1. Who we are
DXBUILDER is the data controller for the personal data described in this policy. We are registered in France at 9 Rue M. Ravel, 91000 Évry-Courcouronnes, under RCS 102 419 793 Évry, and we process personal data in accordance with the General Data Protection Regulation (GDPR). You can reach us about anything in this policy at support@dxbuilder.io.
2. What we collect
Account and identity: your name, email address, password (stored only as a cryptographic hash), and — if you sign in with Google — the account identifier Google returns to us. If you complete a public profile we also store your username, biography and avatar image. We record the IP address used at registration and your interface language.
Billing and credits: your credit balance, purchase and renewal history, subscription status, and each credit transaction. Card details are entered on Stripe's systems and are never transmitted to or stored on ours; we retain only the payment amount, currency and Stripe's transaction reference.
Content you create: the images you upload, the prompts and instructions you write, and the images, videos, characters, avatars, voice and music we generate for you — together with any posts, comments, likes or contest entries you publish in the community area.
3. Why we process it
We process your account data to operate your workspace and authenticate you; your billing data to take payment, apply credits and meet accounting obligations; your content to render what you ask for and make it available in your library; and technical usage data to keep the service working and to understand which parts of it are used.
We do not sell personal data, and we do not use your content to train our own models.
4. Who we share it with
We share data only with the providers that make the service work, and only what each one needs. Every provider acts as a processor on our instructions:
- Stripe — payments, invoicing and tax handling.
- Cloudflare — content delivery and encrypted R2 object storage, where your generated files are held.
- AI model providers — Google (Gemini), ByteDance (Seedance), Alibaba Cloud (Wan and Qwen), Hedra, MiniMax, Suno and Topaz. They receive only the prompt text and the reference images needed to render what you requested. Resend delivers our transactional email, and Google also provides optional sign-in.
5. Your rights
You have the right to access your data, correct it, have it erased, restrict or object to how we use it, and receive it in a portable format. Write to support@dxbuilder.io from your account email and we will respond within one month. You can delete your account at any time, which erases your profile, your content and your generation history.
Privacy contact: support@dxbuilder.io
6. Legal basis
We rely on a different legal basis depending on what we are doing:
- Performance of a contract — creating and running your account, generating what you ask for, and taking payment.
- Legal obligation — keeping invoices and accounting records for the period French law requires.
- Consent — advertising and measurement cookies, and marketing email. You can withdraw consent at any time without affecting the service.
- Legitimate interests — keeping the platform secure, preventing abuse of free credits, and understanding aggregate usage. We balance these against your rights and you may object.
7. How long we keep it
- Account data — for as long as your account exists, and deleted when you close it.
- Generated content — kept while your account is active. On the free tier, content may be removed after 30 cumulative days of inactivity to free storage.
- Payment and invoice records — retained for the statutory accounting period, even after you close your account, because we are required to keep them.
- Usage and visit logs — retained in a form that includes a hashed IP address, country and referrer, for service security and analytics.
- Backups — encrypted database snapshots are kept for seven days locally and seven days off-site. Deleted data disappears from backups as those rotate.
8. Transfers outside the European Union
Some of our providers process data outside the EU — in particular the AI model providers operating from the United States and China, and our storage and payment providers. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard. You may ask us for details of the safeguard applying to a specific provider.
9. Cookies and measurement
Essential cookies keep you signed in and remember your consent choice; they cannot be switched off without breaking the service. Google, Meta and Pinterest advertising and measurement cookies are set only after you accept them in the banner. You can change your choice at any time through the "Manage cookies" link in the footer. Our analytics are cookieless and do not identify you individually.
10. Security
Traffic is encrypted in transit, passwords are stored only as hashes, and generated files are held in encrypted storage. Access to production systems is restricted. No system is perfectly secure, and if a breach ever affects your rights we will notify you and the supervisory authority as the GDPR requires.
11. Children
The service is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, write to support@dxbuilder.io and we will remove it.
12. Changes and complaints
When we change this policy we update the date at the top of the page, and we tell you directly if the change materially affects how we use your data.
If you are unhappy with how we handle your data, please contact us first at support@dxbuilder.io. You also have the right to complain to the French supervisory authority, the Commission Nationale de l'Informatique et des Libertés (CNIL), at cnil.fr.