Privacy Policy

1. Data controller

The data controller is IKTex. The company’s registration details are on the /legal page. All privacy and data deletion requests can be sent to info@iktex.az.

When a company uses IXSocial for its own team, that company decides whose data it enters (for example, the colleagues it invites or the people who appear in its videos) and is responsible for having a lawful basis to do so.

2. Data we collect

The following data is collected when you use the platform:

• Account data: name, email address, a cryptographic hash of your password (never the password itself), role (ADMIN / USER), email verification status, interface language, and a profile image link.
• When signing in with Google: the account identifier, email and name provided by Google. When signing in with Apple: the Apple account identifier, and the email and name Apple shares (which may be a private relay address).
• Company and brand data: company name, brands, brand logos, brand descriptions, the brand’s public website or social links you provide, and per-brand settings.
• Content: post texts, ideas, titles, images, videos, scheduled date and time, status history, approval and rejection comments.
• AI requests: the prompts and reference images you submit for text, image and video generation, and the results returned for them.
• Support messages: what you write to the support desk inside the app, and — if you use the chat on the website without an account — your message and any name, email or phone number you leave so we can reply.
• Activity log: actions taken in the company account (for example, a post approved or a user invited), with the time, the IP address and the browser or device name. The company’s admins can see this log.
• Payment data: see section 5.
• Technical records: server log data such as request identifier, request path, HTTP status and duration.

3. Photos of people and voice recordings (presenter videos)

The presenter studio can make videos in which a person speaks to the camera. To do so it processes:

A face and a voice can identify a person, so we treat them as sensitive data. No video of a real person is rendered until the company has recorded that person’s consent. These materials are used only to create that company’s own videos — never to identify anyone, never for advertising, and never shared with other customers.

To create the voice, the recordings are sent to ElevenLabs, which makes a voice model (a cloned voice) used only for that presenter. When the presenter or the account is deleted, the photos and recordings are deleted and the cloned voice is removed from ElevenLabs.

If you appear in a company’s videos and want your photos or voice removed, ask that company, or write to info@iktex.az.

• Photos of a real person that you upload to create a presenter, and the portraits generated from them.
• Voice recordings you make or upload so that a presenter speaks in that voice, and short recordings of how particular words are pronounced.
• The consent record: who confirmed that the person agreed to be shown, when, and any note added.

4. Data received from social media platforms

When you connect a channel, the following data is received and stored on the basis of the consent you give in the platform permission dialog:

IXSocial does not read your connected accounts’ follower lists, direct messages, or comment content; every permission requested exists solely to publish posts on your instruction, to delete them when you ask, and to show the aggregate statistics of those posts.

• Instagram (Facebook Login — instagram_basic, instagram_content_publish, instagram_manage_contents, instagram_manage_insights, pages_show_list, pages_read_engagement): the connected professional account username, account identifier, the linked Facebook Page name, and access token.
• Facebook (pages_show_list, pages_read_engagement, pages_manage_posts, read_insights): the name and identifier of the Pages you manage, the selected Page, and the access token.
• LinkedIn (openid, profile, email, w_member_social; for company pages also r_organization_social, w_organization_social): the name and identifier of the profile or company page, and the access token.
• TikTok (user.info.basic, video.publish, and video.list where enabled): the display name and app-scoped account identifier (open_id), plus the access and refresh tokens.
• Threads (threads_basic, threads_content_publish, threads_manage_insights, threads_delete): the Threads username, account identifier, and access token.
• Publishing results: the post identifier and any error text returned by the platform.
• Post statistics: the aggregate like, comment, share, save, view and reach counts of posts published through IXSocial.

5. Payments

Payment, cancellation and refund rules are on the /refunds page. For payments:

• Card payments are processed by M-Solution (mPay). You enter your card details on the payment provider’s page; IXSocial never sees or stores the full card number or the security code.
• For automatic renewal we store what the payment provider returns about the card: a card token, the masked card number (for example 4169 •••• •••• 1234), card type, issuing bank and expiry date. You can turn automatic renewal off at any time.
• Payment history: amount, currency, plan, date, status, and the transaction references the bank returns.
• Where a plan is bought inside the mobile app through the App Store or Google Play, the payment is handled by Apple or Google and we receive only the purchase receipt needed to activate the plan.
• If you use a referral code, the code, your company identifier and the amount of payments made with it are shared with RefBonus, the service that runs the referral programme, so the discount and the referrer’s reward can be calculated.

6. The mobile app

The app asks for each device permission only when you first use the feature that needs it. All of them are optional, and you can withdraw them in your device settings:

In the app your sign-in is kept in the device’s secure storage (Keychain on iOS, Keystore on Android). Photos or videos you share into IXSocial from other apps are uploaded only when you attach them to a post.

• Camera — to take photos or videos for a post or a presenter.
• Photo library — to attach your photos or videos, and to save generated images and videos to your device.
• Microphone — to record a presenter’s voice or a pronunciation.
• Face ID / fingerprint — to unlock the app if you turn the app lock on. The check happens on your device; biometric data is never sent to us.
• Notifications — to tell you about approvals, published posts and support replies. To deliver them we store your device’s push token and send notifications through the Expo push service, which passes them to Apple or Google.

7. Why we process data

We process personal data in line with the Law of the Republic of Azerbaijan “On Personal Data” and, where it applies to you, the EU General Data Protection Regulation (GDPR):

• Providing the service itself: accounts, post creation, approval flow, scheduling, publishing, AI generation, presenter videos and support — on the basis of performance of our contract with you.
• Publishing to social media accounts on your behalf — on the basis of the consent you give when connecting a channel.
• Processing a real person’s photos and voice — on the basis of that person’s explicit consent, recorded by the company.
• Taking payments and keeping accounting records — on the basis of our contract and our legal obligations.
• Account security, abuse prevention, activity logging and fault diagnosis — on the basis of legitimate interest.
• Sending essential service email and notifications (email verification, password reset, approvals, publishing results) — on the basis of performance of our contract.

8. AI processing

Text, image and video generation, brand research and the support bot run on Google’s Gemini models. What you submit is sent to Google only to produce the requested result. Some features — news posts and holiday ideas — also let the model run Google Search for public information.

When you add a brand’s website or social links, IXSocial reads those public pages once to describe the brand. AI output can be wrong; it is always shown to you before anything is published. We do not use your content to train AI models.

9. Data sharing

Your data is never sold and never handed to third parties for advertising. The following providers process data for us because the service cannot operate without them; the full list, with what each receives, is on the /subprocessors page:

Data may be disclosed to competent public authorities where the law requires it.

• Meta Platforms (Instagram, Facebook, Threads), LinkedIn and TikTok — publishing, deleting and reading the statistics of posts.
• Google — Gemini AI models, Google sign-in, and Google Play purchases.
• Apple — Sign in with Apple and App Store purchases.
• ElevenLabs — presenter voices, speech, transcription and music.
• M-Solution (mPay) — card payments.
• Contabo — application server and PostgreSQL database hosting.
• Cloudflare R2 — storage of images, videos, logos and recordings.
• Expo — delivery of push notifications to the mobile app.
• RefBonus — the referral programme.
• Email (SMTP) provider — delivery of verification and notification email.

10. International transfers

The providers listed above operate servers in various countries, including the European Union and the United States. Data is transferred to them only as far as needed to provide the service, and their contractual and data-protection commitments apply while it is processed on their infrastructure.

11. Retention

• Account, company and content data, including presenter photos and voice recordings: until you delete them or the account is deleted.
• Social media access tokens: until the channel is disconnected or the token expires (60 days for Meta). Disconnecting a channel deletes the token immediately.
• Payment history: while the company account exists. Card transaction records are also kept by the bank and the payment provider (mPay) for as long as accounting and tax law requires them to.
• Activity log and support messages: while the company account exists.
• Device push tokens: until you sign out of the app or the device stops accepting notifications.
• Verification and password reset codes: deleted once used or once expired.
• Server logs: kept briefly for diagnostics.

12. Security

Passwords are hashed with bcrypt and never stored in clear text. All traffic is encrypted over HTTPS. Social media tokens and card tokens are held server-side only and are never sent to the browser or the app.

Access inside a company is limited by role and by brand. No method of storage or transfer is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

13. Cookies and local storage

The website uses only a few cookies that are needed for it to work or to remember your choices (language, theme) — no advertising, analytics or tracking cookies. The details are on the /cookies page.

14. Your rights

Requests go to info@iktex.az and are answered within 30 days.

• Access your data and obtain a copy of it, in a portable format where applicable.
• Have inaccurate data corrected.
• Have your data deleted — see section 15.
• Withdraw a consent you gave — for example by disconnecting a channel or removing a presenter. Withdrawal does not affect processing that already took place.
• Object to processing based on legitimate interest, or ask for it to be restricted.
• Lodge a complaint with the authority that supervises personal data protection in the Republic of Azerbaijan, or with the data protection authority of your own country.

15. Deleting your account and data

You can delete your account yourself, on the web or in the app: open Profile and choose “Delete account”. If you are the company’s last admin, the whole company account — its brands, posts, media, channel connections, presenters and saved card — is deleted with it.

You can also disconnect a single channel, or remove IXSocial from your Instagram or Facebook account. All the routes are described on /data-deletion.

16. Children

IXSocial is intended for business users and does not knowingly collect data from anyone under 16.

17. Changes and contact

When this policy changes, the “Last updated” date on this page is revised; material changes are announced by email or in the app. Questions: info@iktex.az.