Privacy Policy

1. Who we are

Dexbi is operated by ASSET LAB LLC (“Dexbi”, “we”, “us”). For the personal data described in this policy, we act as the data controller when we process information about our account holders and website visitors, and as a data processor when we process the content and end-user messages inside your Discord community on your behalf.

This policy explains what we collect, why, the legal bases we rely on, and the rights you have under the UK GDPR and Data Protection Act 2018, the EU GDPR, and US state privacy laws including the California Consumer Privacy Act as amended by the CPRA. If you administer a community, you are responsible for having your own lawful basis and notices for the data you route through Dexbi.

2. Information we collect

Depending on how you use Dexbi, we collect the following categories of personal data:

• Account data — your Discord user ID, username, avatar, and email address provided at sign-up
• Server data — the Discord servers, channels, and roles you authorize Dexbi to access
• Knowledge content — documents, URLs, and sources you connect for training your agent
• Conversation data — messages Dexbi processes to generate replies and run procedures, including end-user messages in your community
• Billing data — plan, transaction history, and partial card details held by our payment processor (we never store full card numbers)
• Technical data — IP address, device and browser type, and log and usage data collected automatically
• Cookie data — identifiers set by essential and, with consent, analytics cookies on our website

3. How we use your information

We use personal data to:

• Provide, operate, and secure the Dexbi service and your account
• Generate replies and run the procedures you configure
• Process payments and manage subscriptions
• Respond to support requests and communicate service and security notices
• Monitor, debug, and improve reliability and reply quality for your own workspace
• Detect, prevent, and investigate fraud, abuse, and violations of our terms
• Comply with our legal and regulatory obligations

4. Legal bases for processing (UK & EU GDPR)

Where the UK or EU GDPR applies, we rely on one or more of the following legal bases:

• Contract — to provide the service you have signed up for and to bill you
• Legitimate interests — to secure, maintain, and improve the service, and to prevent abuse, balanced against your rights
• Consent — for non-essential cookies and any optional marketing communications, which you may withdraw at any time
• Legal obligation — to meet tax, accounting, and other legal requirements

5. AI processing & training

Dexbi uses your connected knowledge and conversation data to generate answers for your community. Each community's knowledge base is logically isolated — we do not use one customer's private content to answer questions for another, and we do not use your private community content to train shared or third-party foundation models. We may use aggregated, de-identified statistics that cannot reasonably identify any individual to improve the service.

6. How we share information

We do not sell your personal data, and we do not “share” it for cross-context behavioural advertising as those terms are defined under California law. We disclose personal data only to:

• Sub-processors — vetted providers for hosting, AI inference, analytics, and payments, acting on our instructions under written contracts
• Professional advisers — lawyers, auditors, and insurers where necessary
• Authorities — where required by law, legal process, or to protect rights, safety, and security
• Successors — a buyer or successor in the event of a merger, acquisition, or asset sale, subject to this policy

7. International data transfers

We are based in the United States and our sub-processors may process data in the US and other countries. Where we transfer personal data out of the UK or European Economic Area, we rely on an adequacy decision where one exists, or on appropriate safeguards such as the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, plus additional technical and organisational measures where needed. You may request a copy of the relevant safeguards by contacting us.

8. Data retention

We keep personal data only for as long as necessary for the purposes above. You can disconnect a source or delete your workspace at any time from the dashboard, which removes the associated knowledge and conversation data. We delete or de-identify remaining account data within 30 days of account closure, except where we must retain records to meet legal, tax, accounting, or dispute-resolution obligations (typically up to 7 years for financial records).

9. Security

We use encryption in transit and at rest, access controls, least-privilege permissions, and logging to protect personal data. No system is perfectly secure, but we maintain measures appropriate to the risk and will notify affected users and the relevant regulator of a qualifying personal data breach without undue delay and, where required, within 72 hours.

10. Your rights (UK & EU)

If the UK or EU GDPR applies to you, you have the right to:

• Access a copy of your personal data
• Rectify inaccurate or incomplete data
• Erase your data (the “right to be forgotten”)
• Restrict or object to certain processing, including processing based on legitimate interests
• Data portability — receive your data in a portable format
• Withdraw consent at any time, without affecting prior lawful processing
• Lodge a complaint with a supervisory authority

11. Your rights (US state laws)

If you are a California resident, or a resident of another US state with a comprehensive privacy law, you may have the right to:

• Know and access the personal information we hold about you
• Correct inaccurate personal information
• Delete personal information, subject to legal exceptions
• Opt out of the sale or sharing of personal information — note we do not sell or share it
• Limit the use of sensitive personal information
• Be free from discrimination for exercising your privacy rights

12. How to exercise your rights

To exercise any of these rights, email support@dexbi.app. We will verify your identity and respond within the timeframe required by law — one month under the UK and EU GDPR (extendable by two months for complex requests), and 45 days under California law (extendable by a further 45 days). You may use an authorised agent where the law permits. These rights are free to exercise in most cases.

13. Children's privacy

Dexbi is not directed to children under 13 (or the minimum digital-consent age in your jurisdiction, up to 16 in parts of the EU), and we do not knowingly collect their personal data. If you believe a child has provided us personal data, contact us and we will delete it.

14. Cookies

Our website uses essential cookies needed to operate the site and, only with your consent, analytics cookies that help us understand usage. You can manage non-essential cookies through our cookie banner or your browser settings.

15. Changes to this policy

We may update this policy from time to time. We'll post the revised version here with a new “Last updated” date and, for material changes, provide additional notice where required by law.

16. Contact & complaints

Questions or requests: support@dexbi.app, ASSET LAB LLC. If you are in the UK, you may also complain to the Information Commissioner's Office (ico.org.uk). If you are in the EEA, you may complain to your local Data Protection Authority.