Privacy policy

good vibes GmbH, Gartenstrasse 7, c/o excent AG, Zweigniederlassung Zug, 6300 Zug, Switzerland, represented by its managing director Denis Lulic

Email: deno@x3growth.io · Phone: +41 76 380 63 22

We are subject to the Swiss Federal Act on Data Protection (FADP) and, insofar as we offer services to people in the EU or monitor their behaviour, the General Data Protection Regulation (GDPR). We have not appointed a data protection officer because we are not required to. For questions about data protection, you can reach us at deno@x3growth.io.

We are responsible for the data of visitors to our website, for your X3 Konto, for contracts, billing and support with our customers, for the security of the platform and for our own advertising.

We are not responsible for the content that customers process in the products, such as measurement data about visitors to their websites, contacts, leads and emails in X3 CRM, or chats and workflows in X3 Automation. The respective customer is responsible for this; we are their processor (section 13).

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit it, Vercel processes technically necessary data: IP address, time, requested address, referrer and browser identifier (server logs).

The legal basis is our legitimate interest in a secure, fast website (Art. 6(1)(f) GDPR). We have a data processing agreement with Vercel. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework; transfers to the USA are based on this, supplemented by the European Commission's standard contractual clauses.

Fonts are hosted on our own server. Loading a page does not connect to Google Fonts.

We measure the use of this website with our own analytics platform X3 Growth Intelligence, without third parties such as Google Analytics. As long as you do not choose “Accept all”, measurement works without cookies and without any storage in your browser. Your browser loads the measurement script from the domain you are visiting (x3growth.io or the respective product domain, path “/_x3site/n3”) and sends the measurement data there as well.

We process: pages viewed, referrer, campaign parameters (UTM) and click IDs from ad platforms (e.g. gclid, fbclid), clicks on buttons and links (e.g. “Book a demo”, login, “Start for free”, switching between products), which sections of the page you saw and for how long, scroll depth, time on page, browser window size, device type, browser, language and country.

Our server at Vercel forwards the measurement data, without cookies, together with your IP address, the browser identifier (user agent) and the country derived from it to the X3 server (api.x3growth.io). There, the page views of a visit are linked via a pseudonymous check value with a random value that changes daily; the IP address and browser identifier themselves are not stored.

The X3 server runs at Vercel Inc. (address in section 3) in a data centre in Frankfurt am Main; the measurement data is stored in a database of Neon Inc., also in Frankfurt am Main (Amazon Web Services, region eu-central-1). Vercel and Neon process the data on our behalf (data processing); for transfers to the USA, section 3 applies. Measurement data is deleted automatically after 180 days; we keep aggregated daily figures that cannot be linked to individual visits for up to three years.

Only if you choose “Accept all” in the cookie notice does X3 additionally store the following in your browser: the identifier of your visit in sessionStorage (until you close the tab), so that a visit stays together even after a page reload; the cookie “x3_vid” (a random identifier of your browser, 180 days), so that we can attribute a later visit, enquiry or sign-up to the ad you originally came from; and the cookie “x3_clk” (click IDs of ad platforms from the requested address, 90 days). X3 then also reads the cookies “_fbp” and “_fbc” (section 4b), creates “_fbp” if it is missing, and sends them to the X3 server with the measurement data so that we can report a sign-up or purchase to Meta (section 4b). The legal basis for this is your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). If you withdraw it via “Cookie settings” with “Necessary only”, X3 deletes these entries immediately and then measures without cookies again.

The legal basis is our legitimate interest in understanding which channels and content work (Art. 6(1)(f) GDPR). You can object at any time: open the page once with the addition “?x3_notrack=1” (e.g. x3growth.io/?x3_notrack=1). After that, X3 no longer measures in this browser; only for this purpose is the entry “x3_notrack” stored in your browser's local storage (“?x3_notrack=0” lifts the objection). Or email us at deno@x3growth.io.

With X3 we also analyse how this website is used: clicks (target and position), scroll depth, visible sections, mouse movements, the use of form fields (only focus and abandonment per field, never content) and an approximate location (country, region, city from the network node, without storing the IP address). This results in aggregated heatmaps. A visit can also be stored as a session recording: page layout, scrolling, clicks, mouse movements and page changes, so that the visit can be followed later; we can also view ongoing visits in real time with the same information.

All input in form fields, your selections in forms, passwords and texts that look like personal data (for example email addresses or phone numbers) are made unrecognisable (masked) in your browser before anything is transmitted; the general text of the page remains readable. Login pages are never recorded. No cookies are set and nothing is stored in your browser for heatmaps and recordings; like the measurement script, the script is loaded via the domain you are visiting (path “/_x3site/n3”).

Only some of the recordings are kept (for example visits with an enquiry, with noticeable usability problems, or a random sample); the rest are deleted after 48 hours at the latest. Kept recordings are deleted automatically after 30 days, click and scroll paths of individual visits after 90 days. Storage takes place in Frankfurt am Main as described in section 4.

The legal basis is our legitimate interest in identifying errors and obstacles on this website and making it easier to understand (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR): with “?x3_notrack=1” as described in section 4; nothing more is then captured in this browser. If your browser sends the “Global Privacy Control” signal, heatmaps and recordings do not take place either.

Only if you choose “Accept all” in the cookie notice do we load the Meta Pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). Before that, and if you choose “Necessary only”, this website does not connect to Meta.

With the pixel we measure how our ads on Facebook and Instagram perform and can build audiences for our advertising (for example people who have visited this website). For this, your browser loads a script from connect.facebook.net and reports these events to Meta: page view, view of the pricing page and click on “Start for free”. Meta processes your IP address, information about your browser and device, the requested address and the identifiers from the cookies. We do not pass what you enter in forms or other personal details to the pixel; we do not use automatic matching of contact data (Advanced Matching).

The pixel sets the cookies “_fbp” (a random identifier of your browser) and, if you arrive via an ad, “_fbc” (the click identifier of the ad), each for up to 90 days.

We and Meta are joint controllers for collecting the data on this website and transmitting it to Meta (Art. 26 GDPR). The details are set out in Meta's joint controller addendum (facebook.com/legal/controller_addendum); under it, Meta is responsible, among other things, for fulfilling your rights under Art. 15 to 20 GDPR for the data stored by Meta. Meta alone is responsible for further processing at Meta; see facebook.com/privacy/policy for more.

The legal basis is your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). Meta may transfer data to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework (dataprivacyframework.gov); the transfer is based on this, supplemented by the European Commission's standard contractual clauses.

Every event receives a random identifier. We pass the identifier of the click on “Start for free” in the sign-up link (“x3_meid”). After you sign up on intelligence.x3growth.io, sales.x3growth.io or automation.x3growth.io, we can report to Meta from the server, via our own platform X3, that a sign-up, the choice of a plan or a purchase has taken place (Conversions API), so that Meta can measure the effect of an ad and count an event only once. We only do this if you chose “Accept all” here, and only with the click identifier of the ad (fbclid or _fbc), for a purchase also with amount and currency, never with email address, name or phone number (see section 7).

You can change or withdraw your consent at any time with effect for the future via the “Cookie settings” link at the bottom of every page. If you choose “Necessary only” there, the pixel stops sending anything immediately, we delete the _fbp and _fbc cookies of this domain, and the pixel is no longer loaded from the next page view onwards. We store your decision per domain in your browser's local storage (entry “x3-consent” with your choice and the time) for 12 months; after that we ask again. Our measurement (section 4) records which choice you made; with “Accept all” it also uses the browser entries listed in section 4. If your browser sends the “Global Privacy Control” or “Do Not Track” signal, we treat this as “Necessary only” and do not show the notice; you can still consent via “Cookie settings”.

Without consent we only store what is necessary in your browser: your decision in the cookie notice (localStorage “x3-consent”, 12 months, see section 4b) and, if you object to measurement, the entry “x3_notrack” (section 4). Without consent we do not set any cookies on the website itself. Only if you choose “Accept all” does the Meta Pixel set the cookies “_fbp” and “_fbc” (section 4b) and our X3 measurement set the cookies “x3_vid” and “x3_clk” as well as the identifier of your visit in sessionStorage (section 4).

In the X3 apps, after you sign in, we set technically necessary cookies for your session and for protection against misuse (such as sign-in and security cookies) and store interface settings in your browser. They are required to use the apps (Art. 6(1)(b) GDPR, § 25(2) TDDDG).

If you email or call us, we process your details and the content of your message to handle your request (Art. 6(1)(b) GDPR for enquiries about a contract, otherwise point (f), our legitimate interest in answering). We store enquiries and call notes in our own platform X3 CRM (stored in Frankfurt am Main). If no collaboration results, we delete them after 12 months at the latest.

The buttons “Book a demo”, “Book setup” and similar open a chat in WhatsApp. Data only flows once you use the button. WhatsApp is operated by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; WhatsApp processes your phone number, metadata and the messages under its own terms (whatsapp.com/legal/privacy-policy) and may transfer data to Meta Platforms, Inc. in the USA (Data Privacy Framework). Only use WhatsApp if you agree to this; you can reach us by email just as well. We use what you write to us to arrange the appointment (Art. 6(1)(b) GDPR).

If you book a call via an X3 booking page (such as the intro call for X3 Partners on sales.x3growth.io), we process your name, your email address, optionally your phone number and company, your answers and the chosen time slot in X3 CRM, send you a confirmation and calendar invitation by email and add the appointment to our calendar (Art. 6(1)(b) GDPR). A video call runs via the service named in the invitation.

When you create an X3 Konto (centrally at accounts.x3growth.io, valid for all X3 products), we process your business email address, your phone number, the address of your website and the name of your company, and optionally your name. The phone number is mandatory when you sign up yourself and optional when you are invited. We need it for questions about your account (contract, Art. 6(1)(b) GDPR). We never pass it on to ad platforms; other members of your organisation, API keys, connected apps and AI assistants (MCP) cannot see it. If you come from this website via “Start for free”, the link passes on the identifier of your visit (see section 4) so that we can see which channel you came through. We create your sign-up in X3 as an enquiry for our team; we report it to ad platforms at most with the click identifier of the ad, never with email address, name or phone number, and to Meta only with your consent on this website (section 4b). With this consent, the link also contains the random identifier of the “Start for free” event (“x3_meid”).

We measure sign-up and setup on the sign-up and setup pages of the X3 apps with our own measurement without cookies (as in section 4): the sign-up, the sign-in if you come from this website, the confirmation of your email address and the setup steps up to choosing a plan, nothing after that and never the content of the platform. We record which steps you open and what you do there (for example “step skipped” or “plan chosen”), never your input. On these setup pages we also record how the page is used (clicks, scrolling, page changes) in order to improve the setup; input and personal details are masked as described in section 4a, keys, embed codes, prompts and invitations are not recorded at all, and payment never is. We delete the recordings as described in section 4a. The legal basis is our legitimate interest in making the setup easier to understand (Art. 6(1)(f) GDPR); you can object as described in section 4, for example with intelligence.x3growth.io/signup?x3_notrack=1.

In the “Your company” step you can voluntarily state your industry, number of employees and annual revenue. X3 uses this to suggest the right template and recommend a plan (Art. 6(1)(b) GDPR). This information stays in X3: we do not transfer it to any customer system (CRM) and do not pass it on to third parties. You can change it at any time under Customers & team › Organisation.

Free setup help: only if you switch it on do we call you once (consent, Art. 6(1)(a) GDPR and § 7 UWG). We store when you gave your consent and who gave it; the email to the team only contains this person's phone number. Your request goes by email to the team of good vibes GmbH with name, email address, phone number, company and industry. You can withdraw your consent at any time by switching it off again; the team then receives a short message not to call. If you reserve a paid plan while it cannot be booked yet, the team also receives a short message.

Profile picture: you can voluntarily upload a profile picture under X3 Konto › Profile. We rotate it the right way up, remove all metadata (for example location, camera and date taken) and store it in several sizes in the platform's file storage (Vercel, see below). Only the members of your organisations can see it next to your name and, if you host a booking link, the guests on that booking page and in their appointment emails. The address of the image contains a random identifier and is only shared in these places (contract and legitimate interest in a recognisable contact person, Art. 6(1)(b) and (f) GDPR). You can remove the picture at any time; we also delete it when you delete your account.

Retention and deletion: the details are kept for as long as your account exists. If you delete your account (Account & appearance › Your data), we delete your name, email address, phone number and password; all sign-ins, app connections and your keys end. Where X3 records who changed something (logs, approvals, notes), we replace your email address with an anonymous placeholder. If you delete an organisation, we also delete its company details and the consent to the setup help. When your last membership in an organisation ends, we delete the phone number as well. Under Account & appearance › Your data you can download everything we store about your account at any time, including your connected apps, your keys (without the key itself), invitations, settings and what you changed in X3 (Art. 15 and 20 GDPR).

The platform runs at Vercel Inc. with the database of Neon Inc. in Frankfurt am Main (see sections 3 and 4). We send emails as described in section 10.

If you book a paid plan, we process company, billing address, VAT identification number, billing email, booked plans, usage (such as page views, seats, AI usage), invoices and payment status (Art. 6(1)(b) and (c) GDPR).

Payment is handled by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). You enter your payment details directly with Stripe; we only receive details such as the payment method, the last digits and the expiry date of a card. Stripe also processes data as a controller in its own right, for example for fraud prevention and legal obligations (stripe.com/privacy). Stripe may transfer data to Stripe, Inc. in the USA, which is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework; standard contractual clauses apply in addition.

We keep invoices and accounting records for ten years because the law requires it (Art. 958f CO). We delete the remaining contract data once it is no longer needed for this purpose.

When you use the X3 apps, we process technically necessary data: IP address, time, requested address, browser and device (server logs at Vercel), your sign-ins and sessions, and a log of important changes (audit log: who changed, approved or viewed what and when). We use this to provide X3, fix errors and detect misuse and attacks (Art. 6(1)(b) and (f) GDPR).

We do not use third parties for error analysis and statistics; errors are captured in our own logs. Server logs are deleted automatically after a short time, the audit log after 365 days.

We only analyse how you use X3 (such as which features you open) to improve X3 and support you during setup, and only within X3 (Art. 6(1)(f) GDPR).

We send you emails that are necessary for your account and your contract: confirmation of your email address, sign-in links, invitations, notices about security, plan and invoices, and notifications and reports that you set up in the apps (Art. 6(1)(b) GDPR). You can unsubscribe from notifications and reports in the apps. We only send marketing emails with your consent or, if you are a customer, about similar products of our own, with the option to object at any time.

To send them, we use an email delivery provider (Twilio Inc. with the SendGrid service, USA), which delivers the emails on our behalf. Transfer to the USA: Data Privacy Framework, supplemented by standard contractual clauses. We do not track opens and clicks in our emails to you; the tracking features of the delivery provider are switched off.

You download the mobile apps (such as X3 Sales for iOS and Android) via the App Store of Apple Inc. or Google Play of Google LLC. Their privacy policies apply to the download and to ratings; we only receive aggregated statistics from them.

The app processes the data of your X3 Konto in the same way as the web apps. For push notifications we store a device identifier (push token), platform, app version and language; the notifications are delivered by 650 Industries, Inc. (Expo), USA, via the Apple Push Notification Service and Google's Firebase Cloud Messaging (standard contractual clauses). You can switch off push notifications in the app or in your device settings. The app also receives updates via Expo.

The app only asks for permissions for individual features and only when you use them: contacts (only the one contact you select, never the whole address book), calendar (your appointments stay on the device), microphone and speech recognition for voice notes (converted on the device, the recording is not stored), camera for reading business cards (the photo is not stored), photos (only an image you select) and Face ID for unlocking. Calls, text messages and WhatsApp open your phone's apps; X3 does not make calls itself and does not record conversations.

The app contains no third-party advertising or tracking libraries. It reports crashes and errors without content to our own platform (Art. 6(1)(f) GDPR).

If you ask us for help in your account, we access the data of your organisation needed for this, only to the extent and for as long as necessary for the help, and with logging.

If you connect a mailbox, a calendar, an ad account or another app in X3, you sign in directly with the respective provider; we never see your password. Composio, Inc., USA, manages the sign-in and the connection on our behalf (standard contractual clauses). Which data we then read from the service or send to it is determined by the organisation for which you use X3 (section 13). You can disconnect at any time.

Companies use X3 Growth Intelligence to measure the visitors to their websites and apps and to evaluate advertising, X3 CRM to manage contacts, leads, emails and appointments (including tracking whether an email was opened or a link in it was clicked, if the company has switched this on), and X3 Automation for AI assistants, chats and workflows with their apps.

The respective company is the controller for this data, not us. We only process it on its behalf and according to its instructions on the basis of our data processing agreement (x3growth.io/en/dpa), which also lists the service providers we use. We do not use this data for our own purposes or for advertising.

If you are a visitor to one of our customers' websites, a contact in their CRM or a recipient of their emails, the company informs you in its own privacy policy. Please contact the company directly with questions and to exercise your rights. If you write to us, we forward your request to the company, insofar as we can identify it.

We only pass on your data if this is necessary for the purposes described, if you have consented or if we are legally obliged to do so. Recipients are our service providers working on our behalf: Vercel Inc. (hosting, files, AI gateway), Neon Inc. (database in Frankfurt am Main), Twilio Inc. (email delivery), Composio, Inc. (connections), 650 Industries, Inc. (push notifications), and, as controllers in their own right, Stripe (payments), Meta (only with consent, section 4b) and WhatsApp (only if you use it). Authorities only receive data if the law requires it.

We store the data of the X3 apps in the EU (Frankfurt am Main). Several service providers are based in the USA. We base transfers to the USA on the EU-U.S. and Swiss-U.S. Data Privacy Framework where the recipient is certified, otherwise on the European Commission's standard contractual clauses with the adaptations for Switzerland (Art. 46(2)(c) GDPR, Art. 16(2)(d) FADP). You can obtain a copy of the clauses on request.

We only store data for as long as necessary for the purpose: website measurement data 180 days, aggregated daily figures up to three years, recordings as described in section 4a, account data until your account is deleted, enquiries without a collaboration 12 months, audit log 365 days, invoice and accounting data ten years. After that we delete or anonymise it.

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR, Art. 25 to 28 and 32 FADP). You can object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). You can withdraw consent at any time with effect for the future. You can handle much of this yourself in your account under Account & appearance › Your data.

To do so, email us at deno@x3growth.io. You can also lodge a complaint with a data protection supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch), in the EU with the supervisory authority of the country where you live or work.

We do not make decisions based solely on automated processing that have legal effects on you or similarly significantly affect you.

We update this policy when our offering or the legal situation changes. The version published here applies; we inform you by email or in the app about significant changes that affect your account.