Privacy Policy

Introduction

DataXGen AI ("we", "our", or "us") provides a business data platform: each customer's business runs in its own Space, with live boards, records, documents and an AI Operator that reads and acts on that Space's own data on request. This Privacy Policy explains what we collect, how we use it, and how it's protected.

Information We Collect

When you create an account, we collect:

• Your email address and name
• If you sign in with Google: your Google account's email, name and profile picture
• Basic account and billing information

Beyond your account, a Space holds whatever business data you or your team put into it — records, boards, documents and files you create or upload, and the requests you make to the Operator.

Your Space Is Its Own Tenant

A Space is a hard boundary. Every query the Operator runs, and every permission check, happens at the data layer — not just in the interface — so one Space's data is never visible from another. The Operator only reads and writes within the Space it's asked to act on, and it never changes anything without an explicit "yes" from you; every change it makes can be undone.

Optional Integrations (Gmail, Google Drive)

Separately from signing in, you can choose to connect Gmail and/or Google Drive to your account in Settings → Integrations. This is off by default and only turns on if you explicitly connect it:

• Gmail: once connected, the product can read, send and manage (e.g. mark as read/archive) email in that Gmail account, for the purpose you connected it for
• Google Drive: once connected, the product can read files and sheets from that Google Drive account

You can disconnect either at any time from the same Integrations screen, or by revoking access in your Google Account settings.

Google API Services User Data Policy: DataXGen AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Your Google data is never used to train AI models or for advertising, and is never read by a human except with your consent, to fix a security issue, or where the law requires it.

Google User Data (Gmail)

Signing in with Google asks only for your name, email address and profile picture. It requests no mail access and stores no Google token. Connect Gmail is a separate, explicit step you start yourself from Settings, Integrations or the Inbox. All three use the same consent and the same stored connection.

What we access, and why

• Read your mail (gmail.readonly): so your Gmail appears in the DataXGen Inbox, and so the assistant can answer when you ask about your email
• Organize your mail (gmail.modify): the Inbox actions you take — mark read or unread, star, archive, move to Spam or Trash. “Delete” moves a message to Trash; we never permanently delete your Gmail
• Send mail (gmail.send): sending and replying from your own address, from the Inbox composer or an email the assistant drafted that you approved. Sending always needs your explicit yes

How it is handled

• The first sync takes your last 90 days of mail (up to 2,000 messages); after that only changes are fetched. Messages and attachments are stored in our database and object storage, visible only to you
• Your connection token is encrypted at rest, never logged and never returned by our API
• No AI reads your mail unless you ask. Synced Inbox mail is never passed to an AI model. When you ask the assistant about your email, it searches Gmail for that request and the model that answers sees the mail it fetched
• An optional connector can look through the last 14 days of mail for invoices, receipts and bills, using fixed patterns rather than AI. Each result is only a proposal you approve or reject

Disconnecting and deletion

Disconnecting Gmail (from Settings, Integrations, or by removing the Gmail mailbox in the Inbox — it is one operation) deletes our stored token and asks Google to revoke it. By default, every message, thread and attachment we synced from Gmail is deleted; you can choose to keep it instead, in which case it stays readable to you and is never synced again. Records you already approved into your own business data stay yours. Deleting your account runs the same disconnect. Database backups are kept for 14 days and may still contain deleted mail until they expire.

Limited Use disclosure

DataXGen AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• we use Gmail data only to provide the features you use: your Inbox in DataXGen, sending mail you write or approve, and answering your own requests about your email
• we do not transfer Gmail data to others, except as needed to provide those features (our hosting, database and storage; the AI model provider, only when you ask the assistant about your email), to comply with law, or as part of a merger or acquisition with notice
• we do not use Gmail data for advertising
• no person at DataXGen reads Gmail data, except with your permission for specific messages, for security purposes (such as investigating abuse), to comply with law, or when the data is aggregated and anonymised for internal operations
• we do not use Gmail data to develop, improve or train generalised AI or ML models

Other Optional Connectors (Shopify, WordPress, Webhooks)

Also in Settings → Integrations, off by default:

• Shopify: once connected, reads orders from the shop you connect
• WordPress / WooCommerce: once connected, reads orders and posts from the site you connect
• Webhook: if you set one up, receives whatever rows your own systems push to it, into the collection you choose

How We Use Your Information

• To provide and improve the product
• To authenticate your account and keep it secure
• To let the Operator read and act on your Space's own data, at your request
• To process payments and manage your subscription
• To send you account, billing and product updates, and — only if you've opted in — product news and marketing email

Marketing Email

We only send marketing/product-news email to people who've opted in (a checkbox at signup or in account settings — never on by default). Every marketing email includes a one-click unsubscribe link, and unsubscribing is always honored immediately.

AI Processing

The Operator uses a third-party AI model provider to read and answer your requests — currently one of Groq, Google (Gemini), OpenRouter or Hugging Face, chosen automatically per request; this list can change as we add or swap providers. Only the data needed to answer that specific request is sent to a model provider; we do not sell your personal data or your Space's data to any third party. Each provider processes that request data under its own API terms, and we use their business API services, not consumer apps. We do not use your Space's data to train AI models of our own.

Data You Upload About Other People

Some features, such as email campaigns, let you upload a list of contacts and email them. For that data, we act as your processor: you're responsible for having a lawful basis and consent to hold and email those contacts, and we honor an unsubscribe request across your campaigns automatically and immediately.

Data Security

We use industry-standard measures to protect your data, including:

• Encryption of data in transit (HTTPS/TLS on every connection)
• Payment card details handled only by Stripe, never stored on our servers
• Secure authentication (password or Google OAuth 2.0)
• Access logging and rate limiting on our servers
• Limited internal access to personal and Space data

Third-Party Services

We use the following third-party services:

• Google OAuth: for secure sign-in, and — only if you connect them — Gmail/Drive access
• Shopify, WordPress/WooCommerce, or your own webhook: only if you connect one, per Space
• Namecheap: hosts our servers and backups in the United States
• Stripe: for payment processing; your card details go directly to Stripe and never touch our servers
• Resend: for transactional email (verification, receipts, password reset)
• Groq, Google (Gemini), OpenRouter, Hugging Face: AI model providers the Operator uses to process your requests

If you sign in with Google or connect Gmail/Drive, your Google data is also subject to Google's Privacy Policy.

Legal Bases for Processing (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

• Contract: to run your account and your Spaces, and to bill you
• Consent: for marketing email and for integrations you choose to connect; you can withdraw it at any time
• Legitimate interests: to keep the service secure, prevent abuse and improve the product
• Legal obligation: to keep billing records and respond to lawful requests

Your Rights

You have the right to:

• Revoke access: disconnect Gmail/Drive any time in Settings → Integrations, or revoke Google access entirely in your Google Account settings
• Delete data: request deletion of your account and all associated data
• Export data: request a copy of your Space's data in a portable format
• Access data: see what data we hold about you
• Correct data: request corrections to inaccurate account data
• Object or restrict: ask us to stop or limit a particular use of your data
• Withdraw consent: unsubscribe from marketing, or disconnect an integration, at any time

To use any of these rights, email us at [email protected] from the address on your account. We may need to confirm it's you before we act, and we reply within 30 days. We will not treat you differently for using your rights. If you are in the EEA or UK and are not satisfied with our answer, you can complain to your local data protection authority.

US State Privacy Rights

If you live in California or another US state with a consumer privacy law, you have the rights above to know, access, correct and delete your personal information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use sensitive personal information to infer anything about you. You can use your rights yourself or through an authorized agent, by emailing [email protected].

Data Retention

We keep your data only as long as necessary to provide the service. If you request deletion of your account (email us from the address on the account), we delete your account and your Space's data from our live systems within 30 days. Backup copies are rotated automatically and expire within 14 days after that. Billing records we are required to keep by law (such as invoices) are kept for as long as the law requires.

Cookies and Tracking

We use essential cookies to maintain your session and authentication. On the payment step, Stripe's embedded checkout sets its own cookies for fraud prevention. We do not use third-party tracking, analytics or advertising cookies. If we ever add them, we will update this policy first and ask for your consent where the law requires it.

Children's Privacy

DataXGen AI is a business product and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

Security Incidents

If a security incident affects your personal data, we will notify you, and the authorities where the law requires it, without undue delay, and tell you what happened and what we are doing about it.

Changes to This Policy

We may update this Privacy Policy from time to time. We'll notify you of any significant change by email or a notice on our website.

Company, Hosting and International Transfers

DataXGen AI is operated by an individual, as a sole proprietorship based in Bangladesh, and is responsible for your account data. For the business data you put into a Space, we process it on your behalf and follow your instructions. Our servers are located in the United States, so if you use the service from outside the US, your data is transferred to and processed in the United States. The service is run from Bangladesh, so your data may also be accessed from there to support you and operate the service. Where the law requires a safeguard for these transfers, we put one in place. If your organization needs a data processing agreement, contact us.

Contact Us

Questions about this Privacy Policy or our data practices: