Legal
Privacy policy
The German version is legally binding. This English version is provided for convenience.
Note: a few details (highlighted) are still being added.
This page explains what personal data Dex processes, why, on what legal basis, and what rights you have. In short: we process only what Dex needs to work, store your data in Frankfurt, and use no advertising or analytics trackers.
1. Controller
The controller for Dex is the operator named in our legal notice (Impressum), which lists the name and postal address.
Open the legal noticeEmail: dexai.support@proton.me
We are not required to appoint a data protection officer. Please contact us directly with any question.
2. Visiting our website
When you open our website, our hosting provider Vercel processes technically necessary data: IP address, date and time, the page requested, browser and operating system. This is needed to deliver the page and protect it from abuse.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working service). These logs are kept only as long as security and troubleshooting require.
3. Your account
We use Clerk for sign-in. This involves your email address, your name and your password. Dex itself never sees or stores your password.
Legal basis: Art. 6(1)(b) GDPR (the contract for using Dex).
4. Your website and what Dex does with it
Dex stores your website's address and reads its publicly reachable pages, following the disallow rules in your robots.txt. From those pages it produces findings, drafted improvements and a record of your decisions. Dex has no access to your content management system and changes nothing on your website.
Public pages can contain personal data, such as names on a team page. For business customers we process such data as a processor under our data processing agreement.
Legal basis: Art. 6(1)(b) GDPR.
5. Competitor monitoring
If you name competitors, Dex reads their public pages to spot changes. Legal basis: Art. 6(1)(f) GDPR (your interest in watching your market; only publicly available content is read).
6. Google Search Console (optional)
Only if you connect it yourself, Dex reads your Google Search Console data, such as clicks and search terms for your pages. We store the Google access keys with additional encryption (AES-256-GCM). You can revoke the connection in your Google account at any time.
Legal basis: Art. 6(1)(a) and (b) GDPR.
7. Artificial intelligence
To write drafts, Dex sends the necessary text from your public pages to an AI model hosted by Groq. Every draft is labelled as AI-generated and is used only after you approve it. Dex makes no automated decisions with legal effect on you (Art. 22 GDPR). Dex does not train AI models on your data.
9. Recipients and service providers
We use these service providers. All of them process data only on our behalf and on our instructions (Art. 28 GDPR):
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database (all account data, scans, drafts, decisions) | Stored in Frankfurt, Germany (AWS eu-central-1) |
| Vercel Inc. | Website and app hosting, server logs | USA |
| Clerk Inc. | Sign-in and account management (email, name, password) | USA |
| Groq Inc. | AI model that writes drafts from public page content | USA |
| Upstash Inc. (QStash) | Background job scheduling (technical IDs only) | USA |
| Google Ireland Ltd. / Google LLC | Only if you connect Google Search Console: reading your search data | Ireland / USA |
Your database is in Frankfurt. Some providers are based in the USA. We base transfers there on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses (Art. 46 GDPR). You can request a copy of the safeguards.
We do not sell data or share it for advertising.
10. How long we keep data
We keep your data for as long as your account exists. If you ask us to delete your account, we delete your data within 30 days unless a legal retention duty applies. Data we must keep is blocked from any other use.
11. Your rights
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on legitimate interests (Art. 21 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
Just write to dexai.support@proton.me.
You can also complain to a data protection supervisory authority. The authority responsible for us is: Sächsische Datenschutz- und Transparenzbeauftragte, https://www.datenschutz.sachsen.de.
12. Do you have to provide data?
Dex can't work without your email address and your website's address. Everything else, such as the Search Console connection, is optional.
13. Changes
When Dex changes, we update this policy. We tell signed-in users about significant changes in advance.