Privacy Policy
English version. Die deutsche Fassung finden Sie unter Datenschutzerklärung. In case of doubt, the German version prevails.
1. Controller
Baltasaar Services GmbH, Gensinger Str. 14, 55457 Horrweiler, Germany · Email: hello@9cxo.com. Further details in the Imprint. 9CXO is a brand of Baltasaar Services GmbH.
2. What this policy covers
It covers the website 9cxo.com and the 9CXO product. Where a customer connects a third-party account such as Instagram or Facebook to 9CXO, section 7 applies in addition.
3. Access data / server log files
When you visit this website, our server in the EU (hosting: Hetzner Online GmbH, Germany/Finland) automatically processes technical access data: IP address, date and time, page requested, referrer, user agent. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in operating and securing the website). Log data is deleted after 14 days at the latest, unless a security incident requires otherwise.
4. Cookies and local storage
This website sets no tracking cookies and uses no analytics tools. Your settings (language, theme, demo state) are kept solely in your browser's localStorage. That data stays on your device and is never transmitted to us.
5. Fonts
Since 22 October 2026 the font used (Roboto) is served exclusively from our own server. No fonts are loaded from Google Fonts and no IP address is transmitted to Google or any other third party in the process.
6. Contacting us
If you contact us by email, we process your details in order to handle your enquiry (Art. 6(1)(b) or (f) GDPR). The data is deleted once it is no longer required and no statutory retention obligation applies.
7. Instagram and Facebook data (Meta Platforms)
9CXO can publish content, and read and answer comments and messages, on behalf of a customer. This only happens if the customer explicitly connects their own Instagram professional account, and only for that account. We never connect an account without the account holder's authorisation, and we never use one customer's data for another customer.
When such a connection exists, we receive the following categories of data through Meta's official APIs:
| Data category | Purpose |
|---|---|
| Account identifiers and profile: Instagram account ID, username, profile picture, follower and media counts | Identifying the connected account in the product and showing the customer which account they are acting as |
| Media and publishing data: images, videos, captions, publication status and permalinks of content the customer publishes through 9CXO | Creating, scheduling and publishing the customer's own content |
| Comments: comment text, author username, timestamps | Showing comments to the customer and letting them reply, hide or delete |
| Messages: content and timestamps of direct messages in the connected account's inbox | Showing the inbox to the customer and letting them reply; creating a CRM contact from a conversation where the customer chooses to |
| Insights: aggregated reach, impressions and engagement figures for the connected account and its content | Reporting on the performance of the customer's own content |
| Access tokens issued by Meta | Maintaining the connection; stored encrypted and never shared |
The permissions requested are instagram_business_basic, instagram_business_content_publish, instagram_business_manage_messages and instagram_business_manage_comments. We request no permission we do not use.
Legal basis is Art. 6(1)(b) GDPR (performance of the contract with our customer). Towards end users who interact with our customer's account, our customer is the controller and Baltasaar Services GmbH acts as a processor under Art. 28 GDPR. We do not sell this data, do not use it for advertising, and do not use it to train machine-learning models.
8. Retention and deletion of platform data
- Platform data is retained for as long as the connection exists and the customer's contract runs.
- If the connection is removed, or the contract ends, the data received from that account is deleted within 30 days, except where a statutory retention obligation applies.
- Access tokens are deleted immediately upon disconnection.
- Anyone can request deletion of the data we received from their Instagram or Facebook account by writing to hello@9cxo.com. We also operate an automated data deletion callback: removing the 9CXO app in your Instagram or Facebook settings triggers the deletion and returns a confirmation code with a status page at
https://api.9cxo.com/platform/data-deletion/status/<code>.
9. Your rights
- Access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18)
- Data portability (Art. 20), objection (Art. 21)
- Complaint to a supervisory authority (Art. 77 GDPR)
10. Processing on behalf of customers and sub-processors
For product operation we conclude a data processing agreement under Art. 28 GDPR with our customers. The agreement and the list of sub-processors are available from hello@9cxo.com.
11. Status
September 2026. We update this policy as functionality or the legal situation changes.