Who we are
Repost21 is a platform for creating, scheduling, and publishing content to social networks, managing incoming messages, and automating social media work with AI. The service is operated by "XSOFT" LIMITED LIABILITY COMPANY (Tax ID 311262547), Obod Turmush MFY, 80-Dakha Street 19, office 48, Bekabad, Tashkent Region, Uzbekistan, contact [email protected]. "XSOFT" LLC is the data controller for the data described below. This policy explains what data we process when you use Repost21 and why.
Account data
When you create an account, we store your email address and password (hashed, never in plain text). You may optionally add your name, profile photo, phone number, and time zone. If you sign in with Google or Apple, we receive your email and name from them to create your account.
Connected social accounts
When you connect a social network (such as Instagram, Facebook, Threads, Telegram, LinkedIn, X, YouTube, TikTok, Reddit, or WhatsApp), we store the access tokens that let us act on your behalf. Tokens are kept encrypted, are never shown to you, and are never shared. Depending on the network, we access your profile information, the posts and metrics needed for analytics, and incoming direct messages when you enable the inbox.
Content you create
We store the content you produce in Repost21 — post drafts and published posts, generated and uploaded images and videos, hashtags, schedules, knowledge-base documents, brand assets, and automation flows. This content is used only to provide the service to you and your team.
Messages and contacts
If you use the unified inbox, we store incoming and outgoing messages from your connected channels, along with the contact details your customers share (such as name, username, and profile photo) so you can reply and keep conversation history. Voice messages may be transcribed to text to help you and AI agents respond.
How we use data
We use your data to publish and schedule your content; deliver and answer messages in the inbox; generate text, images, and video with AI when you ask; build analytics and recommendations; send service notifications; provide support; and keep the service secure. We never sell your data or share it for third-party advertising.
Data from social platforms
Data we receive from social networks — including the Meta platforms Instagram, Facebook, and Threads — is used solely to provide the features you turn on: publishing posts, reading your own metrics, and handling your direct messages. We do not use platform data for advertising, do not sell it, and handle it in line with each platform's terms. You can revoke our access at any time by disconnecting the account or removing Repost21 in the network's own settings.
AI processing and subprocessors
To generate and analyze content, we send the relevant text — and where needed images — to AI providers (such as Anthropic, OpenAI, and Google) and use services for embeddings and speech-to-text. We use infrastructure and email providers to run the service and send transactional email. These providers process data only to perform their function for us and may not use it for their own purposes.
Payments
Payments for paid plans are processed by payment providers: ATMOS (JSC "NATIONAL INNOVATIVE PAYMENT TECHNOLOGIES") for cards issued in Uzbekistan and Lemon Squeezy for international payments — cards, PayPal, Apple Pay, and Google Pay. To start a payment, we pass the provider what is needed for the order — the selected plan, the amount, and your account ID or email; the provider collects your card details and any contact details it needs directly on its own secure payment page. The provider may share this data with banks, payment systems (UZCARD, HUMO, Visa, Mastercard, UnionPay), and wallet services (PayPal, Apple Pay, Google Pay) to complete the payment, prevent fraud, and comply with anti-money-laundering laws, and may verify your identity — including with biometric data where the law requires it. We never receive or store your full card number or security code: we only get the payment status, amount, date, and, for card payments, a masked card number. We keep payment records for as long as accounting and tax laws require. Details are in our Payment Policy.
Storage and security
Passwords are hashed, social access tokens are encrypted, and access to data is restricted. We keep your data for as long as your account is active or as needed to provide the service, and retain limited non-identifying logs for abuse prevention.
Deleting your data
You can delete your account and all associated data at any time from Settings or by emailing [email protected] — see our Data Deletion page for details. Disconnecting a social account immediately removes its stored tokens.
Your rights
You can access, correct, export, or delete your data. We honor GDPR and CCPA requests within 30 days. To exercise any right, email [email protected].
Cookies and analytics
We use essential cookies to keep you signed in and remember your preferences. On our public website we also use analytics tools to understand how visitors use the site. We do not use cross-site advertising trackers.
Changes and contact
We may update this policy as the product evolves; the date above reflects the latest version. Questions about privacy? Email [email protected].