Privacy Policy

1. Scope of This Policy

This policy covers three groups of people, and treats them differently:

• Visitors to dossx.com — anyone browsing the DossX site, requesting a call, or filling out the contact form.
• Clients — businesses with an active DossX engagement on one or more products. For most products, DossX acts as a data processor for the client's own business data (site content, call logs, documents, leads, workflow output); the client is the data controller for that data.
• End users of a DossX-powered product — the customers, callers, or site visitors a client's business interacts with through a DossX product (a caller to Frontdesk, a visitor to a DossX CMS site, a follower reached through Broadcast). Their data is controlled by the client whose business they're interacting with, not by DossX directly, except where this policy says otherwise.

2. Information We Collect

Information you give us directly

• Account information — name, email, company, and password when you sign up for a product
• Billing information — processed by our payment processor (Stripe); DossX does not store full card numbers
• Business content — site content, documents, brand and workflow material you provide for any product to work with
• Communications — anything you send us via the contact form, a call request, or support

Information collected automatically

• Usage data — features used, dashboards viewed, general interaction patterns within a product's admin
• Device and log data — browser type, IP address, referring URLs, timestamps
• Cookies and similar technologies — see Section 4

Data each product collects on your behalf

Every product touches a different kind of data from your own customers or business: DossX CMS handles site visitor and order data; Frontdesk handles call recordings, transcripts, and booking details; Broadcast handles the content and social account connections it publishes through; Vault handles the documents you ingest; Prospector handles the lead and contact data it researches; Crew handles whatever inputs and outputs its configured workflow produces. In every case, that data belongs to you as the client — DossX processes and stores it on your behalf as described in Section 1.

3. How We Use Information

• To provide, maintain, and improve every DossX product
• To process payments and manage build fees and retainers
• To respond to support requests and inquiries
• To send account-related communications (billing notices, security alerts, service updates)
• To send product or marketing emails, which you can opt out of at any time
• To detect, investigate, and prevent fraud, abuse, or security incidents
• To generate AI-assisted output — drafted content, call handling, research, workflow steps — as described in Section 5

4. Cookies & Tracking Technologies

dossx.com uses cookies for essential site functionality and, where enabled, analytics to understand how visitors use the site. Sites built on DossX CMS may use their own cookies, configured by the client who runs that site. You can control cookies through your browser settings; blocking essential cookies may affect how a product's admin functions.

5. AI Features & Data Handling

Every DossX product uses automated systems to do its job. Here's how data moves through them:

• Drafted or generated output — written content, call responses, research summaries, workflow results — is produced from the business data and context you provide.
• Where a product is meant to produce something a human reviews before it goes out (content drafts, workflow deliverables), it's built that way by design — DossX doesn't auto-publish or auto-send without an approval step where one is expected.
• On multi-site or multi-client accounts, each client's data and conversational context (a DossX CMS chatbot, a Frontdesk call history, a Vault workspace) is isolated from every other client's, enforced in code.
• Underlying automated processing may involve sending relevant data to a model provider under a data processing agreement; DossX does not permit that provider to use client data to train models available to other companies.
• Clients can request that automated features be scoped down or disabled for their account.

6. How We Share Information

We don't sell personal information. We share it only in these situations:

• Service providers — payment processing (Stripe), telephony, email delivery, hosting and infrastructure, and the model provider described in Section 5, each bound by their own confidentiality and data-handling obligations
• Legal requirements — if required by law, subpoena, or to protect the rights, safety, or property of DossX, our clients, or the public
• Business transfers — if DossX is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction, subject to this policy or a comparable one
• With your direction — anywhere you explicitly ask us to share it

7. Data Retention

We keep account and business data for as long as an engagement is active. After termination or cancellation, clients have 30 days to export their content before it and associated data are permanently deleted. We retain some information longer where required for legal, tax, or security purposes.

8. Data Security

We use technical and organizational measures — encryption in transit, access controls, role-based permissions, and per-client data isolation — to protect information against unauthorized access, alteration, or loss. No system is completely secure, and we can't guarantee absolute security, but we treat this seriously and respond promptly to any confirmed incident.

9. Your Rights & Choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your information, subject to legal retention requirements
• Export your data in a portable format
• Opt out of marketing communications at any time
• Object to or restrict certain kinds of processing

To exercise any of these rights, contact us using the details in Section 13. If your data is held within a client's product account rather than by DossX directly (see Section 1), we'll direct your request to that client, who controls it.

10. Children's Privacy

DossX products are not directed to children, and we do not knowingly collect personal information from children under 13 (or the minimum age required by your local law). If you believe a child has provided us with personal information, contact us and we'll remove it.

11. International Data Transfers

Information may be processed and stored in countries other than your own. Where required, we rely on appropriate safeguards for these transfers. Specific mechanisms (such as standard contractual clauses) depend on where you and your data are located — contact us if you need details for your jurisdiction.

12. Changes to This Policy

We may update this policy as our products evolve. Material changes will be reflected by an updated "Last updated" date at the top of this page, and, where required, we'll provide additional notice.

13. Contact Us