Privacy Policy

1. Scope of This Policy

This policy covers three groups of people, and treats them differently:

• Visitors to dossx.com — anyone browsing the DossX marketing site, requesting a demo, or filling out the contact form.
• Subscribers — businesses and individuals with a DossX account who build and operate sites on the platform. For subscribers, DossX acts as a data processor for the content and customer data their own sites collect; the subscriber is the data controller for that data.
• End users of a DossX-powered site — the customers, readers, or shoppers who visit a site a subscriber built with DossX. Their data is controlled by the subscriber who runs that site, not by DossX directly, except where this policy says otherwise (for example, aggregate platform security and AI processing).

2. Information We Collect

Information you give us directly

• Account information — name, email, company, and password when you sign up
• Billing information — processed by our payment processor (Stripe); DossX does not store full card numbers
• Content you create — pages, posts, products, and other content you build using the platform
• Communications — anything you send us via the contact form, a demo request, or support

Information collected automatically

• Usage data — pages viewed, features used, blocks added, general interaction patterns within the admin
• Device and log data — browser type, IP address, referring URLs, timestamps
• Cookies and similar technologies — see Section 4

Content your site collects from your visitors

If your DossX site includes e-commerce, forms, or the AI chatbot, it will collect data from your own visitors — order details, form submissions, chat conversations. That data belongs to you as the subscriber; DossX processes and stores it on your behalf as described in Section 1.

3. How We Use Information

• To provide, maintain, and improve the DossX platform
• To process payments and manage subscriptions
• To respond to support requests and demo inquiries
• To send account-related communications (billing notices, security alerts, service updates)
• To send product or marketing emails, which you can opt out of at any time
• To detect, investigate, and prevent fraud, abuse, or security incidents
• To generate AI content assistant drafts and power the AI chatbot, as described in Section 5

4. Cookies & Tracking Technologies

dossx.com uses cookies for essential site functionality (like keeping you signed in) and, where enabled, analytics to understand how visitors use the site. Sites built on DossX may use their own cookies for similar purposes, configured by the subscriber who runs that site. You can control cookies through your browser settings; blocking essential cookies may affect how the site or admin functions.

5. AI Features & Data Handling

DossX includes an AI content assistant and an AI chatbot available on every site. Here's how data moves through them:

• The AI content assistant processes the prompts and context you give it to draft content; drafts land for human review before publishing — DossX doesn't auto-publish AI output.
• The AI chatbot processes visitor conversations on a subscriber's site to generate responses, scoped to that site's own content and data.
• On multi-site and agency accounts, each site's AI chatbot context and conversation data is isolated from every other site on the account, enforced in code — one client's chatbot never sees another client's data.
• AI processing may involve sending relevant text to a third-party AI model provider under a data processing agreement; DossX does not permit that provider to use subscriber content to train models available to other companies.
• Subscribers can disable the AI chatbot on a given site at any time from the admin.

6. How We Share Information

We don't sell personal information. We share it only in these situations:

• Service providers — payment processing (Stripe), email delivery, hosting and infrastructure, and the AI model provider described in Section 5, each bound by their own confidentiality and data-handling obligations
• Legal requirements — if required by law, subpoena, or to protect the rights, safety, or property of DossX, our subscribers, or the public
• Business transfers — if DossX is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction, subject to this policy or a comparable one
• With your direction — anywhere you explicitly ask us to share it

7. Data Retention

We keep account and content data for as long as a subscription is active. After termination or cancellation, subscribers have 30 days to export their content before it and associated data are permanently deleted, consistent with the license terms in our pricing and license documentation. We retain some information longer where required for legal, tax, or security purposes.

8. Data Security

We use technical and organizational measures — encryption in transit, access controls, role-based permissions, and per-site data isolation on multi-tenant accounts — to protect information against unauthorized access, alteration, or loss. No system is completely secure, and we can't guarantee absolute security, but we treat this seriously and respond promptly to any confirmed incident.

9. Your Rights & Choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your information, subject to legal retention requirements
• Export your data in a portable format
• Opt out of marketing communications at any time
• Object to or restrict certain kinds of processing

To exercise any of these rights, contact us using the details in Section 13. If your data is held by a subscriber's site rather than by DossX directly (see Section 1), we'll direct your request to that subscriber, who controls it.

10. Children's Privacy

DossX is not directed to children, and we do not knowingly collect personal information from children under 13 (or the minimum age required by your local law). If you believe a child has provided us with personal information, contact us and we'll remove it.

11. International Data Transfers

Information may be processed and stored in countries other than your own. Where required, we rely on appropriate safeguards for these transfers. Specific mechanisms (such as standard contractual clauses) depend on where you and your data are located — contact us if you need details for your jurisdiction.

12. Changes to This Policy

We may update this policy as the platform evolves. Material changes will be reflected by an updated "Last updated" date at the top of this page, and, where required, we'll provide additional notice.

13. Contact Us