Privacy Policy

1. Who we are

Dexbi is operated by ASSET LAB LLC (“Dexbi”, “we”, “us”). For the personal data described in this policy, we act as the data controller when we process information about our account holders and website visitors, and as a data processor when we process the content and end-user messages inside your Discord community on your behalf.

This policy explains what we collect, why, the legal bases we rely on, and the rights you have under the UK GDPR and Data Protection Act 2018, the EU GDPR, and US state privacy laws including the California Consumer Privacy Act as amended by the CPRA. If you administer a community, you are responsible for having your own lawful basis and notices for the data you route through Dexbi.

2. Information we collect

Depending on how you use Dexbi, we collect the following categories of personal data:

• Account data — your Discord user ID, username, avatar, and email address provided at sign-up
• Server data — the Discord servers, channels, and roles you authorize Dexbi to access
• Knowledge content — documents, URLs, and sources you connect for training your agent
• Conversation data — messages Dexbi processes to generate replies and run procedures, including end-user messages in your community. To decide whether a message is meant for it, Dexbi also reads short excerpts of the channel's recent messages (at most 15 from the last 15 minutes, labelled only by role, without names or IDs); these are held in memory for about 15 minutes and then discarded, never stored
• Billing data — plan, transaction history, and partial card details held by our payment processor (we never store full card numbers)
• Technical data — IP address, device and browser type, and log and usage data collected automatically
• Cookie data — identifiers set by essential and, with consent, analytics cookies on our website

3. How we use your information

We use personal data to:

• Provide, operate, and secure the Dexbi service and your account
• Generate replies and run the procedures you configure
• Process payments and manage subscriptions
• Respond to support requests and communicate service and security notices
• Monitor, debug, and improve reliability and reply quality for your own workspace
• Detect, prevent, and investigate fraud, abuse, and violations of our terms
• Comply with our legal and regulatory obligations

4. Legal bases for processing (UK & EU GDPR)

Where the UK or EU GDPR applies, we rely on one or more of the following legal bases:

• Contract — to provide the service you have signed up for and to bill you
• Legitimate interests — to secure, maintain, and improve the service, and to prevent abuse, balanced against your rights
• Consent — for non-essential cookies and any optional marketing communications, which you may withdraw at any time
• Legal obligation — to meet tax, accounting, and other legal requirements

5. AI processing & training

Dexbi uses your connected knowledge and conversation data to generate answers for your community. Each community's knowledge base is logically isolated — we do not use one customer's private content to answer questions for another, and we do not use your private community content to train shared or third-party foundation models. We may use aggregated, de-identified statistics that cannot reasonably identify any individual to improve the service.

6. How we share information

We do not sell your personal data, and we do not “share” it for cross-context behavioural advertising as those terms are defined under California law. We disclose personal data only to:

• Sub-processors — vetted providers for hosting, AI inference, analytics, and payments, acting on our instructions under written contracts
• Professional advisers — lawyers, auditors, and insurers where necessary
• Authorities — where required by law, legal process, or to protect rights, safety, and security
• Successors — a buyer or successor in the event of a merger, acquisition, or asset sale, subject to this policy

7. Service providers we use

These are the sub-processors that handle personal data on our behalf, and what each one does. We will update this list when it changes.

• Discord — the platform Dexbi runs on, and sign-in
• Clerk — account sign-in and session management
• Stripe — payments, subscriptions, and invoices
• Anthropic (Claude) — generating replies, and reading images members send and images you enable
• OpenRouter — routing short decision questions (for example, whether a message needs a reply) to TypeSafe's Jev model, and backup replies to OpenAI models when Claude is unavailable
• Voyage AI — turning knowledge and questions into search vectors, and ranking search results
• Jina AI — rendering JavaScript on public web pages during website sync, only when you turn it on (it receives only the page's URL)
• LangChain (LangSmith) — tracing how replies were produced, to debug and improve reply quality
• Oracle Cloud — hosting our servers and databases
• Cloudflare — DNS, network protection, file storage, and transcript hosting
• Vercel — hosting our website and dashboard
• Resend — sending account and usage emails
• Sentry — error and uptime monitoring

8. International data transfers

We are based in the United States and our sub-processors may process data in the US and other countries. Where we transfer personal data out of the UK or European Economic Area, we rely on an adequacy decision where one exists, or on appropriate safeguards such as the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, plus additional technical and organisational measures where needed. You may request a copy of the relevant safeguards by contacting us.

9. Data retention

We keep personal data only for as long as necessary for the purposes above. Dexbi deletes a stored conversation 90 days after its last message, unless it is a ticket that is still open or a conversation waiting for staff; this covers Dexbi's memory of the conversation and its stored messages and replies, and is the same on every plan. Ticket transcripts and ratings are kept until the workspace is deleted. Usage records that identify a conversation are deleted after 45 days, and only daily totals per server are kept. You can disconnect a source or delete your workspace at any time from the dashboard. A deleted workspace is kept for 60 days in case you change your mind, then its knowledge, conversation data, and files are permanently deleted. You can export a copy of a workspace you own from its settings at any time, and delete your account from the dashboard's account menu once you no longer own a server. We delete or de-identify remaining account data within 30 days of account closure, except where we must retain records to meet legal, tax, accounting, or dispute-resolution obligations (typically up to 7 years for financial records).

10. Security

We use encryption in transit and at rest, access controls, least-privilege permissions, and logging to protect personal data. No system is perfectly secure, but we maintain measures appropriate to the risk and will notify affected users and the relevant regulator of a qualifying personal data breach without undue delay and, where required, within 72 hours.

11. Your rights (UK & EU)

If the UK or EU GDPR applies to you, you have the right to:

• Access a copy of your personal data
• Rectify inaccurate or incomplete data
• Erase your data (the “right to be forgotten”)
• Restrict or object to certain processing, including processing based on legitimate interests
• Data portability — receive your data in a portable format
• Withdraw consent at any time, without affecting prior lawful processing
• Lodge a complaint with a supervisory authority

12. Your rights (US state laws)

If you are a California resident, or a resident of another US state with a comprehensive privacy law, you may have the right to:

• Know and access the personal information we hold about you
• Correct inaccurate personal information
• Delete personal information, subject to legal exceptions
• Opt out of the sale or sharing of personal information — note we do not sell or share it
• Limit the use of sensitive personal information
• Be free from discrimination for exercising your privacy rights

13. How to exercise your rights

To exercise any of these rights, email support@dexbi.app. We will verify your identity and respond within the timeframe required by law — one month under the UK and EU GDPR (extendable by two months for complex requests), and 45 days under California law (extendable by a further 45 days). You may use an authorised agent where the law permits. These rights are free to exercise in most cases.

14. Children's privacy

Dexbi is not directed to children under 13 (or the minimum digital-consent age in your jurisdiction, up to 16 in parts of the EU), and we do not knowingly collect their personal data. If you believe a child has provided us personal data, contact us and we will delete it.

15. Cookies

Our website uses essential cookies needed to operate the site and, only with your consent, analytics cookies that help us understand usage. You can manage non-essential cookies through our cookie banner or your browser settings.

16. Changes to this policy

We may update this policy from time to time. We'll post the revised version here with a new “Last updated” date and, for material changes, provide additional notice where required by law.

17. Contact & complaints

Questions or requests: support@dexbi.app, ASSET LAB LLC. If you are in the UK, you may also complain to the Information Commissioner's Office (ico.org.uk). If you are in the EEA, you may complain to your local Data Protection Authority.