Privacy Policy.

// 01 · DATA WE COLLECTThe minimum needed for the service.

We distinguish three data categories:

• Account data. Name, email, phone, company, role. Needed to create an account, authenticate and provide support.
• Usage data. Access logs, anonymized IPs, pages visited, platform interactions. Used to detect abuse and improve the experience.
• Client operational data. Data the Client uploads to the platform (leads, contracts, messages, files). X7 acts as processor of this data — the Client is the controller.

// 02 · HOW WE USE YOUR DATAExplicit legal bases.

Each use of personal data is grounded in a specific legal basis:

• Contract performance. To deliver the contracted services.
• Compliance with legal obligation. To issue invoices, comply with tax obligations.
• Legitimate interest. To detect fraud, improve product, service-related communication.
• Consent. For newsletter, marketing and non-essential cookies (revocable at any time).

We never sell personal data. We never share data with third parties for marketing unrelated to X7 Growth AI.

// 03 · HOW WE PROTECTSecurity standards.

Full technical details are described in the Security Policy. In summary:

• Encryption at-rest (AES-256) and in-transit (TLS 1.3).
• Access based on principle of least privilege. Log auditing.
• Daily backups with 30-day retention.
• SOC2 Type II in progress (audit expected Q4 2026).
• Incident notification within 72 hours per LGPD/GDPR.

// 04 · DATA SUBJECT RIGHTSHow to exercise your rights.

The data subject has the right to:

• Access. Know what data we hold about you.
• Rectification. Correct inaccurate or incomplete data.
• Erasure. Request deletion (subject to legal retention obligations).
• Portability. Receive your data in a structured, machine-readable format.
• Objection. Object to processing based on legitimate interest.
• Withdrawal of consent. At any time, without affecting processing already carried out.
• Non-discrimination. Exercise of these rights cannot result in degraded service.

To exercise any right: dpo@x7growth.com. Response within 15 days.

// 05 · LGPD & GDPRRegulatory compliance by region.

// 06 · COOKIESHow we use cookies.

We use essential cookies (needed for authentication and platform operation) and anonymized analytics cookies (to improve product). We do not use third-party advertising cookies or cross-site trackers. The Client can manage preferences via the cookie banner or browser settings.

// 07 · DATA RETENTIONHow long we keep it.

• Active account: for the duration of the contract.
• Cancelled account: data deleted within 90 days after cancellation, except for legal obligations.
• Financial data: 5 years (tax obligation).
• Security logs: 12 months.
• Backups: 30 days rolling.

// 08 · INTERNATIONAL TRANSFERSWhere your data lives.

Data is primarily processed on AWS servers (Frankfurt eu-central-1 and Bahrain me-south-1 regions) and on Supabase/Vercel infrastructure. International transfers follow Standard Contractual Clauses (SCCs) approved by the European Commission and equivalent mechanisms for other jurisdictions.

// 09 · DATA PROTECTION OFFICERWho is your contact point.