Legal

Privacy policy

Last updated: 2026-05-04

This policy explains how ZFM Alliance SARL ("DexeLabs", "we") processes personal data when you use the DexeLabs service (the "Service") and the website at dexelabs.com. It is intended to comply with Regulation (EU) 2016/679 (the "GDPR") and the French Data Protection Act (Loi Informatique et Libertés).

1. Data controller

The data controller of your personal data is ZFM Alliance SARL, 60, Rue François 1er, 75008 Paris, France. You can reach us by email at hello@dexelabs.com for any privacy-related question.

2. What we collect

Account data

When you create an account, we collect your email address and, if you sign up with an OAuth provider, the name and avatar URL exposed by that provider. If you subscribe to a paid plan via Stripe, we receive the billing first name as part of the checkout completion.

Content you submit

We process the audio files you upload, record or generate, the scripts and prompts you provide, the brand kits you save (colours, fonts), and the videos generated for you.

Usage data

We log technical events necessary to operate the Service: project creation timestamps, render jobs, credit consumption, and error traces. We log IP addresses on authentication endpoints for security purposes.

Payment data

Card payments are handled directly by Stripe; we never see or store your card number. We retain a limited record of each transaction (amount, currency, plan, billing period) needed to manage your subscription and meet our accounting obligations.

3. Why we process your data — and on what legal basis

  • Provide the Service (account, generation pipeline, rendering, downloads) — performance of a contract with you (art. 6(1)(b) GDPR).
  • Bill subscriptions and process payments — performance of a contract and compliance with our accounting and tax obligations (art. 6(1)(b) and 6(1)(c) GDPR).
  • Send service emails (welcome, payment receipts, credit warnings) — performance of a contract.
  • Send product updates and offers to existing paying customers — our legitimate interest in informing you of relevant product news (art. 6(1)(f) GDPR), with an unsubscribe link in every email.
  • Improve and secure the Service (debugging, fraud prevention, abuse detection) — our legitimate interest in delivering a reliable Service.
  • Comply with legal obligations (accounting, lawful requests from authorities) — art. 6(1)(c) GDPR.

4. Sub-processors and third-party providers

We rely on the following sub-processors to operate the Service. Each is bound to confidentiality and security obligations and processes data only on our instructions:

  • Vercel Inc. (United States) — application hosting. Standard Contractual Clauses in place for transfers outside the EEA.
  • Neon, Inc. — managed PostgreSQL (account, project and subscription metadata).
  • Cloudflare, Inc. — R2 object storage for audio and rendered videos.
  • Amazon Web Services, Inc. — Lambda rendering. Renders are run in EU regions where available.
  • Stripe Payments Europe, Ltd. — card payments and subscription management.
  • NowPayments OÜ — cryptocurrency payments for annual plans.
  • Anthropic PBC — large-language-model inference for the AI animation plan and build steps.
  • ElevenLabs Inc. — text-to-speech and transcription. When you connect with your own ElevenLabs API key, your script and audio are sent directly to ElevenLabs under their own terms.
  • Resend, Inc. — transactional and product emails.

5. International transfers

Some of our sub-processors are located outside the European Economic Area, primarily in the United States. Where applicable, transfers are framed by Standard Contractual Clauses adopted by the European Commission, and by additional technical measures (encryption in transit and at rest). You can request a copy of the relevant safeguards by contacting us at hello@dexelabs.com.

6. How long we keep your data

  • Account data: for the lifetime of your account. When you close your account, we delete identifying account data within thirty (30) days, except where a longer retention is required by law (typically ten (10) years for accounting records and invoices under French commercial law).
  • Project content (audio, videos, brand kits): retained while your account is active. After account closure, we delete project content within thirty (30) days, unless you have asked us to keep it longer.
  • Server logs: retained for up to twelve (12) months for security and debugging.

7. Your rights

Under the GDPR, you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data deleted (right to erasure);
  • restrict or object to certain processing;
  • receive a copy of your data in a portable format;
  • withdraw consent at any time for processing based on consent;
  • define directives concerning the fate of your data after your death (right under article 85 of the French Data Protection Act).

You can exercise any of these rights by writing to hello@dexelabs.com from the email address associated with your account. We will respond within one (1) month.

If you believe we are not complying with applicable data-protection law, you may lodge a complaint with the French data-protection authority, the CNIL (cnil.fr).

8. Security

We apply state-of-the-art technical and organisational measures to protect your data, including encryption in transit (TLS), encryption at rest for stored objects, segregated production and development environments, and least-privilege access controls. No system can be guaranteed 100% secure: in the event of a personal-data breach likely to result in a risk to your rights, we will notify you and the CNIL in accordance with articles 33 and 34 GDPR.

9. Cookies

Our use of cookies and similar technologies is described in our Cookie policy.

10. Changes to this policy

We may update this policy when our practices or the applicable law evolve. The updated version takes effect on the date stated at the top of this page. For material changes, we will notify you by email.

11. Contact

Questions about this policy: ZFM Alliance SARL, 60, Rue François 1er, 75008 Paris, France — hello@dexelabs.com.