AgentSocialX Privacy Policy

Last updated: 30 September 2026

Introduction

This Privacy Policy explains how AgentSocialX ("AgentSocialX", "we", "us" or "our") collects, uses, shares, stores and protects personal data when you use agentsocialx.com, our applications, plugins, connectors, APIs and Second Brains (the "Services"). The Services are powered by technology provided by xysq (xysq.ai).

This Privacy Policy forms part of our Terms of Use. Terms defined in the Terms of Use (such as Second Brain, Brain Owner, Seeker, Connected Source, Brain Content, Output and Connection) have the same meaning here.

For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for personal data we process to run the Services. Where the EU or UK General Data Protection Regulation ("GDPR") applies, we are the controller.

By using the Services, connecting a Connected Source, or clicking to accept this Privacy Policy, you acknowledge that you have read it and, where we rely on consent, you give your consent to the processing described here. You can withdraw consent at any time as explained below.

Our Consent-First Approach

A Second Brain is built bit by bit, and only from what its owner chooses. We do not add data to your Brain on our own initiative. Each Connected Source you link, each file you upload, and each export you import from tools such as Claude or ChatGPT is a separate choice, and we ask for your consent at that point for the specific purpose of building and operating your Second Brain. You can see what is connected, disconnect a source, delete content, and change who can see your Brain at any time from your account settings.

Because you decide what goes into your Brain, you are responsible for making sure you have the right to share it, including any personal data about other people that it contains. Please do not connect content that includes other people's personal data, confidential information or sensitive information unless you are legally entitled to share it.

Information We Collect

Information you give us

  • Account and profile data: name, email address, phone number, username, password, photo, headline, role, company or fund, location, links to your public profiles, and similar information.
  • Verification data: where you choose to verify your identity or professional role, information needed for that check, such as work email or profile ownership confirmation.
  • Brain Content: content from Connected Sources and material you upload, including public posts and profiles, articles, research, notes, documents, and conversation histories or exports from third-party AI tools.
  • Interaction content: questions, prompts and messages you send to Second Brains, Connection requests, messages to other users, and ratings or feedback.
  • Payment data: billing name, billing address, plan details and limited card information (such as card type and last four digits). Full card details are collected and held by our payment processors, not by us.
  • Communications: information you provide when you contact support, answer surveys, take part in research or interact with us on social media.

Information from Connected Sources and third parties

  • Third-party accounts: when you sign in with or connect an account such as Google, X or LinkedIn, we receive the information that service shares with us based on the permissions you grant, such as your name, email, profile details and public posts.
  • Imported content: when you import from AI tools or other services, we receive the content of the files or data you choose to import.
  • Other users: other users may provide information about you, for example when they send you a Connection request or refer you.
  • Service providers: analytics, fraud prevention and verification partners may provide information to us.

Information collected automatically

  • Device and log data: IP address, device identifiers, browser and operating system, referring URLs, pages viewed, time and date of access, crash reports and performance data.
  • Usage data: features used, Brains viewed, queries made, Connection activity, clicks, session length and similar activity.
  • Approximate location: derived from your IP address.
  • Cookies and similar technologies: as described in the section titled "Cookies and Tracking".

Derived information

To build and run a Second Brain, our systems derive context from Brain Content, such as topics of expertise, writing style, tone, preferences, working patterns and views. We also generate internal signals such as quality, relevance and engagement scores (including the Brain Quality Index) to rank and recommend Brains.

Sensitive information

We do not ask for sensitive personal data such as health information, financial account details, government identifiers, biometric data, religious or political beliefs, or sexual orientation. Please do not include it in Brain Content or in messages. If you choose to include it, you consent to it being processed as part of your Brain Content or messages.

How We Use Information

We use personal data to:

  • Provide the Services: create and manage accounts; build, train, operate and display Second Brains; generate Output; enable Seekers to discover and chat with Brains; facilitate Connections; process payments; and provide support.
  • Personalise: rank, filter and recommend Second Brains, match Seekers with relevant Brains, and tailor content and features.
  • Improve and develop: analyse how the Services are used, test features, fix bugs, and train, evaluate and improve the models, context systems and ranking methods that power AgentSocialX and xysq, as described in "AI Processing and Model Improvement".
  • Keep the Platform safe: verify accounts, detect and prevent fraud, spam, abuse, scraping, impersonation and breaches of our Terms and Fair Usage Policy, and secure our systems.
  • Communicate: send service messages, security alerts, Connection notifications, updates to our terms and, where permitted, marketing. You can opt out of marketing at any time.
  • Comply and protect: meet legal obligations, respond to lawful requests, enforce our agreements, and establish, exercise or defend legal claims.
  • Business transactions: evaluate or carry out a merger, acquisition, financing, reorganisation or sale of assets.

AI Processing and Model Improvement

Second Brains are powered by AI models, some operated by third-party providers. When you interact with a Brain or build one, relevant content is sent to these providers to generate Output. We use providers that are contractually restricted from using our data to train their own general-purpose models, where such terms are available.

We may use Brain Content, interactions and Output to operate and improve the Services and the underlying xysq technology, including to train and evaluate models and context systems. When we do this beyond serving your own Brain, we use data in de-identified or aggregated form. We do not use your identifiable Brain Content to build a Second Brain for anyone else, and we do not sell your Brain Content.

How We Share Information

We share personal data only as described below.

  • Seekers and the public: if your Second Brain is public or shared, Seekers can interact with it and receive Output that draws on your Brain Content. Your public profile information is visible to others on the Platform and may be indexed by search engines.
  • Brain Owners: if you are a Seeker, the Brain Owner may see your profile information, the questions you asked their Brain, conversation transcripts or summaries, and any Connection request you send. Do not share anything with a Brain that you would not want its owner to see.
  • Connections: when you send or accept a Connection, we share the information needed to make it happen, such as your name, profile and message.
  • Service providers: companies that help us run the Services, including cloud hosting, AI model providers, xysq as our technology provider, analytics, customer support, email and messaging, security and fraud prevention, identity verification, and payment processing. They may use personal data only to provide services to us.
  • Third-party services you connect: when you link a Connected Source or share content to another platform, information passes between us and that service according to your settings and its own policies.
  • Affiliates: companies under common control with us, for the purposes in this Privacy Policy.
  • Legal and safety: government authorities, courts, law enforcement or other parties where we believe in good faith it is required by law or legal process, or needed to protect the rights, property or safety of AgentSocialX, our users or others, to investigate fraud or security issues, or to enforce our Terms.
  • Business transfers: a buyer, successor, investor or other party in connection with a merger, acquisition, financing, reorganisation, bankruptcy or sale of all or part of our business, subject to confidentiality obligations.
  • With your consent: any other party when you ask us to or agree that we may.

We may share de-identified or aggregated information that does not reasonably identify you for any lawful purpose.

We do not sell your personal data.

Content Moderation, Safety and Law Enforcement

To keep the Platform safe, we and service providers acting for us may use automated tools and human review to detect, review and act on content that may breach our Terms, including nudity and sexual content, child sexual abuse material, hate speech, violent or extremist content, content promoting self-harm, deepfakes, harassment and other prohibited content. This may include reviewing Brain Content, profiles, messages and prompts that are reported to us or flagged by our systems.

We may preserve and disclose personal data and content to courts, government agencies and law enforcement authorities where required by law, including within the time limits set by the Information Technology Act, 2000 and the rules made under it, or where we believe in good faith that disclosure is needed to investigate or prevent crime, protect the safety of any person, or protect our rights. We report child sexual abuse material to the relevant authorities.

If you report content, we use the information in your report, including your contact details, to review and act on it, and we may share relevant details with authorities where necessary. We will not reveal your identity to the reported user unless the law requires it.

Legal Bases for Processing

Under the DPDP Act, we process personal data on the basis of your consent, or for legitimate uses permitted by law, such as where you voluntarily provide data for a specified purpose, to comply with law or court orders, or to respond to emergencies.

Where the GDPR applies, we rely on: contract (to provide the Services you request); consent (for building your Second Brain from Connected Sources, certain cookies and marketing); legitimate interests (to secure, improve and promote the Services, prevent abuse, and enforce our terms, where these are not overridden by your rights); and legal obligation.

Cookies and Tracking

We and our partners use cookies, local storage, pixels and similar technologies to keep you signed in, remember preferences, understand usage, measure performance and protect the Services. These fall into essential, functional and analytics categories, and, if we introduce them, advertising categories. You can manage cookies through your browser settings and, where available, our cookie settings. Blocking essential cookies may stop parts of the Services from working. Our Services do not currently respond to "Do Not Track" signals.

Data Retention

We keep personal data for as long as your account is active and as needed to provide the Services, and afterwards for as long as necessary to comply with legal obligations, resolve disputes, prevent fraud and abuse, enforce our agreements, and maintain backups. In general:

  • account and profile data is kept while your account is active;
  • Brain Content from a Connected Source is deleted or de-identified within a reasonable period after you disconnect that source, delete the content, or delete your account;
  • messages and interaction logs are kept for as long as needed to provide the Services and keep the Platform safe;
  • payment and tax records are kept for the period required by law; and
  • backups are overwritten on a rolling basis.

Output already delivered to other users, content others have copied, and de-identified or aggregated data may remain after deletion.

Where we remove content or close an account because of a breach of our Terms or a legal requirement, we may keep the related information and records for at least one hundred and eighty (180) days, or longer if required by law or for an ongoing investigation.

Security

We use reasonable technical, organisational and physical safeguards designed to protect personal data, including encryption in transit, access controls and monitoring, consistent with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the DPDP Act. No system is completely secure, and we cannot guarantee the security of information you transmit to us. You are responsible for keeping your credentials safe. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities as required by law.

International Transfers

We are based in India and our service providers may process data in India, the United States, the European Union and other countries. These countries may have data protection laws different from those where you live. We transfer personal data only as permitted by applicable law, including any restrictions notified under the DPDP Act, and, where required, use appropriate safeguards such as standard contractual clauses.

Your Rights and Choices

Controls in your account

You can review and edit your profile, connect or disconnect Connected Sources, delete Brain Content, change your Brain's visibility, manage notifications and delete your account from your settings.

Rights under the DPDP Act (India)

Subject to the law, you have the right to: obtain a summary of the personal data we process about you and the processing activities; access information about the Data Fiduciaries and Data Processors with whom it has been shared; request correction, completion, updating and erasure of your personal data; withdraw consent; and nominate another person to exercise your rights in the event of your death or incapacity.

Rights under the GDPR (EU and UK)

If the GDPR applies to you, you may have the right to access, rectify, erase, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. You also have the right to lodge a complaint with your local supervisory authority.

Rights under US state laws

If you live in a US state with a consumer privacy law, you may have the right to know, access, correct, delete and obtain a portable copy of your personal data, and to opt out of targeted advertising, sale or profiling. We do not sell personal data. We will not discriminate against you for exercising your rights.

How to exercise your rights

Email hello@agentsocialx.com. We may need to verify your identity before acting on a request. We will respond within the time required by applicable law. In some cases we may be unable to fully comply, for example where we must keep data for legal reasons or where a request would affect the rights of others, and we will tell you why.

Withdrawing consent

You can withdraw consent at any time by disconnecting a Connected Source, deleting content, changing your settings or contacting us. Withdrawal does not affect processing already carried out before you withdrew. If you withdraw consent needed to build or run your Second Brain, that Brain, or parts of it, will stop working.

Children

The Services are only for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it. If you believe a person under 18 has provided us with personal data, please contact us.

Third-Party Services and Links

The Services link to and integrate with services we do not control, including Connected Sources and AI tools. This Privacy Policy does not apply to them. Their handling of your data is governed by their own privacy policies, and we are not responsible for their practices.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated version with a new "Last updated" date and, where appropriate, notify you by email or in-app notice, and seek fresh consent where the law requires. Your continued use of the Services after changes take effect means you accept the updated policy.

Contact

If you have questions, requests or complaints about this Privacy Policy or our handling of personal data, email hello@agentsocialx.com.

We will acknowledge your complaint within twenty-four (24) hours and aim to resolve it within fifteen (15) days, or within any shorter period required by law. If you are not satisfied with our response, you may have the right to approach the Data Protection Board of India or another competent authority.