Privacy Policy

1. Information we collect

We collect what we need to run your account and your agents. That falls into a few groups:

• Account details: your name, email address, password, plan and any licence code you redeem.
• What you give agents: your messages, each agent's name and instructions, images you attach, and the agents' replies.
• Workspace data: the lists, leads, companies, deals, tasks, appointments, campaigns and funnels you or your agents create, including the contact details of the people in them.
• Connected accounts: the credentials you add for connectors, such as OAuth grants, API keys, SMTP details, Twilio credentials and your own AI keys, and the data those accounts let us access (see Connected accounts and integrations below).
• Channel data: messages you send your agent over WhatsApp, Telegram or the browser extension, plus a label or masked number for each link and when it was last used.
• Usage data: tokens used per chat turn, send and block counts, and technical logs such as IP address, browser and timestamps.
• Funnel analytics: when people visit funnels you publish, we record events such as views and clicks with their country, city, browser, operating system, device type and referrer.

2. How we use it

• To provide the service: run your agents and their tools, send what you ask them to send, and show your Records.
• To secure your account: verify your email, send password reset codes and detect abuse.
• To apply your plan: count tokens and allowances and show your usage.
• To support you when you contact us, and to tell you about important changes to the service.
• To understand and improve how the product is used, using aggregated or de-identified data where we can.

We don't sell your personal information, and we don't use your workspace data to advertise to you or to the people in your lists.

3. AI processing and model providers

Agents are powered by third-party AI models. When you send a message, we send the model provider for that agent's model what it needs to respond: your message, the agent's instructions, earlier messages in the conversation, and the results of any tools the agent uses, which can include workspace data.

• Providers: Anthropic (Claude models), OpenAI (GPT models) and Google (Gemini models), depending on the model you choose.
• Your own AI key: if you add one, requests for that provider are made with your key, and that provider's terms with you also apply.
• Provider handling: each provider processes this data under its own API terms, which set how long it keeps the data and whether it may be used for training.

4. Sharing and subprocessors

We share data only with the service providers that help us run Dexisphere, with services you connect, or when the law requires it.

We may also disclose information to comply with the law, to protect people's safety or our rights, or as part of a merger or acquisition, in which case this policy continues to apply.

5. Connected accounts and integrations

You choose which accounts to connect. We only access what a connected account needs for the features you use, and agents act in it only when you ask them to, directly or through a task you scheduled.

How we handle credentials

• OAuth tokens, API keys and passwords are stored on our servers and used only by your workspace's tools.
• They are never sent to an AI model and never shown back in chat.
• Data an agent reads from a connected account, such as an email thread or a calendar event, may be sent to the AI provider for that agent's model, only to complete the task you asked for.

Google user data

Dexisphere's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Each Google service asks only for its own access: Gmail can only send, and Drive, Sheets and Docs only see files you pick or that Dexisphere creates. Data from Gmail, Google Calendar, Google Drive, Sheets and Docs, Google Contacts, Google Business Profile, YouTube and Google Ads is used only to provide the features you use. We don't use it for advertising, we don't sell it, we don't use it to train general AI models, and people at Dexisphere don't read it unless you ask us to, it's needed for security, or the law requires it.

Dexisphere uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service, and Google's handling of that data is covered by the Google Privacy Policy. You can revoke access at any time from your Google security settings.

Meta: Facebook, Instagram and WhatsApp Business

Data from Facebook, Instagram, Meta Ads and WhatsApp Business is used under Meta's Platform Terms, only for the features you use. To delete it, disconnect the account in Dexisphere, remove Dexisphere under Settings & privacy > Settings > Apps and websites in Facebook, or email [email protected] from the address on your account. We delete data received from Meta within 30 days of your request.

Payment accounts

Payment connections are read-only. Dexisphere reads your transactions, refunds, payouts and disputes, and receives the payment events your provider sends, so an agent can report on sales and alert you when a payment lands. It never creates charges, issues refunds or moves money. Where your provider supports it, use a restricted key with read access only.

Social, ad and work accounts

• Social accounts (Facebook Page, Instagram, LinkedIn, X, YouTube and TikTok) are used to read your posts, their stats and, where the grant includes one, your ad account's spend and results. Ad accounts are read-only.
• Dexisphere doesn't publish to your social accounts today. If publishing is added, it will only post what you approve, and this section will say so first.
• Slack and Telegram channels are only posted to. Jira, GitHub and Shopify are only read: Dexisphere doesn't create, change or delete anything in them.

Disconnecting and revoking access

• Disconnect any account in the app under Plugins > Connectors. We delete its stored tokens or keys straight away.
• You can also revoke access from the provider: Google account permissions, Facebook's Apps and websites settings, your Microsoft account's app permissions, or the connected-apps settings of LinkedIn, X or TikTok. For API keys and tokens, delete or roll the key in the provider's dashboard.
• Records already created from a connected account, such as leads you imported, stay in your workspace until you delete them.

When we add an integration, it's added to this section, with what it can access, before it becomes available.

6. Data retention

• Account details are kept while your account is open.
• An agent's instructions, conversation and channel links are kept until you delete the agent.
• Workspace records are kept until you delete them or close your account.
• A connected account's tokens or keys are deleted as soon as you disconnect it.
• Work receipts aren't stored: they exist only in your browser for the current session.
• Channel pairing codes expire after 15 minutes. Unused conversation copies are removed automatically.
• After you close your account, we delete or anonymise your data within 30 days, except where we must keep it longer for legal, tax or security reasons. Backups roll off on their normal schedule.

7. Security

• Data travels over encrypted HTTPS connections between your browser, the app and our providers.
• Connector credentials are stored on the server and used by your agents' tools. They aren't shown back in chat.
• Access to production data is limited to the people who need it to run and support the service.
• Your session is a sign-in token kept in your browser. Signing out removes it from that browser.

No system is completely secure. Use a strong, unique password, sign out on shared devices, and tell us at [email protected] if you believe your account or data has been compromised.

8. International transfers

We and our providers operate in several countries, including the United States, so your information may be processed outside the country where you live. Where the law requires it, we rely on appropriate safeguards for these transfers, such as standard contractual clauses.

9. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you, and get a copy in a portable format;
• correct information that's wrong, or delete it;
• object to or restrict certain processing, and withdraw consent where we rely on it;
• complain to your local data protection authority.

Much of this you can do yourself: edit or delete agents, disconnect channels and connectors, and delete records. For anything else, email [email protected] from the address on your account. We'll respond within the time the law allows.

10. Cookies and local storage

We keep browser storage to the minimum the site and app need. We don't use advertising cookies.

You can clear these at any time in your browser settings. Clearing the app's storage signs you out. If we add analytics or other cookies, we'll update this section first.

11. Changes and contact

We may update this policy as the product changes. We'll change the "Last updated" date above, and for significant changes we'll let you know by email or in the app before they take effect.

Questions, requests or complaints about privacy: [email protected]. For help with your account, email [email protected].