This Privacy Policy explains how DEXY ("DEXY", "we", "us", or "our") collects, uses, shares, and protects your personal data when you visit our website, join our waitlist, or use our services. We are committed to handling your data lawfully, transparently, and only for the purposes described here.

1. Who we are

DEXY is a proptech intelligence platform that helps people find property by its potential. DEXY is operated by Dexy App Pty Ltd (ACN 698 672 374), an Australian company. Dexy App Pty Ltd is the entity responsible for your personal data — the "data controller" for the purposes of the EU and UK General Data Protection Regulation ("GDPR"), and the "APP entity" under the Australian Privacy Act 1988. You can reach us about any privacy matter at legal@dexyapp.ai.

2. Scope

This policy applies to a global audience. Depending on where you live, you may have specific rights under local law — including the Australian Privacy Act 1988 and its Australian Privacy Principles ("APPs"), the GDPR (Europe and the UK), and the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA"). Where those laws grant you stronger protections, we apply them.

3. Information we collect

We collect only what we need, and we tell you why.

Waitlist data. When you join the waitlist, we collect your email address. We also automatically log basic technical metadata with the request (such as the time of signup and your browser's user-agent string) to operate the service and prevent abuse.
Account & product data (at launch). When DEXY launches, we will collect the details you provide to create an account and the property brief you set (such as your goals, budget, and preferences) so we can score listings for you.
Usage data. We may collect aggregated, largely anonymous information about how the site is used to improve it.

We do not knowingly collect special categories of sensitive personal data, and we ask that you do not send any to us.

4. How we use your data

To add you to the waitlist and notify you when your access opens.
To provide, maintain, and improve our services and website.
To respond to your enquiries and provide support.
To protect against fraud, abuse, and security risks.
To comply with legal obligations.

5. Legal bases for processing (GDPR)

Where the GDPR applies, we rely on the following legal bases:

Consent — for joining the waitlist and receiving related communications. You can withdraw consent at any time.
Contract — to provide a service you have signed up for.
Legitimate interests — to secure, operate, and improve our services, balanced against your rights.
Legal obligation — where we must process data to comply with the law.

6. Cookies and analytics

Our website uses only essential functionality and does not set advertising cookies. If we introduce analytics or non-essential cookies, we will request your consent first where required and update this policy accordingly.

7. How we share your data

We do not sell your personal data, and we do not "share" it for cross-context behavioural advertising as defined under the CCPA/CPRA. We disclose data only to:

Service providers (processors) who help us run DEXY — for example, our hosting and database provider (Cloudflare) and email delivery providers — under contracts that require them to protect your data and use it only on our instructions.
Authorities or third parties where required by law, or to protect our rights, users, or the public.
A successor entity in the event of a merger, acquisition, or sale of assets, subject to this policy.

8. International data transfers

DEXY operates globally and uses infrastructure that may process data outside your country, including in the United States. Where we transfer personal data out of the European Economic Area or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

9. Data retention

We keep waitlist data until you ask us to remove it or until it is no longer needed for the purpose it was collected. Account and product data is retained for as long as your account is active and for a reasonable period afterwards to meet legal, accounting, or reporting requirements.

10. Security

We use technical and organisational measures appropriate to the risk — including encryption in transit and access controls — to protect your data. No method of transmission or storage is perfectly secure, but we work to protect your information and to notify you and regulators of any breach where the law requires.

11. Your rights in Europe and the UK (GDPR)

If you are in the EEA or UK, you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased ("right to be forgotten");
restrict or object to processing;
data portability;
withdraw consent at any time, without affecting prior processing; and
lodge a complaint with your local data protection authority.

To exercise any of these rights, email legal@dexyapp.ai.

12. Your rights in California (CCPA/CPRA)

If you are a California resident, you have the right to:

know what personal information we collect, use, and disclose;
request deletion of your personal information;
request correction of inaccurate personal information;
opt out of the sale or sharing of personal information — note that we do not sell or share your personal information; and
not be discriminated against for exercising your privacy rights.

You may submit a request yourself or through an authorised agent by emailing legal@dexyapp.ai. We will verify your request before acting on it.

13. Your rights in Australia (Privacy Act / APPs)

If you are in Australia, under the Australian Privacy Principles you have the right to:

access the personal information we hold about you;
ask us to correct information that is inaccurate, out of date, or incomplete;
ask how we handle your personal information; and
make a complaint about how we have handled your personal information.

To exercise these rights, email legal@dexyapp.ai. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

14. Children's privacy

DEXY is not directed to children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

15. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of DEXY after an update means you accept the revised policy.

16. Contact us

For any question about this policy or your personal data, contact Dexy App Pty Ltd (ACN 698 672 374) at legal@dexyapp.ai. If you are in the EEA or UK and we are required to appoint a representative, their details will be listed here.