Privacy Policy

Introduction

Dewx ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

Information We Collect

Information You Provide

• Account information (name, email, company name)
• Communication preferences
• Support requests and feedback
• Payment information (processed securely by our payment provider)

Information From Connected Services

When you ask us to connect third-party services (WhatsApp, LinkedIn, Gmail, Instagram, Outlook) so we can run outreach, inbox, and CRM work on your behalf, we access the data needed to perform that work:

• Messages and conversations
• Contact information
• Calendar events (when applicable)

Automatically Collected Information

• Device information and browser type
• Usage data and analytics
• IP address and location data

How We Use Your Information

We use your information to:

• Provide and maintain our service
• Process transactions and send related information
• Send you technical notices and support messages
• Respond to your comments and questions
• Improve and personalize your experience
• Protect against fraud and abuse

Data Retention Policy

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account data: Retained while your account is active and for 30 days after deletion request
• Message data: Retained for the duration of your engagement with us, unless you request earlier deletion
• Analytics data: Retained in anonymized form for up to 24 months
• Billing records: Retained for 7 years as required by law
• Support tickets: Retained for 3 years after resolution

You may request deletion of your data at any time by contacting privacy@dewx.com. We will process deletion requests within 30 days, subject to legal retention requirements.

International Data Transfers (GDPR)

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we comply with applicable data protection laws including the General Data Protection Regulation (GDPR).

Your data may be transferred to and processed in countries outside your jurisdiction, including the United States. When we transfer data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): We use EU-approved SCCs for transfers to countries without adequacy decisions
• Adequacy decisions: We prioritize storing data in jurisdictions with EU adequacy decisions where possible
• Data Processing Agreements: All third-party processors sign DPAs that meet GDPR requirements

Your GDPR Rights: As an EU resident, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure ("right to be forgotten")
• Restrict processing
• Data portability
• Object to processing
• Lodge a complaint with your supervisory authority

California Privacy Rights (CCPA)

California residents have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions
• Right to Correct: You may request correction of inaccurate personal information
• Right to Opt-Out: You may opt out of the "sale" or "sharing" of personal information (note: we do not sell personal information)
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise these rights, contact us at privacy@dewx.com. We will verify your identity before processing requests. You may designate an authorized agent to make requests on your behalf.

Categories of Information Collected: Identifiers, commercial information, internet activity, professional information, and inferences drawn from the above.

Do Not Track: We respond to Do Not Track browser signals by limiting tracking to essential service functionality.

Children's Privacy (COPPA)

Dewx is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. Our service is designed for business professionals and requires users to be at least 18 years old.

If we learn that we have collected personal information from a child under 13, we will promptly delete that information. If you believe we have collected information from a child under 13, please contact us immediately at privacy@dewx.com.

Data Breach Notification

In the event of a data breach that compromises your personal information, we will:

• Notify affected users within 72 hours of becoming aware of the breach (as required by GDPR)
• Notify relevant supervisory authorities where required by law
• Provide details about the nature of the breach and categories of data affected
• Describe measures taken to address the breach
• Recommend steps you can take to protect yourself

We maintain incident response procedures and conduct regular security assessments to minimize the risk of data breaches. If you suspect unauthorized access to your account, please contact us immediately.

Automated Decision Making & AI Disclosure

Dewx uses artificial intelligence (AI) and machine learning as part of the operating work we run for you:

• Research and drafting: Preparing prospect research, message drafts, replies, and follow-ups in your voice
• Triage: Categorizing and prioritizing messages so the decisions that need you reach you first
• Reporting: Summarizing activity, pipeline, and results in your weekly report

Important: AI does the volume; a human runs the loop. Nothing is sent to your contacts without approval, and you maintain control over:

• What AI is used for in your engagement
• Reviewing and approving AI-generated content before it goes out
• Overriding or correcting AI-generated drafts
• Opting out of specific AI processing

We do not use automated decision-making for decisions that have legal or similarly significant effects on you without human oversight.

Third-Party Integrations

Our service integrates with the following third-party platforms. When you connect these services, we access data according to their respective API terms:

Messaging Integrations

• WhatsApp Business API: Messages, contacts, media files (governed by Meta's Platform Terms)
• LinkedIn API: Messages, connections, profile information (governed by LinkedIn's API Terms)
• Gmail API: Emails, contacts, calendar (governed by Google API Services User Data Policy)
• Instagram Graph API: Direct messages, mentions, comments (governed by Meta's Platform Terms)
• Microsoft Graph API: Outlook mail, calendar, contacts (governed by Microsoft API Terms)

Service Providers

• Stripe: Payment processing
• Google Cloud Platform: Infrastructure and AI services
• Amazon Web Services: Cloud infrastructure
• PostHog: Product analytics (privacy-focused)
• Resend: Transactional email

All service providers are bound by data processing agreements and are required to maintain appropriate security measures.

Data Storage and Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Regular security assessments and penetration testing
• Access controls and multi-factor authentication
• Data hosted on infrastructure providers with industry-standard physical and network security
• Regular backups with encrypted off-site storage
• Employee security training and background checks

Data Sharing

We do not sell your personal information. We may share data with:

• Service providers who assist in operating our platform
• Legal authorities when required by law
• Business partners with your consent

Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Opt out of marketing communications
• Withdraw consent at any time

Dewx CRM Data (crm.dewx.com)

For Dewx CRM workspaces, you are the controller of the records you store; Dewx is the processor. Workspace data is hosted on our own infrastructure in the EU (Contabo). Transactional email (sign-up, invites, briefings) is delivered via our SMTP provider. AI features process only the records needed for the requested action; when an external AI model is used, we send the minimum necessary text and never sell or train on your data. You can export or delete your workspace at any time; on deletion we archive, then purge on request.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes, we will send you an email notification.

Contact Us

If you have questions about this Privacy Policy, please contact us at:

• Email: privacy@dewx.com
• Data Protection Officer: dpo@dewx.com

For EU residents, you may also contact our EU representative or lodge a complaint with your local supervisory authority.