Legal

Privacy Policy

Last updated: September 23, 2026

1. Introduction

This Privacy Policy explains how Rixora ("we," "our," or "us") collects, uses, shares, and protects personal data when you visit RixoraAgency.com or use our services (the "Service"). For data you provide and content you create in the Service, we act as a controller for account and billing data and as a processor for the content you submit. The data controller is Rixora Agency LLC, 4089 Palmetto Drive, Lexington, Kentucky 40513, USA.

2. Data We Collect

  • Account data: name, email, password (hashed), company name, and profile details.
  • Billing data: subscription plan, transaction history, and payment metadata. Card details are handled by Stripe; we do not store full card numbers.
  • Content & prompts: business information, brand inputs, prompts you submit, and AI-generated output you create and store.
  • Usage data: pages viewed, features used, device and browser information, and IP address.
  • Cookies & similar technologies: used for authentication, preferences, and analytics (see Section 7).

Data from Facebook and Instagram

If you connect a Facebook Page or an Instagram professional account to Rixora with Facebook Login, we receive only the data covered by the permissions you approve on Meta's consent screen:

  • your Facebook user ID and name, to identify the connection;
  • the list of Facebook Pages you manage, and the name, ID, and access token of the Page you connect;
  • the username and ID of the Instagram professional account linked to that Page; and
  • the posts Rixora publishes for you, with their engagement counts (reactions, likes, comments, shares) and your follower counts.

We use this data only to publish the content you create, approve, or schedule in Rixora (or that you have set Rixora to publish automatically), to show you your connected accounts, and to report how your published posts perform, including in recommendations you ask for. We do not sell this data, use it for advertising, share it with data brokers, or use it to train AI models.

Access tokens are stored in our database with access limited to your account and our backend services, and are deleted as soon as you disconnect the account in Rixora. Other data received from Meta is kept while your Rixora account is active and deleted when your account is deleted.

You can disconnect at any time in Rixora, or remove Rixora in your Facebook settings under Apps and websites or Business integrations. To have all of your data deleted, follow the steps on our Data Deletion page.

3. How We Use Data

  • To provide, secure, and operate the Service and your account;
  • To process AI generations you request and store your content;
  • To process payments, subscriptions, and credits;
  • To provide support and send service and transactional communications;
  • To analyze and improve the Service and prevent abuse and fraud; and
  • To comply with legal obligations.

4. Legal Bases (EEA/UK)

Where applicable, we rely on: performance of a contract (to provide the Service and billing), legitimate interests (to secure and improve the Service and prevent abuse), consent (for optional analytics/marketing cookies where required), and legal obligation (for tax and compliance).

5. AI Processing

When you use AI features, your prompts and relevant context are sent to third-party AI providers to generate output. We do not sell your prompts or output. We instruct our AI providers to process this data to deliver results and, where applicable, subject to their terms; we do not authorize them to train foundation models on your content where an opt-out is available to us.

6. Subprocessors

We share data with trusted service providers ("subprocessors") who process it on our behalf under appropriate agreements. The providers active for the Service may include:

  • Supabase — database, authentication, storage, and serverless functions (hosting of account and content data).
  • Stripe — payment processing and subscription billing.
  • Resend — transactional and account email delivery.
  • OpenRouter and underlying AI model providers — AI text and image generation.
  • Cloudinary — media storage and delivery (where enabled).
  • PostHog — product analytics.
  • Sentry — error monitoring and diagnostics.
  • Google — fonts, analytics, and sign-in (where enabled).

This list reflects the providers currently enabled and may be updated as the Service evolves. We do not sell your personal data.

7. Cookies

We use strictly necessary cookies for authentication and core functionality, and, subject to consent where required, analytics cookies to understand usage. You can control non-essential cookies through your browser settings or any in-product consent controls we provide.

8. International Transfers

Your data may be processed in countries other than your own, including where our subprocessors operate. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses for cross-border transfers.

9. Data Retention

We retain account and content data for as long as your account is active and as needed to provide the Service. After account closure we delete or anonymize personal data within a reasonable period, except where we must retain it to comply with legal, tax, accounting, dispute-resolution, or security obligations. You may contact us for details about the retention period applicable to your data.

10. Security

We use industry-standard measures including encryption in transit, access controls, and tenant isolation to protect your data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your Rights

Depending on your location, you may have the right to access, correct, delete, port, or restrict processing of your personal data, and to object to certain processing or withdraw consent. To exercise these rights, contact us at info@rixoraagency.com. You may also lodge a complaint with your local data protection authority.

12. Data Processing Agreement

Business customers who require a Data Processing Agreement (DPA) for the content they process through the Service may request one at info@rixoraagency.com.

13. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

14. Changes

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated revision date and, where appropriate, communicated to you.

15. Contact

For privacy questions or requests, contact us at info@rixoraagency.com.