# 8x — full content corpus

> Every public page on https://8x.sale, as Markdown, for AI answer engines. Generated from the same source the site renders. See https://8x.sale/llms.txt for the short version and https://8x.sale/developers for the endpoint index.

<!-- https://8x.sale/ -->

# Learn to sell. Get paid to do it.

> No experience needed. Pass a live interview, train with our team, then get paid to call real leads.

Free to apply · 100% remote · Cash out at US$50 or more. Canonical URL: https://8x.sale/

## How you get started.

### Apply

Create an account and add your CV, a personal mobile number from a country we work in, and a short voice recording about yourself.

### Review

A person on our team reviews your application.

### Live interview

If you're approved, you book a live interview with our team.

### Train

Pass the interview, then train with lessons, AI practice calls, and our team.

### Start calling

We assign you to a campaign, and you call from your browser during your prospects' business hours.

### Get paid

Hourly base pay for your live dialing time, added to your balance after each dialing session.

## 8x supports you before, during, and after every call.

### Before the call — Practice with AI prospects who raise objections.

Step-by-step lessons, objection practice, and AI practice calls. Repeat them until opening a call and answering objections feels natural.

- How to open a cold call
- Objection practice: price, timing, no interest
- Scored on 7 sales skills

### During the call — Real leads. Real calls. Your script on screen.

Call from your browser. A live transcript runs beside each call, with your script and answers to common objections on the same screen.

- Researched leads, ready to call
- Dial from your browser, no phone bill
- Live transcript of both sides of the call

### After the call — Get a score and feedback on your calls.

AI practice calls and real conversations get a score on 7 skills, so you can see what to improve on the next call.

## How a call turns into money.

You earn hourly base pay for your live dialing time. You also earn $20 for each meeting you book, once we confirm the booking is genuine, and $70 more when the meeting is held and our team confirms the prospect is a good fit.

- **Hourly base** — Your country's hourly rate, paid for live dialing time (while calls ring or connect, plus 30 seconds to log each connected call). It's added to your balance after every dialing session.
- **Meeting booked** — For a lead we give you. Paid once we confirm the booking is genuine, and you keep it even if the prospect doesn't show up.
- **Qualified meeting** — Paid on top of the booking bonus when the meeting is held and our team confirms the prospect is a good fit: a real potential customer for the company.

Amounts shown are the US/USD rates — the page converts them to the visitor's own market, and payouts are always made in USD.

## Questions, answered.

Clear answers about pay, hours, the leads, and how AI scoring works on your calls.

### What will I do, and who am I selling for?

You phone people at businesses and try to book a meeting between them and a company that works with 8x. The people you call are known as prospects or leads, and a call to someone who does not know you yet is a cold call. We give you each lead with a short brief about their business. Top reps can be promoted to Closer, and then they run the meetings they helped book.

### Do I need sales experience?

No sales experience is required. You do need to send a CV with your application, and a person on our team reviews every application. If you're approved, the live interview is where you show you're ready, and after you pass, we train you with lessons and AI practice calls.

### How do I get paid, and how much?

You earn hourly base pay, at your country's rate, for the time your calls are ringing or connected, plus bonuses for meetings. You get $20 for each meeting you book with one of our leads, paid once we confirm the booking is genuine, and you keep it even if the prospect doesn't show up. You get $70 more when the meeting is held and our team confirms the prospect is a good fit. Your earnings are tracked in USD, and you can cash out through our payout partner once your balance reaches US$50.

### Is there an application or interview?

Yes, both. Signing up starts your application, where you add your CV, a personal mobile number from a country we work in, and a short voice recording about yourself. If our team approves it, you book a live interview with us. If you pass, you train with our team and are assigned to a campaign (the company you will call for) before you start calling.

### Where do the leads come from?

8x provides them. We find and research real companies for each campaign and give them to you ready to call, so you never have to build your own lists. You call them from the dialer in your browser.

### What does the AI do on my calls?

It scores your calls after they end. Calls with a real conversation get a transcript and a score on 7 skills, with written feedback and the one sentence to say differently next time. During a call, you see a live transcript next to your script and a guide to common objections.

### What do I need to start, and where can I work from?

You need a computer with a modern browser, a working microphone, a stable internet connection, and a quiet place to take calls. You also need a personal mobile number from a country we work in, and you must be 18 or over. You work remotely and choose when to dial, within your prospects' business hours: Monday to Friday, 9:00 to 18:00 in their time zone. If you call another country, that can mean evenings or nights where you live.

## Applications are open.

Apply online. Every new rep has a live interview with us and trains with our team before calling real leads.

## Links

- [Apply as a sales rep](https://8x.sale/signup)
- [For companies](https://8x.sale/for-companies)
- [Developer and AI-agent resources](https://8x.sale/developers)
- [Legal](https://8x.sale/legal) · [Privacy](https://8x.sale/privacy)

<!-- https://8x.sale/for-companies -->

# 8x for Companies

> 8x is a campaign-based managed sales force. Companies brief 8x once on what they sell; 8x builds the campaign, certified reps cold-call it, and every real conversation is scored by an AI evaluator with human review.

Canonical URL: https://8x.sale/for-companies

## What you get

- Brief 8x once on what you sell, on a discovery call.
- 8x builds the campaign from that brief — cold-call script and objection handling, your ideal-customer profile, the criteria a meeting has to meet, and a fact base of what reps may claim about you. You read and edit it, and you and 8x both approve it before launch.
- Certified reps dial it, assigned one campaign at a time.
- Every real conversation is scored 1–5 on seven skills and claim-checked against your fact base; flagged calls go to an 8x operator.
- A live dashboard shows leads, dials, connects, meetings booked, showed up and qualified. Call recordings and call scores stay internal.

## Engagement tiers

Pilot, Team, Scale. Every tier is priced "Custom" and quoted per campaign on the call. The tier blurbs are on the page itself; this document restates no figure the product does not measure.

## Markets

8x runs reps in: India, United States, Mexico, Brazil, United Kingdom, Philippines, Türkiye, Portugal, Spain, South Africa, Pakistan.

## Questions, answered

### How does a campaign get built?

A discovery call comes first. We build your campaign from that recording and your website — the cold-call script and objection handling, your ideal-customer profile, the criteria a meeting has to meet, and a fact base of what reps may and may not claim about you. There's no form to fill in. When it's ready you get a login, you read and edit it, and nothing goes live until you submit it and 8x approves it. We don't quote a turnaround, because nothing in the product measures one.

### Do I choose or manage the reps?

No. You don't staff, schedule or interview anyone — 8x assigns certified reps to your campaign, and a rep is on one campaign at a time, so nobody is splitting your pitch with another brand's. Reps set their own dialing hours and are paid by 8x for live dialing time plus outcome bonuses; none of that is yours to manage.

### What does 8x actually run for me?

The outbound itself: dialing your campaign, qualifying prospects and booking meetings against criteria generated from your own ideal-customer profile. You're not filling a headcount — 8x doesn't place anyone inside your company and doesn't recruit for your roles. What you get is meetings.

### What if a rep isn't working out?

Every real conversation is scored 1–5 on seven skills and conduct flags land in a human queue, so a rep who isn't working out shows up early. When that happens 8x pulls them off your campaign. We don't put a number of days on a replacement, and we don't describe billing here — pricing is agreed per campaign on the call.

### Where do the leads come from?

Your list or ours. Upload your own from the portal and an 8x admin reviews the batch before it reaches the floor — you see how many rows actually landed — or work from researched prospects matched to your ideal-customer profile. Either way reps dial from one managed pool, so there's no scraping or list-building on your side. Prospects are only called Monday to Friday, 9 to 6, in their own local time; that's enforced in the dialer.

### Who runs the floor, and what gets checked?

The 8x operations team: they interview and certify reps, sign off their training, clear flagged calls, and confirm whether a booked meeting showed up and qualified. Every call that becomes a real conversation is scored by an AI evaluator on seven skills, and a second pass fact-checks what the rep claimed about you against your own fact base. Call recordings and call scores stay internal — your dashboard reports outcomes: leads, dials, connects, meetings booked, showed up, qualified, and your lead-quality spread.

### How does pricing work?

Pricing is quoted per campaign on the call. Pilot, Team and Scale are engagement sizes, not a rate card — what a campaign costs depends on the market, the motion and the volume, so we price it after the discovery call rather than publishing a number we'd have to caveat.

## Links

- [Book a discovery call](https://cal.com/rohtansh/discovery-call)
- [For companies, in full](https://8x.sale/for-companies)
- [Rep landing](https://8x.sale/)
- [Developer and AI-agent resources](https://8x.sale/developers)
- [Legal](https://8x.sale/legal) · [Privacy](https://8x.sale/privacy)

<!-- https://8x.sale/developers -->

# 8x developer and AI-agent resources

8x is a campaign-based managed sales force. Companies brief 8x once on what they sell; 8x builds the campaign, certified reps cold-call it, and every real conversation is scored by an AI evaluator with human review. (https://8x.sale)

This page is the index of everything 8x publishes for machines — crawlers, AI
answer engines, and autonomous agents.

## Machine-readable endpoints

| Resource | URL | Media type |
| --- | --- | --- |
| Site summary for LLMs | [https://8x.sale/llms.txt](https://8x.sale/llms.txt) | `text/plain` |
| Full content corpus for LLMs | [https://8x.sale/llms-full.txt](https://8x.sale/llms-full.txt) | `text/plain` |
| XML sitemap | [https://8x.sale/sitemap.xml](https://8x.sale/sitemap.xml) | `application/xml` |
| Crawler policy | [https://8x.sale/robots.txt](https://8x.sale/robots.txt) | `text/plain` |
| This page, as Markdown | [https://8x.sale/developers.md](https://8x.sale/developers.md) | `text/markdown` |

## Markdown content negotiation

Every public page below is served as clean Markdown when you ask for it, per
the [acceptmarkdown.com](https://acceptmarkdown.com) convention. Two ways to
get it:

1. **Content negotiation** — send `Accept: text/markdown`. The response is
   `text/markdown; charset=utf-8` and carries `Vary: Accept`.
2. **An explicit `.md` URL** — append `.md` to the path. This ignores the
   `Accept` header entirely, which is handy for tools that can't set headers.

```bash
curl -H "Accept: text/markdown" https://8x.sale/
curl https://8x.sale/for-companies.md
```

Requesting a media type 8x cannot produce (for example
`Accept: application/pdf`) returns `406 Not Acceptable` with the list of
available types. Requesting a path that does not exist returns a real
`404` — and, when you asked for Markdown, a short Markdown body pointing at
this index.

### Documents available as Markdown

- `/` → `/index.md`
- `/pt-BR` → `/pt-BR.md`
- `/es-MX` → `/es-MX.md`
- `/hi-IN` → `/hi-IN.md`
- `/tr-TR` → `/tr-TR.md`
- `/for-companies` → `/for-companies.md`
- `/developers` → `/developers.md`
- `/legal` → `/legal.md`
- `/legal/terms` → `/legal/terms.md`
- `/legal/privacy-prospects` → `/legal/privacy-prospects.md`
- `/legal/acceptable-use` → `/legal/acceptable-use.md`
- `/legal/cookies` → `/legal/cookies.md`
- `/legal/sub-processors` → `/legal/sub-processors.md`
- `/privacy` → `/privacy.md`

## Structured data

Every public page embeds JSON-LD (schema.org) in a
`<script type="application/ld+json">` block:

- `Organization` — the 8x entity, with a stable `@id` of
  `https://8x.sale/#organization`
- `WebSite` — `https://8x.sale/#website`, publisher-linked to the Organization
- `Service` — the managed sales-force offering, with its engagement tiers
- `FAQPage` — on the rep landing and `/for-companies`
- `BreadcrumbList` — on `/for-companies`

## Crawler policy

`robots.txt` names the AI answer-engine crawlers explicitly and allows them on
every public page: GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot,
anthropic-ai, PerplexityBot, Perplexity-User, Google-Extended, Bingbot, and
Applebot-Extended. The authenticated rep and admin applications are
`Disallow`-ed — those routes require a session and hold rep and prospect
data.

## Is there a public API?

**Not today.** 8x publishes no REST API, no OpenAPI/Swagger specification, no
webhook feed, and no MCP server. If you are building an integration against 8x,
[book a discovery call](https://cal.com/rohtansh/discovery-call) and say so — that is the fastest
path to a real answer, and it is the same intake companies use to brief a
campaign.

Please do not infer endpoints from the URLs above: `/api/*` is internal,
session-authenticated, and `Disallow`-ed in `robots.txt`.

## Facts an agent may need

- **Entity name:** 8x
- **Canonical domain:** https://8x.sale (`www.8x.sale` issues a single 308 to the apex)
- **What it does:** 8x is a campaign-based managed sales force. Companies brief 8x once on what they sell; 8x builds the campaign, certified reps cold-call it, and every real conversation is scored by an AI evaluator with human review.
- **Markets served:** India (IN), United States (US), Mexico (MX), Brazil (BR), United Kingdom (GB), Philippines (PH), Türkiye (TR), Portugal (PT), Spain (ES), South Africa (ZA), Pakistan (PK)
- **Engagement model:** engagement tiers are priced "Custom" and quoted per campaign on a discovery call
- **Company contact:** [book a discovery call](https://cal.com/rohtansh/discovery-call)
- **Legal contact:** legal@8x.social
- **Privacy contact:** privacy@8x.social

## Contact

- Companies: [https://cal.com/rohtansh/discovery-call](https://cal.com/rohtansh/discovery-call)
- Sales reps who want to join: [https://8x.sale/signup](https://8x.sale/signup)
- Legal and privacy: see [https://8x.sale/legal](https://8x.sale/legal) and [https://8x.sale/privacy](https://8x.sale/privacy)

<!-- https://8x.sale/legal -->

# 8x legal documents

> These documents describe how the 8x program operates and how we handle data.

- [Privacy Notice (reps & applicants)](https://8x.sale/privacy): How 8x handles the personal data of applicants and sales reps.
- [Terms of Service](https://8x.sale/legal/terms): The terms of service governing your use of the 8x platform — the marketing site, the rep app, and the dialer.
- [Prospect Privacy Notice](https://8x.sale/legal/privacy-prospects): How 8x handles business prospect data, including the indirect collection of contact details from third parties and the rights prospects have.
- [Acceptable Use Policy](https://8x.sale/legal/acceptable-use): The 8x acceptable use policy for rep cold outreach: DNC, opt-outs, recording disclosure, and no misrepresentation.
- [Cookie Notice](https://8x.sale/legal/cookies): This cookie notice lists the cookies and browser storage the 8x platform uses, including consent-gated Google Analytics.
- [Sub-processors](https://8x.sale/legal/sub-processors): The third-party sub-processor list for 8x: what data each one receives, what it does with it, and the regions it is processed in.

<!-- https://8x.sale/legal/terms -->

# 8x Platform Terms of Service

Last updated: June 2026

---

## 1. Introduction and acceptance

These Terms of Service (the "**Terms**") form a binding agreement between you ("**you**," "**your**," or "**Rep**") and 8x Social, Inc., a Delaware corporation ("**8x**," "**we**," "**us**," or "**our**"), whose registered address is 1111B S Governors Ave STE 47647, Dover, DE 19904, United States. These Terms govern your access to and use of the 8x website, web application, dashboards, training materials, dialer/cockpit, and related services (collectively, the "**Platform**").

By creating an account, clicking "I agree" (or a similar control), or otherwise accessing or using the Platform, you confirm that you have read, understood, and agree to be bound by these Terms and by the documents incorporated by reference in Section 18. **If you do not agree, do not access or use the Platform.**

These Terms govern your use of the Platform itself. They do **not** by themselves create any contractor, employment, agency, partnership, or earnings relationship. The commercial relationship under which you may perform outreach work and earn compensation is governed by a separate **Independent Contractor Agreement** (see `independent-contractor-agreement.md`), which you must accept before performing any paid activity. In the event of a conflict between these Terms and the Independent Contractor Agreement regarding the contractor relationship or compensation, the Independent Contractor Agreement controls as to those subjects.

## 2. The Platform: what 8x is and is not

8x operates a sales-training and outreach program. The Platform is designed to:

- recruit, onboard, and train sales representatives;
- provide training content, practice exercises, and an audition/assessment process;
- enable approved Reps to make **real outbound business-to-business cold calls** to **real business prospects** using an integrated Twilio-based dialer; and
- record, transcribe, and evaluate those calls using automated/AI systems in order to assess Rep performance, determine whether an outreach interaction qualifies as a meeting, and calculate compensation.

**Automated evaluation.** You acknowledge and agree that your calls are recorded, transcribed by automated speech-to-text technology, and evaluated by automated/AI systems, and that these automated evaluations are used to determine outreach outcomes, meeting-qualification, eligibility, and **the compensation you may earn**. The criteria, your right to meaningful information about the evaluation, and your right to human review and to contest any pay-affecting evaluation are described in the rep privacy notice (see `privacy-notice-reps.md`) and in the Independent Contractor Agreement (see `independent-contractor-agreement.md`).

**Not a guarantee.** The Platform provides tools, training, and leads. It does **not** guarantee any leads, calls, meetings, conversions, deals, or earnings. See Section 9.

## 3. Eligibility and age representation

To create an account or use the Platform, you represent and warrant that:

1. **You are at least 18 years of age.** The Platform is not directed to, and may not be used by, anyone under 18. If we learn that an account belongs to a person under 18, we may suspend or terminate it and delete associated data.
2. You have the legal capacity to enter into a binding contract in your jurisdiction.
3. You are not barred from receiving services or compensation under the laws applicable to you, including applicable sanctions and export-control laws.
4. The registration information you provide is true, accurate, current, and complete, and you will keep it updated.
5. **Geographic scope: the EU/UK IS in scope.** 8x accepts EU/UK scope (there is no EU-exclusion gate), so **GDPR and the ePrivacy Directive apply** to EU/UK users and prospects. 8x's corresponding obligations — appointing an Art. 27 EU representative (and a UK representative if the UK is in scope), SCCs Module 2 + a documented TIA for US transfers, ePrivacy Art. 13 prior consent for electronic/automated direct marketing, a DPIA, and GDPR Art. 22 automated-decision rights — are addressed in `privacy-notice-reps.md` and `dpa-and-transfer-register.md`.

We may, in our discretion, refuse, suspend, or restrict access for any account that does not meet these requirements.

## 4. Account registration and security

At signup you provide an email address and password. To progress through the program you may later be asked to provide additional information (for example, your name, a short bio, a self-reported LinkedIn profile, your country, and a CV/resume file), and the Platform will generate training and performance data associated with your account. How we collect, use, and retain this information is described in the rep privacy notice (see `privacy-notice-reps.md`).

You are responsible for:

- maintaining the confidentiality of your account credentials;
- all activity that occurs under your account; and
- promptly notifying us at privacy@8x.social of any unauthorized use or suspected breach.

You may not share, sell, or transfer your account, create more than one account without our permission, or impersonate any person or entity. We are not liable for any loss arising from unauthorized use of your account that results from your failure to safeguard your credentials.

## 5. Acceptable conduct and the Acceptable Use Policy

Your use of the Platform — and in particular your outreach activity — is subject to the **Acceptable Use Policy** (see `acceptable-use-policy.md`), which is incorporated into these Terms by reference. The Acceptable Use Policy governs, among other things, lawful calling practices, honoring do-not-call and opt-out requests, call-recording disclosure/consent requirements, prohibited misrepresentations, and handling of prospect data.

Without limiting the Acceptable Use Policy, you agree that you will **not**:

1. use the Platform for any unlawful purpose or in violation of any applicable law, including telemarketing, consumer-protection, data-protection, anti-spam, and call-recording laws;
2. make calls to numbers, or contact persons, in violation of applicable do-not-call rules, opt-out requests, or calling-time restrictions;
3. fail to provide any call-recording disclosure or obtain any consent required by applicable law (you must follow the disclosure script and consent practices we provide);
4. make any false or misleading statement, or any material misrepresentation, during outreach;
5. attempt to manipulate, game, or defeat the automated evaluation or compensation systems (for example, by submitting fabricated, scripted, recycled, or non-genuine call content);
6. upload, submit, or transmit any content that is unlawful, infringing, defamatory, or that you do not have the right to provide;
7. probe, scan, reverse-engineer, scrape, overload, or interfere with the Platform or its security, or circumvent rate limits or access controls;
8. use the Platform to collect or process personal data other than as permitted by us and by applicable law; or
9. use the Platform in a way that exposes 8x to legal liability or reputational harm.

Violation of this Section or of the Acceptable Use Policy is a material breach and may result in suspension or termination under Section 11, withholding of disputed compensation as permitted by the Independent Contractor Agreement, and other remedies available at law.

## 6. Prospect data and privacy

In the course of outreach you will access and create personal data about third-party business prospects (for example, names, companies, phone numbers, email addresses, notes, voice recordings, and AI transcripts/evaluations). With respect to all such data:

1. **8x is the controller.** 8x determines the purposes and means of processing prospect personal data and Rep personal data. You access prospect data solely as authorized by 8x and on its instructions; you may not retain, copy, export, repurpose, sell, or use prospect data outside the Platform or after your access ends.
2. You must handle prospect data strictly in accordance with the Acceptable Use Policy (see `acceptable-use-policy.md`), the prospect privacy notice (see `privacy-notice-prospects.md`), and our written instructions.
3. You must promptly forward to us any privacy request, complaint, opt-out, or do-not-call request you receive, and must not respond to such requests on your own except as we direct.

Our handling of your own personal data as a Rep is described in the rep privacy notice (see `privacy-notice-reps.md`). Our handling of prospect personal data is described in the prospect privacy notice (see `privacy-notice-prospects.md`).

## 7. Compensation and no guarantee of earnings

If and when you are approved to perform paid outreach, you may become eligible to earn compensation under the program. As of the date of these Terms the published compensation components are source-dependent: **for leads 8x provides, a booking bonus of US$15 plus an AI-qualified-meeting payment of US$50; for prospects you source yourself, no booking bonus and a single payment of US$65, payable only when the meeting is held and 8x verifies it fit the ideal-customer profile; and, in either case, a closed-deal payment of US$250**, as further described in the Independent Contractor Agreement. In addition, you may earn an **hourly base fee**: a per-market hourly rate for each hour of **active dialing time measured by the platform dialer**, within a calendar week, up to a cap of **20 hours per week**, with no minimum-hours threshold. The hourly base fee is a per-hour fee for time worked and not a salary or guaranteed minimum, and is likewise governed by the Independent Contractor Agreement. **[NEEDS COUNSEL REVIEW — 2026-07-07: hourly-base sentence added; a per-hour fee for time worked warrants a fresh worker-classification / wage-and-hour review per market — see the Independent Contractor Agreement § 3.2.]** All compensation is denominated and paid in US dollars; any local-currency figures shown anywhere are approximate conversions for convenience only.

**All compensation terms, eligibility conditions, qualification rules, payment timing, taxes, and chargeback/clawback rules are governed exclusively by the Independent Contractor Agreement** (see `independent-contractor-agreement.md`). These Terms do not themselves entitle you to any payment.

You expressly acknowledge that:

- 8x makes **no representation, warranty, or guarantee** of any leads, calls, meetings, qualifications, deals, or earnings, and that **any earnings figures, examples, or averages are illustrative only and are not promises**;
- whether an interaction qualifies for a booking bonus or meeting payment is determined in part by **automated/AI evaluation** and, for prospects you source yourself, by **8x's human verification of meeting attendance and ideal-customer-profile fit** (the booking bonus does not apply to self-sourced prospects), in each case subject to the human-review and contest rights referenced in Section 2; and
- you bear your own business costs and are responsible for your own taxes, as set out in the Independent Contractor Agreement.

## 8. Intellectual property

### 8.1 8x property

The Platform and all associated software, designs, interfaces, training content, lesson materials, scripts, rubrics, prompts, evaluations, methodologies, documentation, trademarks, logos, and other materials (collectively, the "**8x Materials**") are owned by 8x or its licensors and are protected by intellectual-property and other laws. Except for the limited license in Section 8.2, no rights in the 8x Materials are granted to you.

### 8.2 License to you

Subject to your compliance with these Terms, 8x grants you a limited, personal, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Platform and the 8x Materials **solely** for the purpose of participating in the program. You may not copy, distribute, publicly display, modify, create derivative works from, sell, or otherwise exploit the 8x Materials outside the Platform. This license ends automatically when your access ends.

### 8.3 Rep-submitted content

You retain ownership of content you submit (for example, your bio, your CV, and notes you write) ("**Rep Content**"). You grant 8x a worldwide, royalty-free, sublicensable (to our sub-processors and service providers) license to host, store, reproduce, process, transcribe, evaluate, and otherwise use Rep Content **for the purpose of operating, evaluating, improving, and providing the Platform and the program**, and as otherwise described in the rep privacy notice (see `privacy-notice-reps.md`). You represent that you have all rights necessary to grant this license and that your Rep Content does not violate any law or third-party right.

### 8.4 Call recordings and outputs

Recordings, transcripts, and AI evaluations of calls are generated and held by 8x as controller and form part of the 8x Materials and program records. Your performance of a call does not give you any ownership of, or right to obtain, copy, or distribute, those recordings, transcripts, or evaluations, except as expressly provided by the applicable privacy notice or required by law.

### 8.5 Feedback

If you provide suggestions or feedback about the Platform, you grant 8x a perpetual, irrevocable, royalty-free license to use it without restriction or obligation to you.

## 9. Disclaimers

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE PLATFORM AND THE 8x MATERIALS ARE PROVIDED "**AS IS**" AND "**AS AVAILABLE**," WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, ACCURACY, AND NON-INFRINGEMENT.

WITHOUT LIMITING THE FOREGOING, 8x DOES NOT WARRANT THAT: (a) THE PLATFORM WILL BE UNINTERRUPTED, SECURE, OR ERROR-FREE; (b) ANY AUTOMATED EVALUATION, TRANSCRIPTION, OR QUALIFICATION DETERMINATION WILL BE COMPLETE OR FREE OF ERROR (THE HUMAN-REVIEW AND CONTEST RIGHTS IN SECTION 2 ADDRESS PAY-AFFECTING EVALUATIONS); OR (c) YOU WILL ACHIEVE ANY PARTICULAR RESULT, MEETING, DEAL, OR EARNINGS.

You are responsible for your own conduct during outreach and for complying with all laws applicable to you. Some jurisdictions do not allow the exclusion of certain warranties; in those jurisdictions, the exclusions apply only to the extent permitted.

## 10. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:

1. 8x AND ITS OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, AND SUPPLIERS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, EARNINGS, GOODWILL, OR DATA, ARISING OUT OF OR RELATING TO THE PLATFORM OR THESE TERMS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
2. 8x'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE PLATFORM WILL NOT EXCEED THE GREATER OF (a) THE TOTAL AMOUNTS PAID OR PAYABLE TO YOU BY 8x UNDER THE INDEPENDENT CONTRACTOR AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (b) US$100.

These limitations apply regardless of the legal theory and even if a remedy fails of its essential purpose. Some jurisdictions do not allow certain limitations; in those jurisdictions, liability is limited to the greatest extent permitted by law. Nothing in these Terms limits liability that cannot be limited under applicable law (for example, for fraud, willful misconduct, or, where applicable, personal injury).

## 11. Suspension and termination

### 11.1 By you

You may stop using the Platform and request closure of your account at any time by contacting privacy@8x.social.

### 11.2 By 8x

We may suspend, restrict, or terminate your account and access, with or without notice, if we reasonably believe that: (a) you have breached these Terms, the Acceptable Use Policy, or the Independent Contractor Agreement; (b) your conduct creates legal, security, or reputational risk; (c) you have attempted to manipulate the evaluation or compensation systems; (d) suspension is required to comply with law or a lawful request; or (e) you no longer meet the eligibility requirements in Section 3.

### 11.3 Effect of termination

On termination: your license under Section 8.2 ends; your right to access the Platform ceases; and any compensation owed (or subject to clawback) is handled under the Independent Contractor Agreement. We will retain and delete your data in accordance with the rep and prospect privacy notices (see `privacy-notice-reps.md` and `privacy-notice-prospects.md`). Sections that by their nature should survive (including Sections 6, 8, 9, 10, 12, 13, 14, and 16–19) survive termination.

## 12. Indemnification

To the maximum extent permitted by applicable law, you agree to indemnify, defend, and hold harmless 8x and its officers, directors, employees, and agents from and against any third-party claims, demands, losses, liabilities, damages, costs, and expenses (including reasonable legal fees) arising out of or relating to: (a) your breach of these Terms, the Acceptable Use Policy, or the Independent Contractor Agreement; (b) your violation of any law in connection with your use of the Platform or your outreach (including telemarketing, do-not-call, call-recording, anti-spam, or data-protection laws); (c) your misuse of prospect or other personal data; or (d) your Rep Content. We may assume the exclusive defense of any matter subject to indemnification, in which case you will cooperate with us.

## 13. Governing law

These Terms are governed by the laws of Delaware, United States, without regard to its conflict-of-laws rules. The U.N. Convention on Contracts for the International Sale of Goods does not apply. This choice of governing law does not deprive you of the protection of any mandatory consumer or data-protection law of the country in which you reside that cannot be derogated from by agreement.

## 14. Dispute resolution

The state and federal courts located in New Castle County, Delaware have exclusive jurisdiction over any dispute arising out of or relating to these Terms, and you and 8x consent to personal jurisdiction and venue there, subject to any mandatory local forum that cannot be waived.

Regardless of the option chosen, either party may seek injunctive or equitable relief in a court of competent jurisdiction to protect its intellectual property or confidential information.

## 15. Changes to these Terms

We may modify these Terms from time to time. If we make a material change, we will provide reasonable notice (for example, by email to your registered address or by an in-Platform notice) before the change takes effect, and we will update the "Document version" above. Your continued use of the Platform after the effective date of a change constitutes acceptance of the modified Terms. If you do not agree to a change, you must stop using the Platform and may close your account. Changes will not apply retroactively to a dispute of which we had notice before the change.

## 16. Force majeure

8x is not liable for any failure or delay in performance caused by events beyond its reasonable control, including acts of God, outages or failures of telecommunications or third-party service providers (including our sub-processors), labor disputes, government action, or network or power failures.

## 17. General

- **Entire agreement.** These Terms, together with the documents incorporated by reference in Section 18, are the entire agreement between you and 8x regarding the Platform and supersede prior understandings on that subject. The Independent Contractor Agreement governs the contractor and compensation relationship.
- **Severability.** If any provision is held unenforceable, the remaining provisions remain in effect, and the unenforceable provision will be modified to the minimum extent necessary to make it enforceable.
- **No waiver.** Our failure to enforce any provision is not a waiver of it.
- **Assignment.** You may not assign these Terms without our prior written consent. We may assign these Terms to an affiliate or in connection with a merger, acquisition, or sale of assets.
- **No third-party beneficiaries.** These Terms do not create any third-party beneficiary rights, except as expressly stated.
- **Notices.** We may give notices by email to your registered address or by posting in the Platform. You may contact us at legal@8x.social or privacy@8x.social.
- **Language.** These Terms may be provided in translation for convenience; if there is a conflict, the English version controls except where applicable law requires the local-language version to govern (for example, in Mexico or Brazil).

## 18. Incorporated documents

The following documents are incorporated into these Terms by reference and form part of your agreement with 8x:

- **Acceptable Use Policy** — `acceptable-use-policy.md`
- **Independent Contractor Agreement** — `independent-contractor-agreement.md`
- **Rep & Applicant Privacy Notice** — `privacy-notice-reps.md`
- **Prospect Privacy Notice** (prospect/indirect-collection data) — `privacy-notice-prospects.md`
- **Cookie Notice** — `cookie-notice.md`
- **Sub-processor list** — `sub-processors.md`
- **DPA & cross-border transfer register** — `dpa-and-transfer-register.md`

If there is a conflict between these Terms and an incorporated document on a subject the incorporated document is intended to govern, the incorporated document controls as to that subject.

## 19. Contact

8x Social, Inc., a Delaware corporation
1111B S Governors Ave STE 47647, Dover, DE 19904, United States
Privacy / data-protection contact: the 8x Privacy Team, privacy@8x.social
General/legal contact: legal@8x.social

<!-- https://8x.sale/legal/privacy-prospects -->

# Prospect Privacy Notice (Indirect Collection)

Last updated: July 2026

---

## 0. How to read this notice / Como ler este aviso / Cómo leer este aviso

This notice explains how **8x** handles the personal data of **business prospects** — people we contact by phone or email about our products and services, who did **not** sign up with us. You are receiving or reading this notice because we obtained your business contact details from a third-party or public source (see Section 3) and contacted you, or because a call disclosure or outreach email pointed you here.

**Languages:**

- A **Brazilian Portuguese (PT-BR)** version governs for prospects in Brazil.
- A **Mexican Spanish (ES-MX)** _aviso de privacidad_ governs for prospects in Mexico.
- For prospects in India, an **India-specific DPDP itemized notice** applies (see Section 12). **Important: in India a notice is not a substitute for consent;** 8x is aligning its India (+91) outreach to a consent-first approach (see the India note in Section 12).
- For all other prospects, the English / applicable-locale version applies.

This notice is published at **https://8x.sale/legal/privacy-prospects**, the URL referenced in our call disclosures and in every outreach email.

---

## 1. Who we are (controller identity and role)

The data controller is **8x Social, Inc., a Delaware corporation** ("**8x**", "we", "us"), with registered address at **1111B S Governors Ave STE 47647, Dover, DE 19904, United States**.

**Our role.** For both the contact data and the call data described in this notice, **8x acts as the data controller** (in LGPD terms, the _controlador_; in Mexican terms, the _responsable_; in DPDP terms, the _Data Fiduciary_). We decide why and how your personal data is processed. We are not processing your data on behalf of any customer.

**Where we operate.** 8x is a US (Delaware) company. The United States is our home jurisdiction. Brazil, Mexico, and India are markets we serve. **The European Union / United Kingdom ARE in scope** — see Section 11. GDPR and the ePrivacy Directive apply, and the additional EU/UK terms in Section 11 (including the appointment of an Article 27 EU representative, and a UK representative if the UK is in scope) apply.

**Governing law.** Delaware, United States, without prejudice to the mandatory data-protection laws of the jurisdiction where you are located (Brazil — LGPD; Mexico — the Federal Law on Protection of Personal Data Held by Private Parties; India — DPDP Act 2023; and, if applicable, EU/UK GDPR).

---

## 2. How to contact us about your data

| Contact                                            | Details                                                                                                                                                                                                                             |
| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Privacy / data-protection contact**              | **privacy@8x.social**                                                                                                                                                                                                               |
| **Postal address**                                 | 1111B S Governors Ave STE 47647, Dover, DE 19904, United States                                                                                                                                                                     |
| **Data Protection Officer / Privacy Officer**      | the 8x Privacy Team, reachable at privacy@8x.social                                                                                                                                                                                 |
| **Brazil — Encarregado (DPO)**                     | the 8x Privacy Team, privacy@8x.social — **A Brazilian _encarregado_ is appointed because the high-risk processing described here (cold outreach, voice recording, AI evaluation) does not qualify for the small-agent exemption.** |
| **Mexico — Privacy contact (responsable)**         | the 8x Privacy Team, privacy@8x.social                                                                                                                                                                                              |
| **India — DPDP contact / Data Protection Officer** | the 8x Privacy Team, privacy@8x.social                                                                                                                                                                                              |

To **stop hearing from us immediately**, use the opt-out / suppression routes in Section 9.

---

## 3. Where we got your data and the category of source (indirect collection)

We did **not** collect your personal data directly from you. We obtained it indirectly. This section is provided to satisfy LGPD Art. 9, GDPR Art. 14 (where applicable), and the DPDP notice requirements.

- **Categories of source:** publicly available business sources (company websites, public business directories), professional networking profiles (e.g., public LinkedIn profiles), and third-party B2B lead/data providers. See **sub-processors.md** and any data-provider list for the specific suppliers.
- **What we got from the source:** typically your business name, the company you work for, a business phone number and/or business email address, your country, a link to a professional profile, and basic firmographic information about your company.
- We do **not** knowingly source or process special-category / sensitive data about you for prospecting (see Section 4).

> We record the source of each prospect record and will disclose the specific source on request, as part of your access right (Section 8).

---

## 4. Categories of personal data we hold

Depending on the interaction, we may hold the following categories of personal data about you:

**Contact and firmographic data (obtained indirectly per Section 3):**

- Name
- Company / employer
- Business phone number
- Business email address
- Professional profile link (e.g., LinkedIn)
- Country
- Firmographic information about your company (e.g., industry, category, company website, size indicators)

**Data we generate when our sales representatives contact you:**

- **Free-text notes** written by our representatives about the interaction
- **Voice recordings** of cold calls (where we have provided the recording disclosure — see Section 6 and the in-call disclosure)
- **AI-generated transcripts** of those calls (machine transcription)
- **AI-generated evaluations / scores** of the call (an automated assessment of the sales interaction — see Section 7)

A **bare voice recording is treated as ordinary (non-sensitive) personal data.** 8x does **not** create biometric voice-identification ("voiceprint") data, and does not process your voice as sensitive/special-category data.

---

## 5. Why we use your data (purposes)

We process your personal data for the following purposes:

1. **Business-to-business (B2B) prospecting and outreach** — to contact you by phone and/or email to introduce, and assess your potential interest in, products and services, and to schedule meetings.
2. **Operating and recording calls** — to place calls, and to record them where disclosed, for the purposes below.
3. **AI transcription and AI evaluation of calls** — we use automated speech-to-text to transcribe calls and an AI model to evaluate the sales interaction. **This AI evaluation determines whether an outreach resulted in a qualified meeting and is used to calculate what our sales representatives are paid.** This is an automated decision affecting our representatives; for how it may concern _you_ and your rights, see Section 7.
4. **Scheduling** — if you agree to a meeting, to book and manage that meeting.
5. **Record-keeping, quality, training, and compliance** — to maintain records of outreach, train and supervise our representatives, demonstrate compliance (including consent/opt-out records), and handle disputes, complaints, and legal obligations.
6. **Security and abuse prevention** — to protect our systems and prevent misuse.

We will **not** use your data for purposes incompatible with the above without providing a further notice or, where required, obtaining your consent.

---

## 6. Legal basis for processing (by region)

Our legal basis depends on where you are located.

### Brazil (LGPD)

- **B2B prospecting:** **legitimate interest** (_legítimo interesse_), LGPD Art. 7, IX and Art. 10. We maintain a documented **Legitimate Interest Assessment (LIA)** balancing our interest in B2B outreach against your rights. See the LIA in **internal-compliance-artifacts.md**.
- **Voice recording / AI evaluation:** processed under the same legitimate-interest basis as ordinary data, subject to the recording disclosure and your unconditional right to object to direct marketing (Section 9). Sensitive data is not processed on this basis (and we do not create biometric voice-ID; see Section 4).
- **Consumer-protection overlay (CDC):** our outreach identifies the sender, and we honor opt-out requests.
- **Do-not-call:** we honor applicable state _Procon_ "Não Me Ligue" do-not-call registries (e.g., São Paulo Law 13.226/2008, as amended).

### Mexico

- We provide this notice as our _aviso de privacidad_ under the Federal Law on Protection of Personal Data Held by Private Parties (published 20-Mar-2025, in force 21-Mar-2025). For ordinary data, consent is, by default, **tacit (opt-out)** — you may object at any time using Section 9.
- **Transfers disclosed:** under Art. 35, we disclose that your data is transferred to third parties (sub-processors) located in the United States. See Sections 8 and 10.
- **Do-not-call:** we honor the _Registro Público para Evitar Publicidad_ (**REPEP**) under the Federal Consumer Protection Law (LFPC), Art. 18 Bis; we scrub against REPEP and apply suppression.

### India (DPDP Act 2023)

- See Section 12. **In India we cannot rely on a "legitimate interest" basis for cold outreach, and a notice is not a substitute for consent.** 8x is aligning its India (+91) outreach to a consent-first approach and honors all opt-out and do-not-contact requests; India activity is subject to Indian-counsel review before scaling.

### United States

- We rely on our legitimate business interest in B2B prospecting, consistent with applicable US law. We do **not** sell or share your personal data for cross-context behavioral advertising. A direct CCPA notice-at-collection to prospects is excused under 11 CCR 7012(h) because we neither sell nor share, but this public notice covers our handling of prospect data. See Section 8 for your US rights.
- **Call recording:** we adopt **all-party consent** as our baseline (the conservative posture across US states, including California Penal Code §§ 632 and 632.7), implemented via the in-call recording disclosure.

### European Union / United Kingdom

- See Section 11. **EU/UK IS in scope — GDPR and the ePrivacy Directive apply.** Electronic/automated direct marketing requires **prior consent** under the ePrivacy Directive Art. 13 (a legitimate-interest assessment does **not** clear marketing email or automated calls).

---

## 7. Automated processing and AI evaluation — your rights

We use AI to **transcribe** calls and to **evaluate** the sales interaction. The AI evaluation scores the call against a defined seven-dimension rubric (discovery, objection handling, pricing discipline, proof specificity, next-step clarity, authenticity & listening, and tone & professionalism), together with conduct/compliance flags.

**What it decides.** This evaluation drives whether an outreach is treated as a **qualified meeting** and is used to determine **our representatives' pay**. It is a **solely or significantly automated decision** affecting our representatives.

**As a prospect, you can:**

- **Object** to this automated processing where it evaluates aspects relating to you (e.g., your behavior or responses on the call), particularly where it could produce undesired effects, and
- request **human review** of, and **information about**, the automated processing as it concerns you.

We provide a **human-review / contest route** for any pay-affecting evaluation (this is primarily a representative-facing right but is extended to prospects who object). To exercise these rights, contact us per Section 2.

> Mexico specifically recognizes a right to **object to solely-automated processing producing undesired effects** that evaluates behavior/performance — this is engaged by our evaluation. In the EU/UK (in scope), Art. 22 GDPR grants rights to human intervention, to contest, and to meaningful information (see Section 11).

---

## 8. Who receives your data (recipients / sub-processors)

We share your personal data with service providers ("sub-processors") who help us operate. The full, current list — including each provider's role and processing region — is maintained in **sub-processors.md**. As of this draft they include:

| Recipient     | Role                                                   | Data involved                     | Region                                                       |
| ------------- | ------------------------------------------------------ | --------------------------------- | ------------------------------------------------------------ |
| **Twilio**    | Telephony (placing/recording calls)                    | Phone number, call audio          | US                                                           |
| **OpenAI**    | AI transcription (whisper-1) + AI evaluation (gpt-4.1) | Call audio, transcripts           | US (default API endpoints; no ZDR / enterprise tier elected) |
| **Anthropic** | AI evaluation / summarization (Claude)                 | Transcripts                       | US                                                           |
| **Supabase**  | Database, authentication, and storage                  | All categories, incl. recordings  | United States (us-east-1)                                    |
| **Vercel**    | Application hosting                                    | IP address in request logs        | US / global                                                  |
| **Resend**    | Transactional and outreach email                       | Name, email, related contact data | US                                                           |
| **Cal.com**   | Meeting scheduling                                     | Data you enter when booking       | United States / EU                                           |
| **LinkedIn**  | OAuth/OIDC sign-in                                     | _(Intended; **not yet live**)_    | —                                                            |

We may also disclose data where required by law, to enforce our rights, or in connection with a corporate transaction, subject to applicable law.

---

## 9. Your right to object to marketing and to opt out / be suppressed

**You have an unconditional right to object to direct marketing.** If you tell us to stop, we will stop contacting you for marketing purposes and add you to our **suppression list**. You can do this:

1. **By email:** send a request to **privacy@8x.social** (subject: "Opt out / suppression"); or
2. **During a call:** tell the representative you do not wish to be contacted — your objection is recorded and honored; or
3. **By the unsubscribe link / instructions** in any outreach email.

**What happens when you opt out:** we suppress your contact details from further outreach. We honor opt-outs everywhere as a matter of policy (including in jurisdictions without a B2B carve-out), and we apply applicable do-not-call registries (Brazil state _Procon_ "Não Me Ligue"; Mexico **REPEP** with a 30-day suppression cycle; US internal do-not-call). For email, we honor opt-outs consistent with CAN-SPAM (within 10 business days; we aim to act faster).

For outreach **email**, this promise is fulfilled technically by a **suppression list**: every outreach email carries a one-click unsubscribe link (and `List-Unsubscribe` header), and clicking it adds your email address to our suppression list immediately. Before any outreach email is sent, we check that list and will not email an address on it. This suppression record is **retained** for as long as needed to keep honoring your request — including if we otherwise delete your data on request, your suppression entry is kept (with your address no longer linked to any other record) so we do not accidentally contact you again.

We retain a minimal record that you opted out, solely to ensure we continue to honor your request.

---

## 10. International transfers

8x is based in the United States, and several of our sub-processors are in the United States (see Section 8). This means your personal data is **transferred to, and processed in, the United States** and potentially other countries.

We rely on the following transfer mechanisms:

- **Brazil → US:** the **ANPD Standard Contractual Clauses** (Resolution CD/ANPD 19/2024), which 8x is putting in place with its US recipients.
- **EU/UK → US** _(EU/UK is in scope — see Section 11):_ the EU **Standard Contractual Clauses (Module 2)** plus a documented **Transfer Impact Assessment (TIA)**. We default to SCCs + TIA; the EU-US Data Privacy Framework is treated as **unstable** pending the _Latombe_ appeal and is not relied on alone.
- **Mexico → US:** transfers to US sub-processors are disclosed in this aviso under Art. 35.
- **India → US:** transfers are subject to DPDP transfer requirements. The lawful-basis position for India cold outreach is addressed separately in Section 12.

You may request information about the safeguards applicable to transfers of your data by contacting us per Section 2.

---

## 11. EU / UK prospects

**EU/UK IS in scope — GDPR and the ePrivacy Directive apply.** 8x accepts the extraterritorial reach of GDPR Art. 3(2); there is no EU-exclusion gate. The following obligations are **in force**:

- **Marketing basis:** electronic and automated direct marketing requires **prior consent** under ePrivacy Directive Art. 13 (lex specialis); a legitimate-interest assessment does **not** clear marketing email or automated/recorded calls.
- **Representative:** where required, 8x will make an **Art. 27 EU representative** (and a **UK representative** if the UK is in scope) available; you can reach our privacy contact at privacy@8x.social.
- **Transfers:** SCCs Module 2 + a documented TIA (see Section 10); the EU-US Data Privacy Framework is treated as unstable pending the _Latombe_ appeal, so 8x defaults to SCCs + TIA.
- **DPIA:** a Data Protection Impact Assessment is **required** (multiple high-risk criteria stack: cold outreach, voice recording, AI evaluation, profiling).
- **Automated decisions:** Art. 22 grants you rights to human intervention, to contest the decision, and to meaningful information about the logic involved (see Section 7).

---

## 12. India prospects (DPDP Act 2023 + DPDP Rules 2025) — itemized notice

> ⚠️ **INDIA NOTICE.** Under the DPDP Act 2023 and the DPDP Rules 2025 (notified 13 Nov 2025; substantive obligations phasing to approximately 13 May 2027), there is **no "legitimate interest" basis for cold outreach in India**, and consent is generally required. **This notice is not a substitute for consent.** 8x is aligning its India (+91) outreach to a consent-first approach, honors all opt-out and do-not-contact requests, and treats India activity as subject to Indian-counsel review before scaling. The itemized notice below is provided for transparency.

**Itemized DPDP notice:**

- **Data Fiduciary:** 8x Social, Inc., a Delaware corporation (Section 1).
- **Personal data processed:** the categories in Section 4.
- **Purposes:** the purposes in Section 5.
- **How to exercise your rights:** access, correction, completion, updating, erasure, grievance redressal, and nomination — contact our Privacy Team / privacy@8x.social (Section 2).
- **How to withdraw consent:** you can withdraw consent at any time — as easily as it was given — by contacting privacy@8x.social or using the opt-out routes in Section 9.
- **How to complain:** to the **Data Protection Board of India** (Section 13), in addition to our grievance contact.
- **Telemarketing:** any telephone outreach is also subject to **TRAI TCCCPR Second Amendment Regulations 2025** (140-series promotional / 1600-series transactional numbering).

---

## 13. Your rights and how to complain

Subject to your local law, you have rights to:

- **Access** the personal data we hold about you (and information about its source — Section 3);
- **Correct / complete / update** inaccurate or incomplete data;
- **Delete / erase** your data;
- **Object** to processing, including the **unconditional right to object to direct marketing** (Section 9);
- **Object to / request human review of automated decisions** (Section 7);
- **Data portability**, where applicable;
- **Withdraw consent**, where processing is based on consent (e.g., India);
- **Information about international transfers** (Section 10);
- (Brazil/LGPD) other rights under Art. 18.

**How to exercise:** contact us per Section 2. **Response times:** Brazil — within **15 days** (LGPD Art. 19); other jurisdictions — within the statutory period, and otherwise without undue delay.

**Supervisory authorities / regulators — you may complain to:**

- **Brazil:** _Autoridade Nacional de Proteção de Dados_ (**ANPD**).
- **Mexico:** the **Secretaría Anticorrupción y Buen Gobierno** (data-protection enforcement following the abolition of INAI); and **PROFECO** for consumer/telemarketing (REPEP) matters.
- **India:** the **Data Protection Board of India**.
- **EU/UK** _(in scope):_ your national data protection authority / the UK ICO.
- **United States:** the relevant state Attorney General and/or the California Privacy Protection Agency, as applicable.

---

## 14. Data retention

We keep personal data only as long as needed for the purposes above, then delete or anonymize it. Our retention windows:

| Data                                                | Retention                                                                                                                                                             |
| --------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Cold-call audio recordings**                      | Purged at approximately **90 days**.                                                                                                                                  |
| **Live transcript segments**                        | Retained **12 months**, then purged.                                                                                                                                  |
| **Uploaded call records and metadata** (real_calls) | Retained **12 months**, then purged.                                                                                                                                  |
| **Post-call AI transcript and AI assessments**      | Retained only as long as needed for evaluation, dispute resolution, and our legal, tax, and accounting obligations, then deleted or anonymized on a defined schedule. |
| **Suppression / opt-out records**                   | Retained as long as needed to honor your opt-out.                                                                                                                     |
| **Compliance / dispute records**                    | Retained as required by law.                                                                                                                                          |

---

## 15. Cookies and tracking (website)

Our website uses first-party essential and functional cookies (e.g., authentication session, display-locale preference, and limited internal-tooling cookies), and — **only if you accept** through our cookie banner — analytics (PostHog product analytics and Google Analytics). We do **not** use advertising or cross-site marketing trackers. For full detail, see **cookie-notice.md**.

---

## 16. Changes to this notice

We may update this notice. The current version and its date appear at the top. Material changes will be reflected at the published URL (Section 0).

---

_Cross-references: see **sub-processors.md** (recipients and regions), **internal-compliance-artifacts.md** (Brazil/EU LI basis + roles & contacts roster), **cookie-notice.md** (cookies), and **call-recording-disclosures.md** (the call-disclosure scripts that link to this notice)._

<!-- https://8x.sale/legal/acceptable-use -->

# 8x Acceptable Use Policy — Rep Cold-Outreach Conduct

Last updated: June 2026

---

## 1. Purpose and binding effect

This Acceptable Use Policy ("AUP" or "Policy") governs how every person engaged by 8x Social, Inc., a Delaware corporation ("8x", "we", "us") to make outbound sales contact ("you", "Rep") may use the 8x platform, its dialer, and any data made available through it. The platform recruits and trains sales reps, who are engaged as **independent contractors** (not employees) prior to promotion, to place **real outbound cold calls and outreach to real business prospects** and earn performance-based pay (booking, AI-qualified meeting, and closed-deal milestones).

This Policy is **contractually binding**. By using the 8x dialer, accepting leads, or placing any outreach through 8x, you agree to this Policy as a condition of your engagement and of any pay. It is incorporated by reference into your independent-contractor agreement, the 8x Terms of Service (see terms-of-service.md), and is read together with the 8x privacy notices (see privacy-notice-reps.md and privacy-notice-prospects.md) and the recording-disclosure scripts (see call-recording-disclosures.md).

This Policy exists for two reasons:

1. **Legal compliance.** 8x is the data **controller** for both Rep data and prospect data, and 8x relies (outside India) on a documented **legitimate-interest** basis for B2B prospecting (see the legitimate-interest assessment in internal-compliance-artifacts.md). That basis, and 8x's anti-spam / Do-Not-Call ("DNC") / TCPA posture, only hold if Reps actually behave as described here. Your conduct is therefore the operational backstop for 8x's lawful basis.
2. **Trust and brand.** Prospects are real third parties who **did not ask to be contacted**. How you treat them is how 8x is judged.

Failure to follow this Policy can void 8x's compliance posture and exposes both you and 8x to legal liability. Breach has consequences for you, up to and including removal and forfeiture of disputed pay (Section 12).

## 2. Who and what this covers

- **Who:** every Rep (applicant, audition-passed cold caller, and promoted closer), regardless of country, who places calls or sends outreach through 8x.
- **What:** all outbound voice calls placed through the 8x/Twilio dialer; all outreach email sent through or on behalf of 8x; all notes, dispositions, and uploaded data; and any handling of prospect personal data accessed through the platform.
- **Where:** the United States and the markets 8x serves — **Brazil, Mexico, and India** — plus any other country a lead originates from. Region-specific rules appear in Section 11. **Where regional rules conflict, the stricter rule applies.**

> **EU/UK IS in scope — GDPR and the ePrivacy Directive apply.** 8x accepts EU scope (there is no EU-exclusion gate). EU/UK prospects bring GDPR and ePrivacy prior-consent rules into scope: electronic/automated direct marketing to EU prospects requires **prior consent** under ePrivacy Art. 13 (a legitimate-interest assessment does not clear it), and the EU-facing obligations (Art. 27 EU representative, SCCs Module 2 + TIA for US transfers, DPIA, Art. 22 automated-decision rights) are in force (see privacy-notice-prospects.md and the DPIA in internal-compliance-artifacts.md).

---

## 3. Core conduct rules (apply everywhere)

You **must**:

1. **Identify yourself truthfully.** State, at minimum, your name, that you are calling on behalf of 8x (and the client or campaign you are representing, as 8x directs), and the purpose of the call. Never disguise, spoof, or misrepresent who is calling or why.
2. **Use the approved recording-disclosure script** before recording or as the script directs (Section 6).
3. **Honor every objection and opt-out immediately** (Section 5).
4. **Respect calling-hours limits** for the prospect's location (Section 4).
5. **Only contact numbers and people you are permitted to contact** — i.e., not on any applicable DNC or suppression list (Section 4).
6. **Only upload or enter data you have the right to use** (Section 7).
7. **Record your call outcome (disposition) accurately and honestly** — including objections, opt-outs, wrong-number, and do-not-call requests — because suppression and compliance depend on it.

You **must not**:

1. **Make any material misrepresentation** about 8x, the client, the product, pricing, your identity, affiliation, or the reason for the call. Material misrepresentations are independently unlawful even where the call is otherwise exempt from telemarketing rules (US: 16 CFR 310.3(a)(2) and 310.3(a)(4)). This is the conduct 8x's AI conduct-flag system is built to catch (Section 8).
2. **Harass, threaten, intimidate, abuse, or repeatedly call** a prospect who has asked you to stop, or use profane/abusive language.
3. **Re-dial or re-contact a prospect after they object or opt out** (Section 5).
4. **Record a call where recording is prohibited** or where you have not given the required disclosure (Section 6).
5. **Use the dialer for anything other than the assigned campaign** — no personal calls, no calls to numbers you sourced outside 8x, no list 8x did not provide.
6. **Attempt to evade, disable, or "game"** recording, transcription, evaluation, suppression, or rate-limiting controls.
7. **Share, export, sell, or repurpose prospect data** for any purpose outside the assigned 8x campaign.

---

## 4. Who and when you may call: DNC, suppression lists, and calling hours

### 4.1 Suppression is mandatory — never call a suppressed number

You may **only** call numbers 8x serves to you through the dialer, and **only** if they have not been suppressed. You must not call a number that appears on any of the following, and you must not work around the platform to reach a suppressed contact:

- **Any applicable national / regulatory Do-Not-Call or do-not-disturb registry** for the prospect's country (Section 11): US DNC framework; Brazil state **Procon "Não Me Ligue"** registries; Mexico **REPEP**; India **TRAI / DND** under TCCCPR.
- **8x's company-internal suppression list** — every number ever flagged as do-not-call, opt-out, objection, wrong number, or litigation/complaint risk. This list is **permanent** and is honored across all campaigns.
- **Any client-provided suppression / exclusion list.**

If the dialer ever presents a number you have independent reason to believe is suppressed, on a registry, or wrong, **stop and report it** rather than calling.

> Registry scrubbing is primarily an **8x platform** obligation: 8x scrubs against national registries and maintains the internal suppression list before serving numbers. This Policy binds the Rep not to defeat that control and to feed it accurate dispositions.

### 4.2 B2B vs. residential/cell — why you must honor DNC everywhere

Genuine business-to-business calls to real business lines are exempt from most US Telemarketing Sales Rule requirements (16 CFR 310.6(b)(7)) **except** the material-misrepresentation prohibitions. **But that carve-out is narrow and unreliable in practice:**

- If a number you call is actually a **residential or cell** line, internal-DNC and calling-hours rules become **mandatory**, not best practice. You often cannot tell from the record, so 8x treats DNC discipline and calling-hours as mandatory on every call.
- **India, Brazil, and Mexico have no B2B carve-out.** DNC/opt-out and consent rules apply regardless of whether the line is "business."

**Policy:** honor DNC, suppression, and opt-out **on every call, in every country, with no exception** for "it's a business line."

### 4.3 Calling hours

Place calls only within the permitted local calling window for the **prospect's** location, using the prospect's local time (the platform should surface this; if it does not, do not call outside a conservative window).

> 8x's default calling window is **local 9:00–18:00 on business days only**, no weekends or holidays. The US telemarketing baseline is 8:00–21:00 local; 8x's tighter business-hours default is intentional for B2B and to stay clear of residential rules. Tighter per-country windows (BR, MX, IN) may apply and are enforced through the dialer.

---

## 5. Objections and opt-outs — immediate, permanent suppression

This is the single most important rule in this Policy.

The moment a prospect indicates — **in any words, in any language, by any clear signal** — that they do not want to be contacted, do not want this product, want to be removed, or ask you to stop calling, you must:

1. **Stop the pitch immediately.** Do not argue, re-pitch, or try to "handle" a removal request as an objection to overcome.
2. **Acknowledge and confirm** you will remove them (use the approved opt-out wording — see call-recording-disclosures.md / opt-out-wording).
3. **End the call** unless they want something further.
4. **Mark the disposition as opt-out / do-not-call** so the number is added to 8x's permanent internal suppression list.
5. **Never re-dial or re-contact that prospect again** — not on this campaign, not on another, not by phone, not by email. Suppression is permanent and cross-channel.

This applies to **email opt-outs** as well: an unsubscribe or "stop emailing me" must be honored, and must be honored within **10 business days** at the latest for US CAN-SPAM, but 8x's standard is **immediate** suppression (Section 9).

There is **no quota exception** to the opt-out rule. Continuing to contact someone after an opt-out is a serious breach (Section 12) and is independently unlawful in every market 8x serves.

---

## 6. Call recording and disclosure

Calls placed through 8x are **recorded** and then **AI-transcribed and AI-evaluated** (the evaluation can affect your pay — see Section 8 and the Privacy Policy). Because of this:

1. **You must use the approved recording-disclosure script** (see call-recording-disclosures.md) at the point it directs, before the substance of the call. Do not improvise, shorten, or skip it.
2. **You must obtain the consent the script calls for.** 8x's standard posture is **all-party (two-party) consent** as the safe baseline, because several US states require it (California Penal Code §§ 632 and 632.7 covering cellular/cordless calls; and roughly eleven to twelve all-party-consent states including CA, FL, PA, IL, WA, MD, MA, MT, NH, CT, and DE — each with its own nuances) and because the markets 8x serves expect clear notice. **Express verbal consent to recording is the conservative requirement.**
3. **If a prospect refuses to be recorded,** you must not proceed to record: end the call politely and disposition it as "declined recording." Because the AI evaluation that drives pay depends on a recording, there is no non-recorded call path.
4. **Never record where recording is prohibited** by the prospect's jurisdiction or by an explicit refusal.

> Note for counsel: do **not** rely on any claim that an audible recording "beep" alone is or is not valid consent — that question was left open on remand in _Smith v. LoanMe_ and must not be asserted as settled. The approved script is built around **express verbal consent**, which is the conservative posture.

---

## 7. Data you may upload, enter, or access

You may only put data into 8x that you have the right to use for this purpose, and you may only use prospect data for the assigned 8x campaign.

You **must not**:

- Upload, paste, or enter personal data about any person that you obtained without a lawful right to use it for outreach (e.g., scraped lists, purchased lists 8x did not approve, contacts from a prior employer, or data covered by a confidentiality obligation).
- Enter **special-category / sensitive** personal data into notes or any field — including health, race, religion, sexual orientation, political views, biometric identifiers, or financial-account data. Free-text notes are for **business-relevant** observations only. (Note: a plain voice recording is ordinary personal data, but **voice-biometric identification is sensitive data and is prohibited** — 8x does not build or use it, and you must not attempt to.)
- Enter data about anyone other than the business prospect relevant to the campaign.
- Export, copy, screenshot, or transmit prospect data outside the platform.

Keep free-text notes **accurate, professional, and minimal.** Notes are personal data, are retained, and may be disclosed to the prospect on a data-subject request.

---

## 8. AI evaluation, conduct flags, and your pay

Calls are transcribed and **evaluated by an automated AI system** against a defined rubric, and that evaluation determines whether a meeting is "qualified" and therefore whether you are paid (booking $15 / AI-qualified meeting $50 / closed deal $250 — see your contractor agreement and the Privacy Policy for how this automated decision-making works and your rights regarding it).

The same system raises **conduct flags** for behavior this Policy prohibits — for example, signs of **material misrepresentation**, harassment, missing recording disclosure, ignoring an objection, or contacting a suppressed number. Conduct flags are reviewed by a human.

- An automated qualification/pay decision is subject to **human review on request** — you may contest any pay-affecting evaluation and have it reviewed by a person (see privacy-notice-reps.md, "Automated decisions about you", and the automated-decisions / contest procedure in internal-compliance-artifacts.md).
- A **conduct flag** is a compliance matter and is handled under Section 12. Conduct flags are not about your sales skill; they are about whether you followed the rules in this Policy.

You must not attempt to manipulate, evade, or "game" the recording, transcription, evaluation, or flagging systems. Doing so is itself a breach.

---

## 9. Email and other outreach

If you send outreach email through or on behalf of 8x:

- **Header and sender information must be accurate** — no false or misleading "from", "to", routing, or subject lines (US CAN-SPAM).
- Each message must include a **valid physical postal address** (1111B S Governors Ave STE 47647, Dover, DE 19904, United States) and a **working opt-out mechanism**.
- **Honor opt-outs promptly** — within 10 business days at the absolute latest under US CAN-SPAM, but 8x's standard is **immediate** suppression across phone and email.
- Identify the message's commercial nature truthfully; no deceptive subject lines.
- In **India, Brazil, and Mexico**, email/electronic outreach is additionally governed by the regional rules in Section 11 (e.g., India requires consent; do not treat email as exempt).

> 8x sends **all** outreach email centrally through the platform (Resend) from a single 8x-controlled address (`The 8x Team <outreach@send.8x.sale>`). Reps compose and send through the 8x composer; they do **not** send freehand email from their own mailboxes. Because 8x is the sender, the CAN-SPAM obligations above (accurate From/sender information, a valid physical postal address, and a working one-click opt-out) are **implemented at the platform level** — every outbound message carries the CAN-SPAM footer and `List-Unsubscribe` header, and an unsubscribe writes a permanent suppression that is honored on every subsequent send. (See sub-processors.md for the email processor; see privacy-notice-prospects.md § 9 for the prospect-facing opt-out/suppression mechanism.)

---

## 10. [Reserved]

_[Placeholder retained so section numbering stays stable across counsel revisions; regional rules follow in Section 11.]_

---

## 11. Region-specific rules

These rules are **in addition to** Sections 3–9. Where a regional rule is stricter, it controls. The country is determined by the **prospect's** location.

### 11.1 United States

- **Telemarketing Sales Rule (TSR):** genuine B2B calls are exempt from most of the TSR (16 CFR 310.6(b)(7)) **except** the material-misrepresentation prohibitions (310.3(a)(2) and (a)(4)), which **always** apply — no false or misleading statements about any material fact. If a called number is actually residential or cell, full DNC and calling-hours rules apply.
- **DNC:** honor the US Do-Not-Call framework and 8x's internal DNC/suppression list. Treat internal DNC and calling-hours as mandatory on every call.
- **TCPA / robocall framework:** the platform's posture is built on **prior express consent** for any autodialed or prerecorded contact and on the DNC/robocall rules. Do not rely on any "one-to-one consent" rule — it was vacated by the Eleventh Circuit in January 2025 and must not be asserted.
- **Recording:** all-party consent baseline; California §§ 632 / 632.7 and other all-party states (Section 6).
- **Email:** CAN-SPAM (Section 9).

### 11.2 Brazil

- **Lawful basis:** B2B prospecting relies on **legitimate interest** (LGPD Art. 7 IX / Art. 10) supported by a documented **Legitimate Interest Assessment** (see the LIA in internal-compliance-artifacts.md). Your conduct must keep the call within the scope of that assessment — minimal, relevant, respectful, and immediately stopped on objection.
- **Consumer Code (CDC):** clearly **identify the sender** and **honor opt-outs**.
- **Do-not-call:** scrub and honor **state Procon "Não Me Ligue"** registries (e.g., São Paulo Law 13.226/2008 as amended). _(Do not reference Anatel "Não Me Perturbe" — that regime is telecom/financial-sector-specific and does not apply to 8x.)_
- **Data-subject requests:** prospects can exercise rights; LGPD requires a response within **15 days** — route any request you receive to 8x immediately (see privacy-notice-prospects.md).
- **No sensitive data** may ride on legitimate interest (LGPD Art. 11). Keep to ordinary business data (Section 7).

### 11.3 Mexico

- A Spanish-language **aviso de privacidad** must be available to prospects (8x publishes this — see privacy-notice-prospects.md / aviso-de-privacidad). Direct the prospect there if asked.
- **Do-not-call:** scrub and honor **REPEP** (Registro Público para Evitar Publicidad) under the consumer-protection law (LFPC, Art. 18 Bis); PROFECO enforces, with fines up to approximately MX$2.24M (Art. 127). Suppress REPEP-registered contacts and apply at least a **30-day suppression** window.
- **Automated decisions:** under Mexico's new data-protection law (in force 21 March 2025), a data subject may object to solely-automated processing producing "undesired effects" that evaluates behavior or performance — relevant to 8x's Rep evaluation, less to prospects, but flagged.
- Honor objections/opt-outs as in Section 5. (Ordinary-data consent is tacit/opt-out by default; honor all opt-outs regardless.)

### 11.4 India

India's DPDP Act 2023 and DPDP Rules 2025 (notified 13 November 2025; substantive obligations phasing toward ~13 May 2027) are materially different from the other markets:

- **There is no legitimate-interest basis for cold outreach.** Consent is required, and you generally **cannot even cold-contact a person to obtain that consent.**
- A DPDP-itemized **notice is not a substitute for consent.**
- Penalties reach up to **₹250 crore** for the security-safeguards tier.

8x is aligning its India (+91) outreach to a consent-first approach and treats India activity as subject to Indian-counsel review before scaling. While outreach continues:

- **You must still honor every opt-out and do-not-call request from +91 / India prospects immediately and permanently** (Section 5), and deliver the India recording disclosure (see call-recording-disclosures.md).
- **Telemarketing format rules:** TRAI TCCCPR Second Amendment Regulations 2025 require use of the correct numbering series — **140-series for promotional** and **1600-series for transactional** calls — and honoring DND. The platform must place India calls only from compliant numbering; do not attempt India outreach from non-compliant numbers.

---

## 12. Consequences of breach

Compliance is a condition of your engagement and of your pay. 8x enforces this Policy through a graduated process, but reserves the right to escalate immediately for serious breaches.

**Graduated enforcement (default):**

1. **Warning** — for a first or minor breach (e.g., an isolated missed disclosure caught by review). Includes corrective guidance.
2. **Suspension** — temporary loss of dialer/lead access for repeated or more serious breaches, pending review.
3. **Removal** — termination of your engagement for serious or repeated breaches.

**Immediate suspension or removal** (no warning step) may apply to serious breaches, including:

- Contacting a prospect **after an opt-out / do-not-call request**, or calling a **suppressed or registry-listed** number.
- **Material misrepresentation** about identity, affiliation, product, or price.
- **Harassment, abuse, or threats.**
- **Recording where prohibited** or without the required disclosure.
- **Uploading data you had no right to use**, or entering prohibited sensitive data.
- Attempting to **evade or game** recording/transcription/evaluation/suppression controls.
- Contacting **India (+91)** prospects in violation of the India rules in Section 11.4 (e.g., ignoring an India opt-out/DND, or dialing from non-compliant TRAI numbering).

**Pay consequences.** Pay is earned only for outreach conducted in compliance with this Policy. Pay tied to a call or meeting obtained through a breach of this Policy (for example, a "qualified meeting" secured by misrepresentation, or contact made after an opt-out) may be **withheld, reversed, or forfeited.** This is separate from, and does not limit, the human-review/contest right you have for **automated evaluation** of legitimately conducted calls (Section 8).

**Process and fairness.** 8x's default process is written notice of the alleged breach, an opportunity to respond before removal except in egregious cases, and a single internal appeal, read together with the termination terms of the Independent Contractor Agreement.

Nothing in this Section limits 8x's other rights or remedies, or any obligation 8x has to suppress, report, or cooperate with regulators.

---

## 13. Changes to this Policy

8x may update this Policy as law, processors, or operations change. Material changes will be notified to Reps by email or in-Platform notice, with re-acceptance required where the change is material. Continued use of the dialer after the effective date of a change constitutes acceptance. The current version and effective date appear at the top of this document.

---

## 14. Questions and reporting

If you are unsure whether something is allowed, **ask before you act.** If a prospect raises a privacy request, an opt-out you cannot complete, a complaint, or a legal threat, **report it to 8x immediately** so 8x can respond within the applicable deadlines.

- Compliance / conduct questions: legal@8x.social
- Privacy matters: privacy@8x.social

---

### Cross-references

- privacy-notice-reps.md / privacy-notice-prospects.md — controller disclosures, data-subject rights, automated decision-making, retention (rep and prospect notices)
- call-recording-disclosures.md — approved recording disclosure and opt-out wording
- sub-processors.md — recipients of personal data (Twilio, OpenAI, Anthropic, Supabase, Vercel, Resend, Cal.com, LinkedIn-intended)
- internal-compliance-artifacts.md — legitimate-interest assessment (Brazil / US B2B basis), DNC/suppression policy (registry scrubbing + internal suppression list), and the human-review/contest process for automated evaluations
- terms-of-service.md — platform terms this Policy is incorporated into

<!-- https://8x.sale/legal/cookies -->

# Cookie Notice

Last updated: July 2026

---

## 1. About this notice

This Cookie Notice explains how 8x Social, Inc., a Delaware corporation ("**8x**," "**we**," "**us**") uses cookies and similar browser-storage technologies on the 8x web platform (the "**Platform**"). It supplements, and should be read together with, our rep & applicant privacy notice (see privacy-notice-reps.md).

**Scope of users.** The Platform is used by sales representatives engaged as independent contractors and by applicants who sign up to be considered as such. This notice addresses the cookies set in those users' browsers when they access the Platform. It does **not** address prospects' personal data (prospects do not visit the Platform); for how 8x handles prospect personal data, see privacy-notice-prospects.md and the cold-call disclosure (see call-recording-disclosures.md).

**Summary.** 8x uses first-party cookies that are **strictly necessary or functional** to run the Platform. Analytics — our product analytics (**PostHog**) and **Google Analytics** — load **only if you accept** them through our cookie banner. If you decline, or have not yet chosen, no analytics cookies are set; if you decline, PostHog keeps only a privacy-preserving, non-identifying count (no cookies, no device storage). We do **not** use advertising, retargeting, or cross-site marketing trackers. You can change your choice at any time (see Section 6).

**Controller and contact.** The controller responsible for the personal data processed via these cookies is 8x Social, Inc., a Delaware corporation, 1111B S Governors Ave STE 47647, Dover, DE 19904, United States. For privacy questions, contact our Privacy Team at privacy@8x.social.

---

## 2. What cookies are

A cookie is a small text file stored in your browser when you visit a website. Cookies can be:

- **First-party** (set by the site you are visiting — here, the 8x Platform) or **third-party** (set by another domain). **8x's own cookies are first-party.** If you accept analytics, **Google Analytics** additionally sets cookies associated with Google as a third party.
- **Session** (deleted when you close your browser) or **persistent** (stored until they expire or you delete them).
- **Strictly necessary / essential** (required for the site to function and for you to log in securely), **functional** (remember your preferences or context), **analytics** (measure usage), or **advertising** (track you for marketing). **8x uses strictly-necessary and functional cookies always, and analytics (PostHog product analytics and Google Analytics) only with your consent. We use no advertising cookies.**

Some of the values below use the [`__Host-` prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#__host-). This is a security hardening measure: a `__Host-`-prefixed cookie is sent only over HTTPS, scoped to the exact origin that set it, and cannot be set or overwritten by subdomains. It does not make the cookie a tracker.

---

## 3. Cookies we use

The essential and functional cookies below are **first-party**, set by the 8x Platform itself. Analytics — **PostHog** product analytics and **Google Analytics** — load **only after you accept** through the cookie banner. We set no advertising or cross-site marketing cookies.

| Cookie                                     | Category                                            | Purpose                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | Set by                                                                 | Duration                                                           |
| ------------------------------------------ | --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------- | ------------------------------------------------------------------ |
| Supabase authentication session cookies    | Strictly necessary (essential)                      | Keep you securely logged in. These cookies carry your authenticated session so the Platform knows who you are on each request and can enforce access controls. Without them you cannot sign in or use the Platform.                                                                                                                                                                                                                                                                        | 8x (via our authentication provider, Supabase — see sub-processors.md) | Session / the lifetime of your authenticated session               |
| `__Host-8x_view_as_rep`                    | Functional / essential to an administrative feature | Records that an authorized 8x administrator is using the "view as rep" impersonation tool to see the Platform as a particular representative would. It is set only when an admin activates that feature and governs which view is rendered. It is not a tracking or profiling cookie.                                                                                                                                                                                                      | 8x                                                                     | Session / cleared when impersonation ends                          |
| `__Host-displayLocale`                     | Functional                                          | Remembers your selected display language / locale preference (i18n) so the interface renders in your chosen language across visits.                                                                                                                                                                                                                                                                                                                                                        | 8x                                                                     | Persistent (until you clear it or change your language preference) |
| `__Host-li_oauth_state`                    | Strictly necessary (security) — **NOT ACTIVE**      | A CSRF anti-forgery state value reserved for LinkedIn OAuth/OIDC sign-in. **This flow is not live.** LinkedIn OAuth is currently a non-functional stub (it returns an HTTP 501 and does not run), so this cookie is **not set in normal use today.** It is documented here for transparency and will become active only if and when LinkedIn sign-in is enabled, at which point it will be set transiently during the sign-in handshake and discarded immediately afterward.               | 8x                                                                     | Transient (during a sign-in handshake) — not currently issued      |
| `8x-cookie-consent` (browser localStorage) | Strictly necessary (records your choice)            | Stores whether you accepted or rejected analytics cookies, so we do not ask again and analytics stays off unless you accepted. Clearing it re-shows the banner.                                                                                                                                                                                                                                                                                                                            | 8x                                                                     | Persistent (until you clear site data)                             |
| `ph_…_posthog`                             | Product analytics (first-party)                     | Set by PostHog, our product-analytics provider, to understand how the Platform is used so we can improve it. **Set only after you accept** through the cookie banner; if you decline, PostHog sets no cookies or storage and keeps only a privacy-preserving, non-identifying count. Session recording is configured for **maximum privacy** — all text and form inputs are masked, so names, emails, phone numbers, and lead data are not captured. Served first-party via the 8x origin. | 8x (via PostHog — see sub-processors.md)                               | Persistent (about 1 year) — only if you accept                     |
| `_ga`, `_ga_<stream-id>`                   | Analytics (**third-party — Google**)                | Google Analytics 4. Distinguishes visitors and sessions to measure site usage. **Set only after you accept** analytics via the cookie banner; if you decline or have not chosen, Google Analytics does not load and these cookies are never set.                                                                                                                                                                                                                                           | 8x (via Google — see sub-processors.md)                                | Persistent (up to 2 years)                                         |

The Supabase authentication session is implemented as first-party cookies on the 8x origin; no third-party Supabase-domain cookie is set in your browser.

---

## 4. Analytics and your consent

We use analytics to understand how the Platform is used so we can improve it, and we handle it as follows:

- **Google Analytics (third-party):** Loaded **only after you accept** through the cookie banner. Until you accept, the Google Analytics script is **not loaded at all** and sets no cookies (this is Google's "basic" consent mode). You can **decline as easily as you can accept**, and you can change your mind later (Section 6).
- **Product analytics (PostHog, first-party):** Loaded **only after you accept** through the same cookie banner. Until you accept, PostHog captures nothing and sets no cookies or storage. If you decline, PostHog keeps only a **privacy-preserving, non-identifying count** of visitors who declined (a server-side hash — no cookies, no device storage, no personal data). Event capture and session recording run only after you accept, and session recording is configured for maximum privacy (all text and form inputs are masked, so readable personal data is not captured).
- **No advertising, marketing, retargeting, or cross-site tracking technologies, social-media pixels, fingerprinting, or data-broker tags** are present.

**Jurisdiction-specific note.** Cookie/consent rules differ by market:

- **EU / UK (ePrivacy):** Storing or reading information on a user's device generally requires prior consent **except** for cookies that are strictly necessary to provide the service the user has requested. **EU/UK is in scope — GDPR and the ePrivacy Directive apply** (see privacy-notice-reps.md, "International transfers" / territorial scope). **Google Analytics and PostHog product analytics are therefore gated behind opt-in consent** and are not loaded or activated unless you accept (if you decline, PostHog keeps only a cookieless, non-identifying count). The functional cookies (locale preference, impersonation) are disclosed in this notice.
- **US (CCPA/CPRA):** We do **not** use cookies for the "sale" of personal information or for cross-context behavioral advertising. We maintain a CCPA-ready disclosure in privacy-notice-reps.md.
- **Brazil (LGPD), Mexico, India (DPDP):** Analytics is used as described above; we rely on this notice and, for Google Analytics and PostHog, on your opt-in consent, and address any additional local requirements through our broader privacy program.

---

## 5. Our commitment when analytics changes

Consistent with the commitment in earlier versions of this notice, when we introduced analytics (**Google Analytics**, and when we brought **PostHog** product analytics under the same banner) we, at deployment:

1. **Updated this Cookie Notice** to describe each service, its purpose, the recipients (Google and PostHog), and its duration; and
2. **Implemented a consent mechanism** — a cookie banner that loads analytics **only on acceptance**, with **reject offered as easily as accept**, and the ability to change your choice (Section 6).

For any future non-essential cookie or tracking technology, we will apply the same two steps before, or at the point at which, we rely on it, and honor opt-out preferences where opt-out is the applicable standard.

---

## 6. Managing cookies and your analytics choice

**Withdrawing or changing analytics consent.** To withdraw consent for analytics (Google Analytics and PostHog) after accepting (or to change an earlier choice), clear this site's stored data in your browser. That removes the `8x-cookie-consent` preference and re-shows the banner; analytics does not load again until you accept.

Essential and functional cookies are required for the Platform to work — in particular, blocking the authentication session cookies will prevent you from logging in.

You can control or delete cookies through your browser settings. Most browsers let you view stored cookies, delete them, and block cookies from specific sites. See your browser's help documentation (Chrome, Firefox, Safari, Edge) for instructions. Note that clearing cookies will sign you out, reset your saved locale preference, and reset your analytics choice.

---

_Cross-references: privacy-notice-reps.md · privacy-notice-prospects.md · sub-processors.md_

<!-- https://8x.sale/legal/sub-processors -->

# 8x Sub-processor List

Last updated: July 2026

---

## 1. About this list

This is the public, versioned list of third-party service providers ("sub-processors") that 8x Social, Inc., a Delaware corporation ("8x", "we") engages to help operate its platform. Each sub-processor receives or has access to personal data that 8x controls, and processes it only on 8x's documented instructions and under contract.

8x is the **controller** for all personal data described in its privacy notices — both the data of its sales representatives (independent contractors and applicants) and the data of the business prospects whom representatives contact. 8x does **not** act as a processor for any external business customer, and therefore does not currently owe a data processing agreement (DPA) to customers; the providers below are 8x's own sub-processors. See `privacy-notice-reps.md` (rep-facing) and `privacy-notice-prospects.md` (prospect-facing) for the underlying processing descriptions, and `dpa-and-transfer-register.md` / `internal-compliance-artifacts.md` for the internal record this table backs.

This list supports:

- the privacy notices, which reference it for the identity of recipients;
- the internal DPA register and Record of Processing Activities (RoPA); and
- 8x's cross-border transfer documentation (see Section 5).

The "Location" column states where the relevant processing/account is configured.

---

## 2. Current sub-processors

| #   | Sub-processor                     | Service / Purpose                                                                                                                                                                                                                                                              | Categories of personal data shared                                                                                                                                                                                                                                                                                                             | Location (processing / data residency)                                                                                                | Cross-border transfer mechanism (for non-US data subjects → US)                                                 |
| --- | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| 1   | **Twilio Inc.**                   | Outbound telephony for cold calls; carrier connectivity; call audio capture                                                                                                                                                                                                    | Prospect phone numbers; call audio (rep + prospect voice); call metadata (timestamps, duration, call status); caller ID / per-rep number                                                                                                                                                                                                       | United States                                                                                                                         | See Section 5.                                                                                                  |
| 2   | **OpenAI, L.L.C.**                | (a) Speech-to-text transcription of call audio (`whisper-1`); (b) AI evaluation of call transcripts (`gpt-4.1`) that drives meeting-qualification and rep pay                                                                                                                  | Call audio; AI-generated transcripts; rep identifiers tied to a call; prospect identifiers present in transcript content                                                                                                                                                                                                                       | United States. **Default API endpoints are in use; no zero-data-retention (ZDR) / enterprise tier has been elected** — see Section 4. | See Section 5.                                                                                                  |
| 3   | **Anthropic, PBC**                | AI evaluation and summarization of call transcripts (Claude models)                                                                                                                                                                                                            | AI-generated transcripts; rep identifiers tied to a call; prospect identifiers present in transcript content                                                                                                                                                                                                                                   | United States. **Default API endpoints are in use; no zero-data-retention / enterprise tier has been elected** — see Section 4.       | See Section 5.                                                                                                  |
| 4   | **Supabase, Inc.**                | Primary application database (Postgres), authentication, and file storage (Storage buckets) — the system of record                                                                                                                                                             | All categories of rep and prospect personal data, including: account credentials, names, contact details, country, CV files, training/performance records, payout data, IP addresses; prospect names, companies, emails, phone numbers, LinkedIn, firmographics, free-text rep notes; **voice recordings**, AI transcripts, and AI evaluations | United States (us-east-1)                                                                                                             | See Section 5.                                                                                                  |
| 5   | **Vercel Inc.**                   | Application hosting, serverless compute, edge/CDN delivery                                                                                                                                                                                                                     | IP addresses and request metadata in server/access logs; any personal data transiting requests to the application                                                                                                                                                                                                                              | United States / global edge network                                                                                                   | See Section 5.                                                                                                  |
| 6   | **Resend (Plus Five Five, Inc.)** | Transactional email and rep/prospect outreach email delivery                                                                                                                                                                                                                   | Rep email addresses and names; prospect email addresses, names, and any personal data contained in message content                                                                                                                                                                                                                             | United States                                                                                                                         | See Section 5.                                                                                                  |
| 7   | **Cal.com, Inc.**                 | Meeting scheduling for booked calls                                                                                                                                                                                                                                            | Prospect-entered scheduling data (name, email, chosen time, any notes); rep identifier for the host                                                                                                                                                                                                                                            | United States / EU (provider-configured)                                                                                              | See Section 5.                                                                                                  |
| 8   | **PostHog, Inc.**                 | Product analytics and privacy-masked session replay to improve the Platform — **consent-gated: activated only after the visitor accepts the cookie banner; if the visitor declines, only a privacy-preserving, non-identifying count is kept (no cookies, no device storage)** | Website-visitor / rep online identifiers, usage and event data, and **masked** session recordings (all text and form inputs masked — no readable names, emails, phone numbers, or lead data). No prospect personal data                                                                                                                        | **European Union — PostHog Cloud EU (`eu.posthog.com`)**; data residency in the EU                                                    | **EU-hosted; no transfer to the US for this processor.** For non-EU data subjects, data is processed in the EU. |
| 9   | **Google LLC** (Google Analytics) | Website analytics (Google Analytics 4) measuring site usage to improve the site — **consent-gated: loads only after the visitor accepts the cookie banner**                                                                                                                    | Website-visitor / rep online identifiers (GA client-id cookie, IP address — GA4 does not store the full IP), device/browser metadata, and page-interaction events. Visitor browsing data only — **no prospect personal data**                                                                                                                  | United States                                                                                                                         | See Section 5. (Google is EU-US Data Privacy Framework-certified; per Section 5, default to SCCs + TIA.)        |

---

## 3. Intended sub-processors (not yet live)

| #   | Sub-processor                                   | Service / Purpose                                                                                    | Categories of personal data shared                                           | Status                                                                                                                                                                                                                                                                                                |
| --- | ----------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 10  | **LinkedIn (LinkedIn Corporation / Microsoft)** | Identity verification of representatives via OAuth / OpenID Connect (OIDC) — verified profile fields | Rep-authorized LinkedIn OIDC fields (e.g. verified name, profile identifier) | **NOT YET LIVE.** The integration exists in schema only; the OAuth flow is a non-functional stub (returns HTTP 501) and is not enabled in production. Listed here for transparency. This list will be updated, and notice given (Section 6), before the integration goes live and any data is shared. |

---

## 4. AI provider data-retention posture

OpenAI (#2) and Anthropic (#3) are currently used through their **default API endpoints**, with **no zero-data-retention (ZDR) or enterprise tier elected**. Under default API terms these providers may retain submitted content for a limited period (e.g. for abuse monitoring) before deletion, per the provider's then-current policy.

Because the data sent to these providers includes **call audio and transcripts of real prospects**, 8x's default posture is to **elect a zero-data-retention / enterprise arrangement (and an EU/regional endpoint where offered)** to minimize provider-side retention and tighten the transfer posture. 8x is evaluating electing such an arrangement for OpenAI and Anthropic and will update this Section and the transfer documentation accordingly.

---

## 5. Cross-border transfers

All current sub-processors **except PostHog (#8, hosted in the EU)** process data in, or transfer data to, the United States. Personal data of prospects and representatives in **Brazil, Mexico, India, and the EU/UK** (EU/UK is in scope — see `dpa-and-transfer-register.md`) therefore flows from those jurisdictions to US-based processors, which engages cross-border transfer obligations:

- **Brazil (LGPD):** International transfers to US processors require **ANPD Standard Contractual Clauses** (Resolution CD/ANPD No. 19/2024). 8x is putting the ANPD Standard Contractual Clauses in place with its US sub-processors for these transfers.
- **Mexico (Federal Law on Protection of Personal Data Held by Private Parties, in force 21 March 2025):** Transfers to US sub-processors must be **disclosed in the Spanish `aviso de privacidad`** under Art. 35 (transfer disclosure is still required even though Art. 15's express enumeration changed). Contractual transfer safeguards with each recipient are recommended.
- **India (DPDP Act 2023 + DPDP Rules 2025):** Transfers are permitted except to countries restricted by the Central Government. Separately, under the DPDP Act cold outreach generally requires consent and a notice is not a substitute for consent; 8x is aligning its India outreach to a consent-first approach, honors all opt-out and do-not-contact requests, and treats India activity as subject to Indian-counsel review before scaling. See `privacy-notice-prospects.md` and `dpa-and-transfer-register.md`.
- **EU/UK (in scope):** **EU/UK IS in scope** — GDPR and the ePrivacy Directive apply (no EU-exclusion gate). Chapter V transfers to US sub-processors require **SCCs (Module 2) plus a documented Transfer Impact Assessment (TIA)**; treat the EU-US Data Privacy Framework as unstable (pending the _Latombe_ appeal) and default to SCCs + TIA. ePrivacy Art. 13 **prior consent** also applies to electronic/automated direct marketing to EU prospects (outreach email via Resend, automated calls). See `dpa-and-transfer-register.md`.

For each sub-processor above, 8x maintains the applicable provider DPA and transfer instrument (SCCs / regional equivalent) in the DPA register (`dpa-and-transfer-register.md`).

---

## 6. Changes to this list and advance notice

8x maintains this list as the authoritative, versioned record of its sub-processors. When 8x intends to **add a new sub-processor**, **change the purpose for which an existing one is used**, or **bring an intended sub-processor (Section 3) live**, 8x will:

1. update this list and increment the document version (Section header), and
2. provide **advance notice** of the change before the new processing begins.

8x will provide at least **30 days'** advance notice before the change takes effect, except where a faster change is required to maintain security or service continuity, in which case notice will be given as soon as reasonably practicable.

**Questions or updates:** to ask about this list or 8x's use of any sub-processor, or to request notice of changes, contact **our Privacy Team** at **privacy@8x.social**.

---

## 7. Document control

| Field              | Value                                                                                                                       |
| ------------------ | --------------------------------------------------------------------------------------------------------------------------- |
| Controller         | 8x Social, Inc., a Delaware corporation                                                                                     |
| Registered address | 1111B S Governors Ave STE 47647, Dover, DE 19904, United States                                                             |
| Privacy contact    | our Privacy Team, privacy@8x.social                                                                                         |
| Governing law      | Delaware, United States                                                                                                     |
| Version            | 1.0 — June 2026                                                                                                             |
| Related documents  | `privacy-notice-reps.md`, `privacy-notice-prospects.md`, `dpa-and-transfer-register.md`, `internal-compliance-artifacts.md` |

<!-- https://8x.sale/privacy -->

# Rep & Applicant Privacy Notice

Last updated: July 2026

---

## 0. Who this notice is for

This notice explains how **8x** handles the personal data of **applicants and sales representatives ("reps")** — the people who apply to and work in the 8x program. It is provided directly to you at the point we collect your data (Brazil LGPD Art. 9; EU/UK GDPR Art. 13), because we collect most of it from you.

This is a separate notice from the one that covers the **business prospects** our reps contact. If you make cold calls or send outreach as a rep, the data you collect _about prospects_ is governed by a different notice — see **privacy-notice-prospects.md** — and 8x, not you, is the controller of that data. You are acting on 8x's behalf when you generate it.

**The controller of your data is** 8x Social, Inc., a Delaware corporation ("8x", "we", "us"), with its registered address at 1111B S Governors Ave STE 47647, Dover, DE 19904, United States. Governing law for this notice is Delaware, United States. The United States is our home jurisdiction; we also serve markets in Brazil, Mexico, and India, and this notice is written to meet the data-protection requirements of those jurisdictions as well.

---

## 1. The most important things to know up front

- **We do not store your password.** When you sign up, your email and password are handled by our authentication provider, **Supabase Auth (GoTrue)**. 8x's own application database never receives or stores your password — not in plaintext and not as a hash that we control. Password verification happens inside Supabase Auth. (This corrects an earlier version of our privacy page that incorrectly described 8x as storing a hashed password.)
- **8x is a real cold-calling program, not just a simulator.** As a rep you will make **real telephone calls to real business prospects** over Twilio, and you may send real outreach emails. Those calls are **recorded** and **automatically transcribed and evaluated by AI**. Earlier copy that said "no real third party is ever a participant" was wrong and is superseded by this notice.
- **AI evaluation affects your pay.** An automated system scores your real calls. Those scores feed decisions about whether a call counts as a qualified meeting and therefore whether — and how much — you get paid. You have a right to human review of any pay-affecting evaluation (see Section 6).
- **You can contact a real person about your data.** See the Data Protection Officer / Encarregado contact in Section 9.

---

## 2. What data we collect about you

### 2.1 At sign-up

- **Account credentials** — email address and password. As noted above, the password is held by Supabase Auth (GoTrue); 8x's application stores **no** password value of any kind.

### 2.2 As you build a profile and progress

- **Identity & profile** — name, short bio, self-reported LinkedIn URL, country.
- **CV / résumé file** — if you upload one, stored as a file in Supabase Storage (private; access only via short-lived signed URLs to authorized admins).
- **Training & performance data** — your activity in onboarding, lessons, auditions, practice and mock calls; scores and progress; and the AI evaluations of your **real** cold calls (call audio, transcripts, and rubric-based assessments — see Section 2.3).
- **Payout & earnings data** — amounts you earn and the records needed to pay you (booking bonus on provided leads, AI-qualified-meeting payment — higher for prospects you source yourself, which carry no booking bonus — and closed-deal payment). Payouts are made through **Stripe**, our payment processor: the payment-account details you provide are held by Stripe, while 8x retains the earnings and payout records needed to pay you and to meet tax and accounting obligations.
- **Technical / security data** — your IP address, captured for rate-limiting and abuse prevention, and standard request-log data held by our hosting provider.

### 2.3 Data generated when you make real cold calls

When you call prospects through the platform:

- **Call audio** is recorded (Twilio, and an in-browser HD companion recording).
- **Transcripts** are produced by AI (OpenAI whisper-1) — both a live segment stream during the call and a more accurate post-call per-channel transcript.
- **AI evaluations** are produced by AI models (gpt-4.1, and Anthropic Claude for evaluation/summarization) that score the call against a rubric.

This data is _about your performance as a rep_ and is covered by this notice. The same recordings and transcripts also contain the **prospect's** personal data, which is additionally covered by **privacy-notice-prospects.md**.

### 2.4 LinkedIn fields — not currently active

Our system is designed to support verified LinkedIn sign-in (LinkedIn OIDC), which would let us receive verified fields such as your name, email, and LinkedIn profile identifier directly from LinkedIn. **This is not live.** The integration is a stub today and we do **not** currently receive any verified data from LinkedIn. If we turn it on, we will update this notice before doing so. Any LinkedIn URL we hold now is the one you typed yourself, not a verified value.

---

## 3. Where the data is collected from

- **From you** — everything you type, upload, or generate by using the platform.
- **From your use of the service** — performance data, AI evaluations, IP address, and session/log data generated automatically as you use it.
- **From LinkedIn** — only if and when LinkedIn OIDC is activated (see Section 2.4). Not active today.

---

## 4. Why we use your data and our lawful basis

You participate in the 8x program as an **independent contractor** (not an employee, at least before any promotion). We process your data on the following bases.

| Purpose                                                                                                | Lawful basis (LGPD)                                                             | Lawful basis (GDPR — EU/UK in scope)                              |
| ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------- | ----------------------------------------------------------------- |
| Create and operate your account; deliver training; let you make calls; calculate and make your payouts | Execution of a contract / pre-contractual steps at your request (LGPD Art. 7 V) | Performance of a contract (Art. 6(1)(b))                          |
| Evaluate your real calls to determine eligibility, call validity, qualified meetings, and pay          | Execution of the contract (Art. 7 V); see Section 6 on automated decisions      | Performance of a contract (Art. 6(1)(b)); see Section 6 / Art. 22 |
| Security, rate-limiting, abuse prevention (incl. IP)                                                   | Legitimate interest (Art. 7 IX), with a documented assessment                   | Legitimate interests (Art. 6(1)(f))                               |
| Comply with legal, tax, accounting, and recordkeeping obligations                                      | Compliance with a legal obligation (Art. 7 II)                                  | Legal obligation (Art. 6(1)(c))                                   |

Note: the lawful basis for processing **prospect** data is different (legitimate interest / business prospecting in Brazil, with the India-specific constraint that there is **no** legitimate-interest basis for cold outreach there). That analysis lives in **privacy-notice-prospects.md** and is not repeated here.

We do **not** intentionally collect sensitive personal data from you. A plain voice recording is ordinary data; we do **not** build or use voiceprint / biometric voice identification, which would be sensitive data under LGPD Art. 11. We do not use your CV/résumé to infer sensitive categories of data about you.

---

## 5. Who we share your data with (sub-processors)

We use third-party service providers ("sub-processors") to run the platform. Each receives only the data needed for its function. The current, authoritative list — including each provider's role, the data categories it receives, and its processing region — is maintained in **sub-processors.md**. In summary, the providers that may process **rep/applicant** data include:

- **Supabase** — database, authentication (your credentials), and file storage (CV, recordings). Region: United States (us-east-1).
- **Twilio** — telephony and call recording (US).
- **OpenAI** — whisper-1 transcription and gpt-4.1 evaluation of your calls (US); used through default API endpoints, with no zero-data-retention / enterprise tier elected (see sub-processors.md).
- **Anthropic** — Claude evaluation/summarization of transcripts (US).
- **Vercel** — hosting; your IP appears in request logs (US/global).
- **Resend** — transactional and outreach email; your email address (US).
- **Cal.com** — scheduling. Region: United States / EU (provider-configured).
- **LinkedIn** — OAuth/OIDC verified sign-in — **intended, not yet live** (see Section 2.4).

We do **not** sell your personal data, and we do not "share" it for cross-context behavioral advertising as those terms are used under US state privacy laws.

---

## 6. Automated decisions about you (this affects your pay)

**What is automated.** When you make a real cold call, the recording is transcribed by AI and then scored by an AI evaluator against a defined rubric. That score is used to decide:

- whether a call is **valid** (clean conduct),
- whether a call produced an **AI-qualified meeting**, and
- consequently whether you are **paid** (and at which tier — booking $15, AI-qualified meeting $50, closed deal $250).

So this is automated processing that can produce a significant effect on you (your earnings) and that evaluates your performance/behavior.

**The criteria.** The evaluation is based on a seven-dimension rubric — discovery (problem-first), objection handling, pricing discipline, proof specificity, next-step clarity, authenticity & listening, and tone & professionalism — together with conduct/anti-gaming flags (for example, an ignored objection, a missing recording disclosure, or a misrepresentation), applied to what you, the rep, controlled during the call.

**Your right to human review and to contest.** For **any** evaluation that affects your pay, you may request human review and contest the outcome. To do so, contact us at the address in Section 9 and identify the call. A person — not the automated system — will re-examine the call and the score, and you may provide your own explanation.

- Under **GDPR Art. 22** (if you are an EU/UK data subject), you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, including the rights to obtain human intervention, to express your point of view, and to contest the decision, together with meaningful information about the logic involved.
- Under **LGPD Art. 20** (as amended after 2019), you have the right to request review of decisions taken solely on the basis of automated processing that affect your interests, and to receive clear information about the criteria and procedures used. (LGPD Art. 20, as amended in 2019, currently does not expressly mandate a human reviewer, but this position is unsettled and ANPD guidance may evolve. Regardless, **8x commits to human review** of any pay-affecting evaluation.)

---

## 7. How long we keep your data

We retain data only as long as needed for the purpose it was collected, then delete it on a schedule. The current schedule is also documented in the retention schedule in **internal-compliance-artifacts.md**.

| Data                                                                                  | Retention                                                                                                                                                                                            |
| ------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Cold-call **audio** recordings                                                        | Purged at approximately **90 days** after the call (automated job).                                                                                                                                  |
| Live transcript **segments** (the streamed segments)                                  | **12 months**.                                                                                                                                                                                       |
| Uploaded **real_calls** records + their metadata                                      | **12 months**.                                                                                                                                                                                       |
| Post-call **accurate transcript** (the consolidated JSONB) and the **AI assessments** | Retained only as long as needed to evaluate your calls, resolve disputes, and meet our legal, tax, and accounting obligations, then deleted or anonymized on a defined schedule.                     |
| Account, profile, training, and payout records                                        | For as long as your relationship with 8x is active, plus any period required for legal, tax, and accounting obligations. You may request earlier deletion (Section 8), subject to those obligations. |
| Deletion audit rows                                                                   | Append-only audit records (containing no raw PII — e.g. a hash of the deleted identifier, reason, and actor) are retained to demonstrate that retention limits are honored.                          |

---

## 8. Your rights and how to exercise them

Depending on where you are, you have rights to **confirm** processing, **access** your data, **correct** it, **delete / anonymize** it, **port** it, **object** to or **restrict** certain processing, **withdraw consent** where processing is based on consent, and to obtain **review of automated decisions** (Section 6).

**How to exercise them.** Email the contact in Section 9. We may ask reasonable questions to verify your identity before acting.

**Timelines.**

- **Brazil (LGPD Art. 19):** we will respond to access requests within **15 days**. (This corrects an earlier "30 days" statement, which did not reflect LGPD Art. 19.)
- **EU/UK (GDPR Art. 12(3)):** we will respond within **one month**, extendable by up to two further months for complex or numerous requests, with notice to you.
- **United States / other jurisdictions:** we will respond within the period required by applicable law, or otherwise without undue delay. Where the CCPA/CPRA or other US state privacy laws apply, we honor the rights and timelines they require.

You also have the right to lodge a complaint with your local supervisory authority — in Brazil, the **ANPD**; in the EU/UK, your national data-protection authority; and in other jurisdictions, the competent regulator.

---

## 9. Data Protection Officer / Encarregado — contact

For any privacy request or question — access, correction, deletion, automated-decision review, or a complaint — contact our data-protection contact:

- **Role:** Data Protection / Privacy contact (Encarregado de Proteção de Dados)
- **Contact:** the 8x Privacy Team
- **Email:** privacy@8x.social
- **Postal:** 1111B S Governors Ave STE 47647, Dover, DE 19904, United States

We use a **role-based** address, not an individual's personal email. (This corrects an earlier version of our privacy page that listed a personal Gmail address as the DPO contact.) A documented assessment confirms that, given the nature, scope, and risk of our processing, an Encarregado is appointed for Brazil; the small-agent exemption is treated as **unavailable** here because the processing is high-risk.

---

## 10. International transfers

8x is based in the United States and most of our sub-processors are in the United States (see **sub-processors.md**). If you are in Brazil, Mexico, India, or the EU/UK (the EU/UK is in scope), your personal data is transferred to the United States and processed there.

We rely on the transfer mechanisms required by each jurisdiction:

- **Brazil → US:** ANPD International Data Transfer **Standard Contractual Clauses** (Resolution CD/ANPD 19/2024), which 8x is putting in place with its sub-processors.
- **EU/UK → US (EU/UK is in scope):** EU **Standard Contractual Clauses (Module 2)** plus a documented transfer impact assessment (TIA). We do not rely on the EU-US Data Privacy Framework alone — it is treated as unstable pending the _Latombe_ appeal, so we default to SCCs + TIA.
- **Mexico → US:** transfers to our US sub-processors are disclosed in the Spanish-language _aviso de privacidad_.

---

## 11. Cookies

The 8x site uses first-party essential and functional cookies, and — **only if you accept** through our cookie banner — analytics (PostHog product analytics and Google Analytics). We do **not** use advertising or cross-site tracking cookies. The essential and functional cookies are:

- **Supabase authentication session cookies** — essential, to keep you logged in.
- **`__Host-8x_view_as_rep`** — functional, used for admin "view as rep" impersonation.
- **`__Host` display-locale preference** — functional, remembers your chosen language.
- **`__Host li_oauth_state`** — a LinkedIn OAuth CSRF token — **not active** (LinkedIn sign-in is not live).

Full detail is in **cookie-notice.md**, including the consent-gated PostHog product analytics and Google Analytics. We set no advertising or cross-site marketing trackers.

---

## 12. Security

Structured data is stored in Supabase Postgres and uploaded files (CV, recordings) in Supabase Storage, encrypted at rest with platform-managed AES-256 keys. Files are private by default and accessed only via short-lived signed URLs issued to authorized admins. Your password is never received or stored by 8x; it is managed by Supabase Auth (Section 1). If a personal-data breach occurs, we will notify the competent supervisory authority and affected individuals as required by applicable law — in Brazil, the ANPD and affected data subjects within the timeframe set by ANPD Resolution 15/2024.

---

## 13. Changes to this notice

We may update this notice. When we make material changes — for example, activating LinkedIn sign-in or changing the AI evaluation that affects pay — we will update this notice and the version line below before the change takes effect.

---

## 14. Related documents

- **privacy-notice-prospects.md** — how 8x handles the data of the business prospects reps contact.
- **sub-processors.md** — full, authoritative list of third-party processors, roles, data categories, and regions.
- **internal-compliance-artifacts.md** — detailed retention schedule and deletion jobs (plus LIA, DPIA, RoPA, DNC policy, automated-decisions/contest procedure, roles & contacts roster).
- **cookie-notice.md** — full cookie detail.