnecting a social account immediately removes its stored tokens.
Your rights
You can access, correct, export, or delete your data. We honor GDPR and CCPA requests within 30 days. To exercise any right, email [email protected].
Cookies and analytics
We use essential cookies to keep you signed in and remember your settings, and analytics (Yandex Metrica, Google Analytics 4 and our own cookie-free Umami counter) to understand how the website and the app are used. On your first visit we ask you to accept this in a short notice. We do not use cross-site advertising trackers. The full list of cookies and how to refuse them are in our Cookie Policy.
Changes and contact
We may update this policy as the product evolves; the date above reflects the latest version. Questions about privacy? Email [email protected].