Privacy Policy
Last updated: 2026-08-07
BigDealSocial helps you grow an X (Twitter) account: it watches accounts and keywords you choose, drafts replies and posts, and schedules them. This page explains what we do with your data in plain language.
We are the data controller. Contact us any time at info@bigdealsocial.com.
1. What we collect
Your account. Your email address and a hashed password (we never store the password itself). If you sign in through a device we haven't seen before, we record the session — browser, approximate location from your IP address, and sign-in time — so you can review and revoke sessions.
Your setup. Your X handle, timezone, and the free-text notes you write about your niche and voice. These shape what the AI drafts for you.
Connected accounts. If you connect X, we store OAuth access and refresh tokens, encrypted at rest. We never see or store your X password. If you connect Telegram, we store your Telegram chat ID so we can send you alerts. You can disconnect either at any time from Your setup.
What you create. Scheduled posts and any images or video you attach, replies you send through us, generated content ideas, and drafts you submit to the copy desk.
Public posts we fetch for you. To build your reply feed we retrieve public posts from the accounts and keywords you choose to watch, together with their public author details and engagement counts. This is public information published on X by people who are not our users.
API keys. If you connect an agent, we store a hash of the key — never the key itself.
Payments. If you subscribe, Stripe handles your card details. We never see or store card numbers; we keep only your subscription status and billing identifiers.
We do not use advertising trackers or sell data to anyone.
2. Why we use it, and our legal basis
- To run the service you asked for — polling watched accounts, drafting and publishing posts, sending your alerts. Legal basis: performance of a contract.
- To keep your account secure — sign-in alerts, session records, rate limits. Legal basis: our legitimate interest in preventing account abuse.
- To send service email — confirmation, password resets, security notices. Legal basis: performance of a contract.
- To bill you, if you are on a paid plan. Legal basis: performance of a contract and our legal obligation to keep financial records.
3. Who we share it with
We use a small number of processors, each doing one job:
| Processor | What it handles |
|---|---|
| Hetzner (Germany) | Hosting and database |
| Amazon Web Services | Sending transactional email |
| Anthropic | Generating reply angles, ideas and critiques |
| X / Twitter | Publishing your posts and replies |
| twitterapi.io | Retrieving the public posts in your feed |
| Telegram | Delivering your alerts, if you connect it |
| Cloudflare | DNS, and file storage if you upload media |
| Stripe | Payments, if you subscribe |
When we send a draft to Anthropic to be rewritten or critiqued, that text is processed to produce your result. It is not used to train models, and it is not pooled with other customers' content.
Some of these providers are outside the European Economic Area. Where that is the case, transfers rely on the European Commission's Standard Contractual Clauses.
We will also disclose data if the law requires it, or to protect our rights or someone's safety.
4. How long we keep it
We keep your data for as long as your account exists. Delete your account and we delete your personal data within 30 days, except records we must keep for legal reasons — invoices, for example, which tax law requires us to retain for seven years. Backups are overwritten on a rolling basis within 30 days.
5. Your rights
Under the GDPR you can ask us to:
- See the personal data we hold about you
- Correct anything inaccurate
- Delete your data ("right to be forgotten")
- Export your data in a portable format
- Restrict or object to how we use it, including anything based on legitimate interest
- Withdraw consent where you gave it, without affecting what came before
Email info@bigdealsocial.com and we'll respond within one month. You can delete your account yourself at any time from your settings. If you think we've handled your data badly, you can complain to your local data protection authority — in the Netherlands that is the Autoriteit Persoonsgegevens.
6. Cookies
We use cookies that are strictly necessary: one to keep you signed in, and one to protect forms against cross-site request forgery. No advertising or analytics cookies, so there is nothing to consent to.
7. Security
Passwords are hashed. Connected-account tokens and agent API keys are encrypted or hashed at rest. Traffic is served over HTTPS. No system is perfectly secure, but if a breach ever affects your personal data we will notify you and the relevant authority within 72 hours, as the GDPR requires.
8. Children
BigDealSocial is not intended for anyone under 16, and we don't knowingly collect their data.
9. Changes
If we change this policy materially we'll email you before it takes effect. The date at the top always reflects the current version.
10. Contact
BigDealSocial, Amsterdam, Netherlands — info@bigdealsocial.com