DEX website chat privacy notice

DataInbox, Liessentstraat 9A, 5405 AH Uden, the Netherlands, is responsible for personal data processed through DEX on this website. Questions can be sent to hello@datainbox.ai.

This notice covers the public DEX widget and its contact flow. DEX writes these interactions to the Website Lead Intelligence Inbox. It is not connected to a customer’s private Customer Inbox unless that customer separately configures such a service.

Depending on what you do, we process your question and chosen context, language, current page, timestamps, technical request data, pseudonymous visitor and website-session identifiers when tracking is allowed, chat correlation identifiers, your feedback, and any name, email address, organisation and follow-up choice you submit with contact permission.

Do not enter special-category data, passwords, API keys, payment data or other confidential information in DEX.

You are talking to an AI assistant, not a human. DEX answers only questions about DataInbox from an approved, bounded product context. It has no tools and cannot access customer systems through this website chat. Answers can be incomplete or wrong; do not rely on them as legal, security, financial or other professional advice.

Questions, context and replies may be retained as conversation and audit records so we can provide the answer, secure and troubleshoot the service, and evaluate quality.

Journey personalisation is off until you actively allow it. Without it, DEX uses only the page currently open and stores no DEX journey. With permission, this browser stores at most 60 path-only visits for 30 days; query strings and URL fragments are excluded.

A deterministic score combines topic relevance, recency, sequence and repeat visits. DEX shows the three strongest percentage signals and a confidence level. These signals prioritise likely interests; they do not identify you, infer sensitive characteristics, predict a purchase, or make decisions with legal or similarly significant effects. Only a bounded score summary—not the raw journey—is sent with a question.

You can chat while keeping personalisation off. Allowing or refusing it does not change access to DEX. “Stop and erase” removes the stored DEX journey immediately. A browser Do Not Track signal keeps personalisation off. Permission to contact you is requested separately inside the dialog and can be withdrawn.

DEX personalisation permission does not grant permission for marketing, advertising, cross-device tracking or unrelated third-party tracking.

We use consent for optional journey personalisation and for the contact request you submit. We rely on legitimate interests to operate, secure, prevent abuse, troubleshoot and improve DEX, and to respond to a question you deliberately send, balanced against your rights. Processing may also be necessary to take requested pre-contractual steps, perform a contract, or meet legal obligations.

You can withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal.

DEX applies origin, schema, input, prompt, budget and rate-limit controls. It may close before any AI call when Cloudflare identifies a verified or very high-confidence bot, or when the browser shows automation or impossible navigation patterns where permitted by law. Ordinary page speed alone is not treated as proof of a bot.

If you believe you were blocked incorrectly, contact us by email. Security records may be kept to investigate abuse and protect the service.

We use vetted infrastructure, security and configured AI-model providers, including Cloudflare for the public website edge. They process data only to provide their services under contractual safeguards. Where data is transferred outside the European Economic Area, we use an applicable transfer mechanism and supplementary safeguards where required. Provider and transfer details relevant to your request are available from us.

The optional path-only journey remains in this browser for no more than 30 days and is removed sooner when you choose “Stop and erase”. The public chat credential expires after 60 minutes; that expiry is a security control and does not itself delete necessary conversation or audit records.

Backend chat, contact and security records are retained only as long as needed for their stated purpose, configured Inbox retention, legal duties and dispute handling, then deleted or anonymised. Contractual customer retention settings may apply to separately configured customer services.

Subject to applicable law, you may request access, rectification, erasure, restriction or portability, object to processing, withdraw consent, and lodge a complaint with the Dutch Data Protection Authority or another competent supervisory authority. Email hello@datainbox.ai to exercise a right. We may need to verify your identity.

Do not use DEX for unlawful, abusive, fraudulent or harmful activity; unsolicited messaging; impersonation; attempts to obtain hidden instructions or credentials; security bypasses; or excessive automated requests. We may restrict use to protect visitors and the service.

We update this notice when DEX, its providers or legal requirements materially change. The date above identifies the current version. For privacy questions, contact hello@datainbox.ai.