Who we are
Dipexer is a service for creating presentations with AI, and the controller of the personal data the service processes. This processing is subject to the Personal Data Protection Law of the Kingdom of Saudi Arabia and its regulations. For anything about your data: [email protected].
The data we process
| Data | When | Why |
|---|---|---|
| Name and email, and the account's plan and status (email confirmed, suspended) | When you create and use an account | To run your account and write to you about it |
| Password | When you sign up with email | To sign in. Stored as an irreversible argon2 hash, never in its original form |
| Google account ID, name and email | When you sign in with Google | To sign in without a password, linked to your account if you have one with the same email |
| Your agreement to the terms, with its version and date | When you sign up or when the terms change | To record your agreement |
| The description you write, the decks and pictures produced and your edits, any pictures or logo you upload, and any personal data of others you put in them | When you use the service | To create, save and export your decks |
| The last time a deck's page was open while it was being made | While a deck is being made | To send the "your deck is ready" email only if you left the page |
| The language you choose | When you choose a language | To show the interface and send messages in it |
| The number and cost of decks and AI edits | When you use the service | To apply plan limits and track costs |
| Subscription and payment data: subscription ID, status and renewal date, and each payment's ID, amount and date | When you subscribe to Pro | To start, renew and cancel the plan, and for accounting records. Your card details never reach us, and we do not keep your PayPal account details |
| Sign-in sessions, and email confirmation and password reset links | When you sign in or request links | To keep you signed in and complete confirmation and resets. Stored hashed |
| IP address, and the email typed in sign-in and password reset attempts | When you sign up, sign in or request links | To protect against repeated attempts and fraud |
| Information about your device, browser and interaction with the page, and IP address | When you open the sign-up, sign-in or password reset pages | To tell people from bots, through Google reCAPTCHA |
| Technical logs: IP address and requested pages, account and deck identifiers, reCAPTCHA results and error messages | When you use the website and app | Security and troubleshooting |
We do not sell your data or use it for advertising.
Legal bases for processing
- Performing our agreement with you: creating and running your account, creating, saving and exporting your decks, your Pro subscription, and messages about the service.
- Legitimate interest: protecting the service and its users from fraud and attacks (rate limits, reCAPTCHA, technical logs), and tracking usage and costs. We do not process sensitive data on this basis.
- Legal obligation: what the law requires of us, such as keeping accounting records and responding to requests from competent authorities.
- Consent: when you choose to sign in with Google. You can withdraw it by writing to us or by deleting your account, without affecting what was done before, or processing we carry out on another basis.
Cookies and browser storage
We use only these necessary cookies, and no tracking or advertising analytics:
dx_session: keeps you signed in, for 30 days or until you sign out.dx_oauth: temporary, 10 minutes, while signing in with Google, to protect it from tampering.dx_lang: remembers the interface language you chose, for one year.
On the sign-up, sign-in and password reset pages, Google reCAPTCHA may set its own cookies (such as _GRECAPTCHA), for security. Your browser also keeps your decks' pictures temporarily so they open faster; you can clear them in your browser settings.
Service providers
We rely on the following providers to run the service. They process data on our behalf, and Google and Cloudflare also process some of it under their own policies, while PayPal is an independent controller:
- Microsoft Azure: runs our servers and database. Through a gateway we operate, the deck description, slide text and picture descriptions are sent to it, so AI models can write the content and create the pictures. Microsoft's terms for Azure AI services state that this data is not used to train the models; Microsoft may keep some of it temporarily to monitor abuse.
- Resend: sends our emails: email confirmation, password reset and password change notices, and notices that a deck is ready or could not be created. Your name, email and the message content, including links and the deck title, are sent to it.
- Google: when you sign in with Google, and for the reCAPTCHA check, which loads when you open the sign-up, sign-in or password reset pages; we send Google the check token and your IP address to verify it, under the Google Privacy Policy and Terms of Service.
- Cloudflare: the website's and app's requests and their content pass through it, to deliver and protect them.
- PayPal: when you subscribe to Pro, you enter your payment details with PayPal directly, which processes them as an independent controller under its privacy policy. It sends us the subscription ID, its status and the details of each payment.
Where your data is processed
Your data is stored and processed on Microsoft Azure servers in the European Union (Sweden), and the providers above may process some of it in other countries; in other words, your data is transferred outside the Kingdom of Saudi Arabia. We limit the transfer to what is needed to provide and protect the service, and rely on the contractual safeguards of these providers, as required by the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom.
Retention and deletion
- Your account and its decks: as long as the account exists.
- Deleting a deck: the deck and its pictures are deleted immediately; its usage record (without its content) stays to count the month's limits, until you delete your account.
- A picture you remove from a slide: stays among the deck's files so you can undo, and is deleted with the deck or the account.
- Deleting your account: from your "Account" page; your PayPal subscription, if any, is cancelled, and the account, its decks, pictures, usage record and sessions are deleted from our live systems immediately. Copies remain in backups until they are deleted automatically, and in technical logs until they are overwritten. What reached you by email or your browser kept stays with you.
- Payment records (payment ID, amount and date): kept for as long as accounting and tax laws require, and kept after you delete your account without being linked to it.
- Backups: on our server, at most 14 days for the database and at most 7 days for pictures, then deleted automatically.
- Rate-limit counters (IP address and email): deleted automatically within two days.
- Temporary sign-in data (confirmation and reset links, expired sessions, temporary Google sign-in data): deleted automatically within two days of expiring.
- Technical logs: kept at a limited size, the oldest overwritten automatically, so how long they last depends on usage.
Your rights
Under the Personal Data Protection Law, you have the right:
- To know how we process your data; this policy is for that.
- To see your data and receive a copy of it.
- To ask for it to be corrected or updated.
- To ask for it to be destroyed: delete any deck or your whole account yourself, or write to us to delete specific data.
- To withdraw your consent where we rely on it.
To exercise your rights, write to [email protected]; people without an account can too, such as someone whose data appears in a deck made by someone else. We verify your identity in proportion to the request and carry it out within 30 days, which we may extend as the law allows, telling you why. We may keep some data where a law requires it. You may also complain to the Saudi Data and AI Authority (SDAIA).
Security
We protect your data with encrypted connections (HTTPS), hashed passwords, session tokens and links, rate limits, and a database that is not exposed to the internet. Only the service's administrator can see account data, as far as needed to run the service.
If a breach of your data occurs, we handle it as the law requires: we notify the competent authority within 72 hours of becoming aware of it where required, and tell you without undue delay if it may harm you.
Children
The service is for people aged 18 and over; if we learn of an account belonging to someone younger, we delete it.
Changes and language
We publish any change on this page with its date, and ask for your agreement again to any material change. This policy is available in Arabic and English; the Arabic version prevails in case of any difference.