Eightx ("we," "us," or "our") operates the website eightx.co (the "Site") and the Eightx client platform at hub.eightx.co (the "Platform"). The Site and the Platform together are the "Services." This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit the Site, use the Platform, or otherwise engage our services.
This policy distinguishes between two kinds of information. (1) Site information — information about visitors and prospective clients that we collect through the Site, for which Eightx acts as the controller. (2) Platform data — business and financial data that our clients connect to or enter into the Platform so we can deliver fractional CFO and financial-analysis services, for which Eightx acts as a service provider / data processor handling the data on the client's behalf and instructions, as described in Section 2.
1. Information We Collect Through the Site
Information You Provide
We collect information you voluntarily provide when you:
- Fill out a contact form (name, email, company, revenue range, message)
- Subscribe to our newsletter (email address)
- Book a call through our scheduling tool (name, email, and any information you share during booking)
- Engage with us as a client (financial data, business information necessary to provide our services)
Information Collected Automatically
When you visit our Site, we may automatically collect:
- Device and browser information (type, version, operating system)
- IP address and approximate location
- Pages visited, time spent, and referring URLs
- Cookies and similar tracking technologies
2. The Eightx Platform (hub.eightx.co)
The Platform is a private, login-protected application we make available to clients and their authorized users. It connects to a client's financial, commerce, and advertising systems and produces dashboards, reports, forecasts, board packs, benchmarks, and AI-assisted answers.
Our Role
With respect to the business and financial data made available through the Platform, the client (the business that engages Eightx) is the owner and controller of that data, and Eightx acts as a service provider / processor that handles the data only to provide the Services, as instructed by the client and as described here and in any applicable engagement letter or data processing addendum.
Account and User Information
To provision access we store each authorized user's name, email address, role, and the client organization(s) they may access, together with login and session records managed through our authentication provider.
Connected Accounts
With your authorization, the Platform connects to third-party systems using OAuth or API credentials. We store the access and refresh credentials for these connections in encrypted form, and you can disconnect any connection at any time. We currently support, or are adding, connections to:
- QuickBooks Online and Xero — accounting data, including profit & loss, balance sheet, and cash-flow statements; chart of accounts and account balances; and financial line items;
- Shopify — order and sales data, including order totals, discounts, refunds, taxes, currency, order timestamps, and product/variant and customer identifiers;
- Meta (Facebook) Ads and Google Ads — advertising-account metrics, including spend, conversions and purchases, and attributed revenue;
- additional sources we may add over time (for example Stripe, Amazon, TikTok, Klaviyo, GA4, or bank-data aggregators), which will be governed by this policy when enabled.
Information Derived by the Platform
From the connected sources we compute and store derived metrics and analyses — for example daily revenue, ad spend, cash position, burn, runway, customer cohorts, CAC and LTV, forecasts, inventory and purchase plans, and board-pack commentary. We also retain raw copies of certain source records (such as order and report payloads) so that our calculations are reproducible and auditable.
Client Inputs and AI Conversations
Authorized users may enter assumptions and planning inputs (for example budgets, forecast assumptions, hiring plans, and financing schedules) and may submit questions and messages to the Platform's AI assistant. We store these inputs and the resulting outputs.
End-Customer Data
Some connected sources (notably Shopify) may include identifiers or limited data relating to a client's own customers. Where this occurs, the client is the controller of that end-customer data and is responsible for having an appropriate legal basis and privacy notice for it. Eightx processes such data solely to provide the Services and does not use it to contact those individuals or for our own marketing.
3. How We Use Information
We use Site information to:
- Respond to your inquiries and provide requested services
- Send newsletters and marketing communications (with your consent)
- Improve our Site and user experience
- Analyze website traffic and usage patterns
- Comply with legal obligations
We use Platform data to:
- Operate and secure the Platform and authenticate users
- Retrieve, aggregate, and analyze connected data to produce dashboards, reports, forecasts, and board packs
- Generate AI-assisted answers and written briefs (Section 4)
- Produce de-identified, aggregated benchmarks and insights (Section 8)
- Provide support, maintain, and improve the Services
- Comply with legal obligations
Legal bases (where the GDPR or similar laws apply). For Site information, we rely on your consent (for marketing and non-essential cookies), our legitimate interests (in operating, securing, and improving the Site), and compliance with legal obligations. For Platform data, we process on behalf of our client under the client's instructions and a contract (including, where applicable, the Data Processing Addendum); where Eightx determines purposes for its own limited operations (such as security and service improvement), we rely on legitimate interests. Where we rely on consent, you may withdraw it at any time.
4. AI and Automated Processing
The Platform uses artificial-intelligence models to answer questions and draft financial commentary. When you use these features, we send the relevant inputs — typically aggregated financial metrics for your business and the question or request you submit — to our AI provider, Anthropic (the Claude API), which processes them to generate a response. We do not send raw, customer-level records to the AI provider for this purpose. We have selected a provider that, under its commercial API terms, does not use data submitted through its API to train its models. AI-generated output may be inaccurate or incomplete, is provided for informational purposes only, and is not professional financial, tax, accounting, legal, or investment advice; review it before relying on it.
5. Site Analytics and Tracking Technologies
On the Site, we use the following third-party services that may collect data:
- Google Analytics — website analytics and traffic analysis
- Google Tag Manager — tag and pixel management
- Meta (Facebook) Pixel — advertising measurement and conversion tracking
- ThoughtMetric — marketing attribution and ad-performance measurement
- Calendly — appointment scheduling
- Netlify — website hosting and form submissions
These technologies may collect information about your interactions with the Site, including page views, navigation patterns, click events, device and browser information, IP address, approximate location derived from IP, referrer information, and similar data. The data collected may be transmitted to and processed by the third-party providers above, in some cases on servers located outside your country of residence. Each of these services has its own privacy policy governing the use of your information; we encourage you to review them.
The Platform is a private, logged-in application and does not use third-party advertising or attribution pixels. It uses only cookies and similar technologies that are strictly necessary for authentication, session management, and security.
6. Subprocessors and Service Providers
We rely on a limited set of service providers ("subprocessors") to operate the Platform. As of the date above these include:
- Vercel — application hosting and content delivery;
- Supabase — database hosting and user authentication;
- Anthropic — AI processing for the assistant and brief-generation features (Section 4);
- the third-party data sources you choose to connect (Section 2), which receive only the credentials and requests needed to retrieve your data.
Each subprocessor is bound by contractual confidentiality and security obligations and may process data only to provide services to us. We may update this list as the Platform evolves; material changes will be reflected here.
7. Cookies
Our Services use cookies and similar technologies. Cookies are small data files stored on your device. On the Site we use:
- Essential cookies — required for the Site to function properly
- Analytics cookies — help us understand how visitors interact with our Site
- Marketing cookies — used to deliver relevant advertising
On the Platform we use only essential cookies for authentication and session management. You can control cookies through your browser settings; disabling cookies may affect functionality.
Consent through use. By accessing the Site and continuing to use it, you acknowledge and consent to the use of the tracking technologies named in Section 5 and to the collection, transmission, and processing of Site data described in this Privacy Policy. If you do not consent, do not use the Site.
8. Aggregated and De-Identified Data
We may create de-identified and aggregated data from information processed through the Platform — for example cross-client benchmark percentiles for metrics such as margins, customer-acquisition cost, average order value, and growth rates. De-identified and aggregated data does not identify you, your business, or any individual, and cannot reasonably be used to do so. We may use and retain such data, including after an engagement ends, to operate, benchmark, and improve the Services and to produce industry insights. We do not disclose any individual client's underlying data to other clients, and we will not publicly attribute aggregated insights to you without your consent. Where benchmarking draws on your business's data, you may ask us to exclude your data from cross-client benchmark calculations by contacting us at contact@eightx.co.
9. Data Sharing and Disclosure
We do not sell your personal information or Client Data. We may share information with:
- Subprocessors and service providers who help us operate the Services, as described in Section 6
- Professional advisors (legal, accounting) as necessary
- Law enforcement or regulatory authorities when required by law
- A successor entity in connection with a merger, acquisition, or sale of assets, subject to this policy
10. Data Retention
We retain Site information only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. Contact form submissions and newsletter subscriptions are retained until you request removal.
Platform data is retained for the duration of the client's engagement and for a reasonable period afterward to meet legal, audit, and continuity needs, after which it is deleted or de-identified. Clients may request export or deletion of their Platform data as described in Section 11. De-identified and aggregated data (Section 8) may be retained.
11. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your personal information
- Opt out of marketing communications at any time
- Withdraw consent where processing is based on consent
To exercise any of these rights, contact us at contact@eightx.co.
Where information is processed through the Platform as part of a client's account, Eightx acts as a processor and will refer individual requests to the relevant client (the controller) and assist them in responding. Client administrators may request access, correction, export, or deletion of their organization's Platform data, and may disconnect connected data sources at any time.
California (CCPA/CPRA). We do not sell or share personal information as those terms are defined under California law, and we do not use sensitive personal information for purposes requiring a right to limit. California residents may exercise rights to know, delete, correct, and to be free from discrimination for exercising those rights. Where we process information on a client's behalf, we act as a "service provider" and will direct requests to that client.
Canada (PIPEDA). We handle personal information in accordance with PIPEDA and applicable provincial privacy laws. You may contact us to access or correct your personal information or to raise a concern, and you have the right to escalate unresolved concerns to the Office of the Privacy Commissioner of Canada.
EEA / UK. Where the GDPR or UK GDPR applies, you may also have the right to object to or restrict certain processing, to data portability, and to lodge a complaint with your local supervisory authority.
We will not discriminate against you for exercising any of these rights. We may need to verify your identity before responding.
12. Data Security
We implement appropriate technical and organizational measures to protect information against unauthorized access, alteration, disclosure, or destruction. For the Platform, these measures include encrypting connected-account credentials at rest, encrypting data in transit using TLS, restricting access to authenticated and authorized users, and isolating each client's data so that users can access only the client organizations to which they have been granted access. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
If we become aware of a breach of security affecting personal information that we control, we will notify affected individuals and authorities where required by applicable law and without undue delay. For Platform data we process on a client's behalf, we will notify the client without undue delay so that the client can meet its own notification obligations, as described in our Data Processing Addendum.
13. Children's Privacy
Our Services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.
14. International Data Transfers
Eightx is based in Canada. Our Platform subprocessors (including Vercel, Supabase, and Anthropic) may store and process data in the United States and other countries. If you access our Services from outside Canada, your information may be transferred to and processed in Canada, the United States, or other jurisdictions where we or our service providers operate. By using our Services, you consent to such transfers.
15. Disputes Regarding Data Handling
Any dispute, claim, or controversy arising under or relating to the collection, use, sharing, processing, or retention of data under this Privacy Policy is governed by the dispute-resolution provisions, including the pre-dispute notice requirements, informal-resolution requirements, arbitration agreement, class-action waiver, governing law, and venue, set forth in Section 9 of our Terms of Service. By using the Site, you agree that any such dispute will proceed in accordance with those provisions and will not be brought as a class, collective, consolidated, or representative action.
16. Substantiation of Data-Handling Claims
If you believe your data has been collected, used, shared, or processed in violation of this Privacy Policy or applicable law, you must provide us with all of the following as part of your pre-dispute notice under our Terms of Service:
- a complete, unedited copy of the data forming the basis of your claim;
- a detailed written explanation specifying the nature of the alleged violation, the date(s) on which it occurred, the URLs accessed, the device and browser used, and the IP address(es) used to access the Site if known;
- the legal theory or theories on which the claim is based; and
- a description of the harm alleged.
This requirement is intended to enable a meaningful investigation of any alleged violation and shall not be construed to limit any rights you have under applicable law.
17. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.
18. Contact Us
If you have questions about this Privacy Policy or our data practices, contact us at:
Eightx
Email: contact@eightx.co
Website: eightx.co
