Privacy Policy

Who We Are

heydex.ai ("Dex") is operated by Dave Killeen, based in the European Union. For any privacy-related questions, you can reach us at dave@heydex.ai.

What We Collect

We collect the following information when you use Dex:

• OAuth profile data — your name, email address, and profile photo, provided by your identity provider (Google, Microsoft, or Apple) when you sign in.
• LinkedIn data — job title, company, industry, seniority level, and professional summary, only when you voluntarily provide or authorise access to this information.
• Email domain — extracted from your verified email address and used for automatic company grouping.
• Usage data — the diffs you publish or adopt, adoption status, and related activity within the platform.
• Marketing preference — your opt-in or opt-out choice for marketing communications.
• Registration source — how you arrived at Dex (e.g. referral, direct, CLI).

Why We Process Your Data

• Service provision (contractual basis) — to operate your account, store your diffs, and deliver the core Dex service.
• Company grouping (legitimate interest) — to organise users by verified work email domain so teams at the same company can discover shared methodologies.
• Marketing (consent) — to send product updates and relevant communications. For users in the EU, marketing is strictly opt-in.
• Product improvement (legitimate interest) — to measure how Dex and heydex.ai are used (screens opened, features used, counts and outcomes) so we can improve them. Analytics never includes the content of your diffs. You can object at any time (see Your Rights below).

Our Processors

We use the following third-party services to operate Dex:

• Convex — database and backend infrastructure, hosted in EU West 1.
• Exa AI — LinkedIn profile enrichment, used only when you provide LinkedIn data.
• Google, Microsoft, Apple — OAuth identity providers for sign-in.
• Pendo — product analytics for heydex.ai and the Dex application. When you are signed in, your usage is linked to your account email so we can understand how the website and the application are used together. Analytics never includes the content of your diffs or your vault.

We do not sell your data to anyone.

Data Retention

We retain your data for as long as your account is active. When you delete your account, all associated data is permanently deleted — including your profile, published diffs, adoption records, and any company grouping information.

Your Rights (GDPR Articles 15-22)

If you are in the EU or EEA, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct any inaccurate or incomplete data.
• Erasure — request deletion of your personal data.
• Portability — receive your data in a structured, machine-readable format.
• Restriction — request that we limit how we process your data.
• Withdraw consent — withdraw any consent you have given at any time.
• Lodge a complaint — file a complaint with your local supervisory authority.

To exercise any of these rights, contact us at dave@heydex.ai.

Local Storage

We store an authentication token, your consent preference, and an anonymous analytics identifier in your browser's local storage. We use Pendo for product analytics, which may set its own cookies or local storage to measure how the site is used. We do not use advertising or cross-site tracking cookies, and we do not sell your data.

International Transfers

Dex is hosted in the European Union (Convex EU West 1). Exa AI may process data outside the EU under standard contractual clauses. OAuth providers (Google, Microsoft, Apple) operate globally and are subject to their own privacy policies and transfer mechanisms.

Changes to This Policy

If we make material changes to this privacy policy, we will notify registered users by email. We encourage you to review this page periodically.