DEX website chat privacy notice

DataInbox, Liessentstraat 9A, 5405 AH Uden, the Netherlands, is responsible for personal data processed through DEX on this website. Questions can be sent to hello@datainbox.ai.

This notice covers the public DEX widget and its contact flow. DEX writes these interactions to the Website Lead Intelligence Inbox. It is not connected to a customer’s private Customer Inbox unless that customer separately configures such a service.

Depending on what you do, we process your question and chosen context, language, current page, timestamps, technical request data, pseudonymous visitor and website-session identifiers when tracking is allowed, chat correlation identifiers, your feedback, and any name, email address, organisation and follow-up choice you submit with permission.

If you opt in to the profile link, the email address, bounded interest summary and relevant visitor, session and interaction references are recorded. Personal email is a separate, optional choice. Do not enter special-category data, passwords, API keys, payment data or other confidential information in DEX.

You are talking to an AI assistant, not a human. DEX answers only questions about DataInbox from an approved, bounded product context. It has no tools and cannot access customer systems through this website chat. Answers can be incomplete or wrong; do not rely on them as legal, security, financial or other professional advice.

Every refresh starts a new visible conversation. Questions, context and replies may still be retained as separate conversation and audit records so we can provide the answer, secure and troubleshoot the service, and evaluate quality. Where permission and identifiers allow, DataInbox links references to these source records under the same visitor or contact profile; it does not overwrite the originals or automatically replay old chat text.

Journey personalisation is off until you actively allow it. Without it, DEX uses only the page currently open. With permission, page and interaction signals already received by the Website Lead Intelligence Inbox are organised there under a pseudonymous visitor profile. DEX does not store the journey or your email in browser storage.

A deterministic server-side score combines topic relevance, recency and permitted interaction weight. DEX receives only a bounded projection: up to three topic percentages, evidence count, confidence, two recent topics and contact-status booleans. It never receives the server-side email or raw journey through this context route. These signals do not infer sensitive characteristics, predict a purchase, or make decisions with legal or similarly significant effects.

You can chat while keeping personalisation off. Allowing or refusing it does not change access to DEX. A browser Do Not Track signal keeps personalisation off. After allowing journey personalisation, you may separately link the permitted context to an email address and, with another unticked choice, request personal DataInbox email.

The browser retains only the consent receipt and pseudonymous visitor/session identifiers needed to retrieve the right bounded server profile. “Stop personalization and email” stops DEX using personal context and sends a server-side withdrawal when a contact point was linked. If confirmation fails, DEX says so and provides an email route. Personalisation or profile-link permission alone does not grant permission for personal email, advertising or unrelated third-party tracking.

We use consent for optional journey personalisation, linking permitted context to an email contact point, personal email, and the contact request you submit. We rely on legitimate interests to operate, secure, prevent abuse, troubleshoot and improve DEX, and to respond to a question you deliberately send, balanced against your rights. Processing may also be necessary to take requested pre-contractual steps, perform a contract, or meet legal obligations.

You can withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal. An email is treated as a contact point, not proof of identity; we may require additional verification before disclosing data or acting on a rights request.

DEX applies origin, schema, input, prompt, budget and rate-limit controls. It may close before any AI call when Cloudflare identifies a verified or very high-confidence bot, or when the browser shows automation or impossible navigation patterns where permitted by law. Ordinary page speed alone is not treated as proof of a bot.

A clear attempt to hack, bypass or manipulate DEX, extract hidden instructions or obtain secrets is not sent to the AI model. DEX locks that browser session and may ask for an email address plus explicit permission to forward the untrusted question for human security review and reply by email. Without that permission, no security-review request is sent.

If you believe you were blocked incorrectly, contact us by email. Security records may be kept to investigate abuse and protect the service.

For DEX profile access, compact context signals and contact actions, the server issues a security cookie named __Host-datainbox-visitor. It expires after 30 days, contains no email address or conversation, and cannot be read by website JavaScript. It proves access to the visitor profile assigned by the server; a visitor ID or email address alone is not an access credential. The cookie contains a random visitor identifier, expiry and a cryptographic signature; the website keeps no separate session register. Profiles and context remain in DataInbox. This security check does not turn on personalisation or grant permission for email.

An older profile based only on a browser-generated ID, or one whose security cookie has been removed or expired, is not automatically recovered. You can choose to link the new profile separately. To stop an earlier email preference that is no longer visible here, contact hello@datainbox.ai from the connected address; further verification may be needed.

We use vetted infrastructure, security and configured AI-model providers, including Cloudflare for the public website edge. They process data only to provide their services under contractual safeguards. Where data is transferred outside the European Economic Area, we use an applicable transfer mechanism and supplementary safeguards where required. Provider and transfer details relevant to your request are available from us.

The browser consent receipt expires after no more than 30 days and is removed sooner when you stop personalisation. The browser does not retain the DEX journey or linked email. The public chat credential expires after 60 minutes; that security control does not itself delete necessary conversation or audit records.

Server-side journey signals, chat, profile-link, consent, withdrawal, contact and security records are retained only as long as needed for their stated purpose, configured Inbox retention, legal duties and dispute handling, then deleted or anonymised. Contractual customer retention settings may apply to separately configured customer services.

Subject to applicable law, you may request access, rectification, erasure, restriction or portability, object to processing, withdraw consent, and lodge a complaint with the Dutch Data Protection Authority or another competent supervisory authority. Email hello@datainbox.ai to exercise a right. We may need to verify your identity.

Do not use DEX for unlawful, abusive, fraudulent or harmful activity; unsolicited messaging; impersonation; attempts to obtain hidden instructions or credentials; security bypasses; or excessive automated requests. We may restrict use to protect visitors and the service.

We update this notice when DEX, its providers or legal requirements materially change. The date above identifies the current version. For privacy questions, contact hello@datainbox.ai.