Legal

Privacy Policy

Last updated: April 25, 2026

This Privacy Policy describes how glabs AI ("we", "us", or "our") collects, uses, and shares information about you when you use xmdbot and our related websites, applications, and services (collectively, the "Service"). By using the Service, you agree to the terms of this Privacy Policy.

1. Who We Are

xmdbot is operated by glabs AI. You can contact us at [email protected] for any questions about this policy or your personal data.

2. Information We Collect

We collect the following categories of information:

2.1 Information You Provide

  • Account information: name, email address, and any profile details you choose to add when creating an account.
  • Authentication data: sign-in credentials and session tokens generated when you sign up or log in.
  • Communications: messages you send us through support channels, forms, or email.
  • Content: any text, links, or data you submit to the Service, including content generated through X (Twitter) integrations you connect.

2.2 Information Collected Automatically

  • Usage data: pages viewed, features used, clicks, referring URLs, and timestamps.
  • Device data: browser type, operating system, approximate location (derived from IP), and device identifiers.
  • Product analytics (PostHog): we use PostHog as our sole product-analytics provider to understand how the Service is used and improve it. PostHog may set first-party cookies or use local storage. See our Cookie Policy for details.

We do not use Google Analytics, Meta Pixel, or any third-party advertising or marketing trackers.

2.3 Information from Third Parties

  • X (Twitter) integrations: when you connect an X account, we receive profile information and content access permissions as authorized by you through X's OAuth flow.
  • Authentication providers: basic profile information from any social login you use.

3. How We Use Your Information

We process your information to:

  • Provide, operate, and maintain the Service;
  • Create and authenticate your account and secure your session;
  • Respond to support requests and communicate service updates;
  • Understand product usage and improve features (via PostHog);
  • Detect, prevent, and address fraud, abuse, or security issues;
  • Comply with legal obligations.

4. Legal Bases for Processing

Where the GDPR applies, we rely on the following legal bases:

  • Contract: to provide the Service you request.
  • Legitimate interests: to secure the Service, analyze product usage, and improve features.
  • Consent: for any optional cookies or communications (you can withdraw consent at any time).
  • Legal obligation: to comply with applicable laws.

5. How We Share Information

We share information only with:

  • Service providers (sub-processors) that help us run the Service. Today this includes PostHog for product analytics, plus infrastructure providers used to host the application, send transactional email, and operate authentication. We will update this policy as our sub-processor list changes.
  • Legal and safety reasons: when required by law, subpoena, or to protect rights, property, or safety.
  • Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy.

We do not sell your personal information.

Advertising (future)

The Service is currently fully free and contains no advertising. We may introduce advertising in the future. If and when we do, we will update this policy in advance to describe what data is shared with advertising partners and what choices you have (including any applicable opt-outs). We will not retroactively share previously collected data with ad networks without an appropriate legal basis.

6. International Data Transfers

The Service is available globally. Your information may be processed in countries other than your own, including the United States and the European Union. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. We delete or anonymize data when it is no longer needed, except where retention is required by law.

8. Your Rights

Depending on your location, you may have the following rights:

  • Access — request a copy of your personal data.
  • Correction — request corrections to inaccurate data.
  • Deletion — request deletion of your personal data.
  • Portability — receive your data in a structured, machine-readable format.
  • Objection / Restriction — object to or restrict certain processing.
  • Withdraw consent — where processing is based on consent.
  • Complaint — lodge a complaint with your local data protection authority.

To exercise your rights, contact us at [email protected].

California Residents (CCPA/CPRA)

California residents have additional rights, including the right to know, delete, correct, and opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as defined under the CCPA.

9. Children's Privacy

The Service is not intended for children under 16 (or the age required in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we will delete it.

10. Security

We implement administrative, technical, and physical safeguards designed to protect your information. No method of transmission or storage is 100% secure, but we continuously work to improve our security posture.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date. Material changes will be communicated via email or through the Service.

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us at [email protected].