Privacy policy
Effective date: September 8, 2026
FarmBot Inc, a California benefit corporation doing business as 100x Apps ("100x Apps," "we," "us," or "our"), operates 100x Media Manager (the "Service"). This policy explains how we collect, use, disclose, retain, and protect information when a Shopify merchant, its authorized users, or a visitor uses the Service.
FarmBot Inc is located at 75 Higuera Street, Suite 105, San Luis Obispo, California 93401, United States. Questions or privacy requests may be sent to contact@100x-apps.com.
Information we collect
Shopify store and account information
When the Service is installed, Shopify provides the store domain, store and installation identifiers, granted permissions, installation status, and limited store settings such as the store name, brand information, and timezone. Shopify also provides signed session information needed to authenticate authorized store users. We receive subscription, trial, billing-status, and usage-charge information through Shopify's billing services.
Merchant content
We process content that an authorized user selects, uploads, imports, synchronizes, or creates. This may include product titles, descriptions, tags, SEO fields, blog posts, source documents, social posts, images, videos, audio, captions, metadata, export archives, brand guidance, campaign briefs, drafts, schedules, approvals, publishing instructions, feedback, and publication history. Content may incidentally include personal information if the merchant includes it.
Connected accounts and publishing information
When a user connects a social network, newsletter provider, forum, or other publishing destination, we receive the provider account identifier, profile or page information, granted scopes, access and refresh credentials, token expiry, selected destination, and provider capabilities. We retain remote post identifiers, permalinks, processing states, and publishing results so the Service can publish reliably and avoid duplicate posts. Provider credentials are encrypted before storage using per-record encryption keys protected by Google Cloud Key Management Service.
Generated and enriched information
The Service creates descriptions, embeddings, transcripts, chapters, perceptual fingerprints, campaign structures, drafts, and other analysis derived from merchant content. We also retain prompts, model and provider identifiers, outputs, processing states, and feedback needed to operate, audit, troubleshoot, and improve the merchant's results.
Usage, device, and support information
For optional standalone access outside Shopify, we store the invited user's email address, workspace memberships, passkey public keys and identifiers, and authentication and session records. We never receive your biometric data, device PIN, or passkey private key. Email sign-in codes expire after five minutes; browser sessions expire after 30 days or 14 days of inactivity. Recovery codes are stored as hashes and work once. Deleting the last workspace associated with an account also removes its standalone identity and credentials.
We collect service events such as page and feature use, job and publication status, storage and metered usage, audit history, errors, timestamps, IP address, browser and device information, and security events. If a user contacts us, we retain the message and information supplied to resolve the request.
Information we do not intentionally collect from Shopify
The Service does not request or import Shopify customer, order, payment, checkout, or payment-card records. Merchants should not upload passwords, private keys, government identifiers, health information, payment-card data, or other sensitive personal information that is unnecessary for content management and publishing.
How we collect information
We receive information directly from authorized users, from Shopify through approved APIs and signed app sessions, from sources a user asks us to import, and from connected services the user authorizes. We may also retrieve public webpages or media when a user supplies a URL or enables discovery. Discovery providers may receive brand-related search queries, but not OAuth credentials or private media.
How we use information
We use information to:
- authenticate users and isolate each merchant workspace;
- import, organize, search, deduplicate, enrich, and display merchant content;
- generate, review, schedule, publish, and reconcile campaigns and posts;
- operate connected accounts and refresh authorization when permitted;
- administer subscriptions, plan limits, storage, trials, and usage charges;
- provide support, notices, audit history, security, backups, and service health;
- prevent fraud, misuse, duplicate publication, and unauthorized access;
- comply with law, enforce our terms, and protect users and the Service; and
- improve reliability and features using aggregated or de-identified operational information.
AI processing
When a user requests generation or enrichment, selected text, images, audio, video, and related instructions may be sent to configured commercial AI providers, including OpenAI and Google. Support and feature-request text may also be processed by an AI-assisted triage system to select an approved support response or prepare an internal product plan. We use those services only for the requested workflow. AI output can be incomplete or inaccurate and remains subject to application safeguards or human review.
How we disclose information
We do not sell personal information, share it for cross-context behavioral advertising, or use merchant content to advertise to other merchants. We disclose information only as needed:
- Service providers. Hosting, storage, security, AI, search, email, and support vendors process limited information on our behalf.
- Shopify. Shopify processes app authentication, installation, billing, and compliance events under its own terms.
- Connected destinations. When a user connects or publishes to a supported provider such as Shopify, Facebook, Instagram, Threads, X, Pinterest, LinkedIn, or Discourse, we send the content and instructions chosen by that user. Published content may become public under the destination's settings and policies. Providers labeled Coming soon do not receive merchant content until their connections are enabled and the merchant authorizes one.
- Legal and safety reasons. We may disclose information when reasonably necessary to comply with law or legal process; enforce our terms; investigate fraud, abuse, or security issues; or protect the rights and safety of 100x Apps, merchants, users, or the public.
- Business transfers. Information may transfer as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and notice requirements.
- At the merchant's direction. We disclose information when an authorized user instructs us to export, share, connect, or publish it.
Subprocessors
We use a limited set of subprocessors to operate the Service. The current list, processing purpose, and data categories appear below. Our Data Processing Addendum governs their use and provides the applicable processor commitments.
| Subprocessor | Purpose | Information processed | Primary location |
|---|---|---|---|
| Google LLC (Google Cloud and Gemini API) | Application hosting, databases, private object storage, encryption-key management, logging, monitoring, search, and requested media analysis | Workspace records, original and derived media, encrypted credentials, operational metadata, brand search queries, and content selected for media analysis | United States; provider infrastructure may process globally |
| OpenAI, LLC | Requested text and image analysis, generation, embeddings, and AI-assisted support triage | Content and instructions selected for the requested workflow, generated output, and limited support text | United States; provider infrastructure may process globally |
| Brave Software, Inc. | Optional public-web discovery | Brand and organization search queries; no OAuth credentials or private media | United States |
| Plus Five Five, Inc. (Resend) | Standalone workspace invitations and sign-in email delivery | Recipient email address, workspace name in invitations, short-lived sign-in codes, message content, and delivery metadata; no media library or social-account credentials | United States; provider infrastructure may process globally |
| Squarespace, Inc. (email forwarding, powered by Mailgun) | Forwarding messages sent to our public support and privacy contact address | Sender and recipient addresses, messages, attachments, and delivery metadata supplied by the sender | United States; provider infrastructure may process globally |
Shopify provides the merchant platform, authentication, installation, and billing under its agreement with the merchant. Social networks, newsletter providers, forums, and other connected destinations receive content only at the merchant's direction and operate under their own agreements; they are integrations selected by the merchant rather than our subprocessors. We will update this list before a material new subprocessor begins processing Merchant Personal Data and will provide notice in the Service or by email when reasonably practicable.
Cookies and similar technology
The Service uses cookies and comparable browser mechanisms that are necessary for authentication, security, Shopify embedding, session continuity, and user preferences. We do not currently use advertising pixels or cookies for cross-site behavioral advertising.
Retention, cancellation, uninstall, and deletion
We retain workspace information while needed to provide the Service and meet legal, security, billing, and audit obligations. If a subscription is canceled, full access continues through the paid period. The workspace then becomes read-only for 14 days so the merchant can reactivate or permanently delete it. If it is not reactivated, the workspace and its stored content, AI enrichments, schedules, and connected-account credentials are deleted from active systems.
A merchant may permanently delete its workspace through the Service during the reactivation period. Uninstalling the Shopify app immediately removes the stored Shopify authorization and disables publishing connections, except that an independently authorized, operator-managed standalone workspace may retain its non-Shopify connections. Shopify sends a shop/redact request after uninstall; when received, we delete the store workspace. Deleted objects become unavailable immediately and may remain in restricted Cloud Storage soft-delete recovery for up to seven days. Managed database backups are retained for up to 14 days, point-in-time recovery logs for up to seven days, and encrypted portable database backups for up to 35 days. These recovery copies are not used for ordinary operations and expire automatically. We may retain a minimal deletion or legal-compliance receipt without the deleted workspace content.
Security
We use commercially reasonable administrative, technical, and physical safeguards, including tenant-scoped access controls, encryption in transit, encrypted credential envelopes, managed key protection, restricted private object storage, signed access URLs, audit trails, and tested backups. No security method is perfect, and we cannot guarantee absolute security. Please report suspected security issues to contact@100x-apps.com.
International processing
FarmBot Inc and its service providers are based in the United States and may process information in the United States and other countries. Where required, we use appropriate contractual or legal safeguards for international transfers.
Your privacy choices and rights
Authorized users can review and change many workspace settings, disconnect publishing accounts, disable recurring sources, download a complete workspace export from Settings → Data management → Export your data, or delete the workspace. The portable ZIP contains workspace records in JSON plus retained original media and source files; encrypted credentials and internal security material are excluded. Depending on location, an individual may also have rights to request access, correction, deletion, restriction, objection, or portability, or to appeal or complain to a privacy authority. California residents may have rights to know, correct, and delete personal information and to receive equal service when exercising those rights. Because we do not sell personal information or share it for cross-context behavioral advertising, there is no sale or advertising-sharing opt-out to exercise.
Send requests to contact@100x-apps.com. We may need to verify identity and authority, and merchants may need to submit requests concerning their own customers through Shopify. We honor Shopify's mandatory customers/data_request, customers/redact, and shop/redact compliance webhooks.
Children
The Service is intended for businesses and authorized adult users. It is not directed to children under 13, and we do not knowingly collect their personal information. Contact us if you believe a child has provided personal information through the Service.
Changes to this policy
We may update this policy as the Service or applicable law changes. We will post the updated policy here with a new effective date and provide additional notice when a material change requires it.
Contact
FarmBot Inc dba 100x Apps
75 Higuera Street, Suite 105
San Luis Obispo, CA 93401, United States
contact@100x-apps.com