Legal
Data processing agreement (DPA)
The German version is legally binding. This English version is provided for convenience.
Note: a few details (highlighted) are still being added.
This agreement under Art. 28 GDPR applies between you as a business user (controller) and us (processor) wherever Dex processes personal data for you. It becomes part of the contract when you accept our terms.
1. Subject, duration, nature and purpose
The subject is checking your website, writing and checking draft improvements, recording your decisions and, if connected, analysing your Google Search Console data. Processing lasts as long as the main contract.
2. Types of data and data subjects
- Data: content of your public pages (e.g. names, roles and contact details on team or contact pages), Search Console data, account data of your team members
- Data subjects: your staff and team members, people named on your website, your customers and prospects where identifiable in search data
3. Our obligations
- We process data only on your documented instructions, meaning within the functions of Dex and your settings.
- Everyone with access is bound to confidentiality.
- We apply the technical and organisational measures described on our Security page (Art. 32 GDPR).
- We help you with data subject requests and your obligations under Art. 32 to 36 GDPR.
- We notify you of personal data breaches without undue delay, at the latest within 48 hours of becoming aware.
- When the contract ends we delete your data within 30 days, or hand it over first if you ask, unless a retention duty applies.
- We give you all information needed to demonstrate these obligations and allow audits by prior arrangement.
4. Sub-processors
You agree to the use of these sub-processors:
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database (all account data, scans, drafts, decisions) | Stored in Frankfurt, Germany (AWS eu-central-1) |
| Vercel Inc. | Website and app hosting, server logs | USA |
| Clerk Inc. | Sign-in and account management (email, name, password) | USA |
| Groq Inc. | AI model that writes drafts from public page content | USA |
| Upstash Inc. (QStash) | Background job scheduling (technical IDs only) | USA |
| Google Ireland Ltd. / Google LLC | Only if you connect Google Search Console: reading your search data | Ireland / USA |
We announce new sub-processors at least 30 days in advance. You may object on reasonable data protection grounds, in which case either side may terminate. Transfers to third countries rely on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.
5. Contact
Questions about this agreement: dexai.support@proton.me. The operator and postal address are in the legal notice. A signed copy is available on request.