- Who we are
- What we collect
- How we use it
- Services we share data with
- Google user data
- Text messages and phone calls
- Retention
- Your choices and rights
- Security
- Age requirement
- Changes to this policy
- Contact
Who we are
Daxus (“Daxus”, “we”, “us”) is a marketing-agency software platform available at daxuspro.com. It is operated by TCBKitt, PO Box 147, Georgetown, TX 78626. You can reach us about anything in this policy at hello@daxuspro.com.
Daxus is used by marketing agencies and the local service businesses they work for (“clients”). Through the platform, an agency manages a client’s marketing and the client sees that work in a live portal: leads, appointments, review requests, messages, quotes, campaign results and the like. Much of the personal data in the platform therefore belongs to a client’s own customers, and is entered or collected by the agency or the client on their behalf.
What we collect
Account information
When you are given access to the portal we hold your name, email address, role, and, if you provide one, your mobile number and your notification preferences. Sign-in is handled by Clerk (see below); Daxus does not store your password.
Client business information
The business details an agency records for a client: business name, address, phone numbers, email addresses, logo, website, Google Business Profile details, time zone, service offerings, and settings such as booking hours and message templates.
Customer information
Information about a client’s customers and prospects, entered by the agency or the client or submitted by the customer themselves through a booking or website form: name, phone number, email address, the service requested and notes about it, appointment dates and times, whether the customer has agreed to receive text messages (and the wording they saw when they did), satisfaction flags, review requests and their outcomes, private feedback, and the content of text-message and email conversations with the business.
Calls
Where a client uses call tracking, we hold the caller’s phone number, the time and duration of the call, the caller’s approximate location (city and state, as provided by the carrier), and, where call recording is enabled, a recording of the call. See Text messages and phone calls.
Reviews
Published reviews of a client’s business from Google Business Profile: the reviewer’s display name, star rating, review text, date, and any owner reply.
Quotes and payments
Quotes and invoices a business sends its customers: line items, prices, the name and email address of the person who accepted or signed, and payment status. Payments are processed by Stripe. Daxus never receives or stores card numbers or bank details.
Technical information
Standard server logs and session cookies needed to keep you signed in. Public booking pages record the visitor’s IP address for a short period to limit abuse of the form.
How we use it
- To provide the platform: showing an agency and its clients the work being done, scheduling and confirming appointments, sending reminders, requesting reviews, routing calls, and sending quotes and receipts.
- To send notifications the business has asked for, such as a text or email when a new lead arrives.
- To keep the platform secure, prevent abuse, and diagnose problems.
- To meet our legal obligations, including record-keeping of consent to receive text messages.
We do not sell personal data, and we do not use it for advertising.
Services we share data with
Daxus runs on, and sends data to, the services below. Each receives only what it needs to do its job, and each is bound by its own privacy terms.
- Clerk — authentication. Handles sign-in by email and password, one-time email code, or Google account, and holds the credentials Daxus never sees.
- Google — sign-in with a Google account (through Clerk), and Google Calendar, which a business can connect so customers can book open times directly onto its calendar. Described in full in Google user data.
- Twilio — text messages and phone calls: sending and receiving SMS, forwarding tracked calls, and recording calls where enabled.
- Resend — email: portal invitations, notifications, review requests, appointment reminders, quotes and receipts.
- Stripe — payments on quotes and invoices. A business connects its own Stripe account and payments go to it directly. Stripe receives the payer’s details; Daxus receives confirmation that a payment happened.
- Zernio — reads a business’s published Google Business Profile reviews into the portal and posts the owner’s replies back to Google on the business’s behalf.
- Instantly — where an agency runs a cold-email program for a client, replies to those campaigns (the sender’s email address and message) flow into the client’s portal.
- Sentry — error reporting. When something breaks, technical details about the error are sent to Sentry so we can fix it. Before anything is sent we remove email addresses, phone numbers, customer names held in contact fields, and the access codes in links that open customer quotes.
- Supabase — the database and file storage the platform runs on. Vercel — hosting for the application.
We may also disclose data when required by law, to protect the rights and safety of Daxus, its users or others, or as part of a merger, acquisition or sale of assets, in which case this policy would continue to apply to the data transferred.
Google user data
Daxus lets a business connect its own Google Calendar so that its customers can book an available time on a public booking page. This section describes exactly what Daxus asks for from Google, what it does with it, and what it does not do.
What we request
When a business connects a calendar, Daxus requests the https://www.googleapis.com/auth/calendar.events scope — permission to view and edit events on that calendar — plus the connected account’s email address so the business can see which account it connected. We do not request access to other Google services, to the contents of other calendars, or to create or delete calendars.
What we do with it
- Reading availability. To show open times, Daxus reads the events on the connected calendar for the dates being offered and works out which periods are busy. Only the busy periods are used; event titles, descriptions, attendees and other details are not stored.
- Writing bookings. When a customer books, Daxus creates one event on the connected calendar for that appointment and keeps that event’s identifier so the appointment and the calendar entry can be kept in step.
- Keeping the connection working. Daxus stores the credential Google issues, encrypted, so the connection keeps working without the business signing in again. It is used only for the two purposes above.
What we do not do
- We do not use Google user data for advertising, and we do not sell it.
- We do not transfer it to anyone other than the service providers needed to operate the feature, and then only as necessary to provide it.
- Daxus personnel do not access Google user data except with the business’s explicit permission, where necessary for security or to investigate abuse, to comply with law, or for internal operations on data that has been aggregated or anonymized.
- We do not use Google user data to build or improve models or any other product.
Limited Use
Daxus’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting
A business can disconnect its calendar at any time from the portal’s calendar settings, which deletes the stored credential, or by removing Daxus’s access from its Google account permissions. Either stops all access immediately. Bookings already made remain in the portal; no further calendar events are read or written.
Text messages and phone calls
Businesses on Daxus send text messages to customers who have agreed to receive them — appointment confirmations and reminders, review requests, booking links and replies to messages the customer sent. We keep a record of the consent given — when it was given, through which form, and the wording the customer saw. Every message includes the business’s name and a reply-STOP opt-out, and a reply of STOP ends further messages from that business.
Where a business uses call tracking, calls to its tracking number are forwarded to its real line. Where recording is enabled, callers hear a notice that the call may be recorded before it connects. Recordings are used by the business to review its own calls and for no other purpose.
Retention
We keep data for as long as the relevant account is active and as needed afterwards to meet legal and accounting obligations, resolve disputes and maintain backups. Records of consent to receive text messages are kept for as long as applicable law requires. When an agency ends its use of Daxus, or a client is removed from the platform, their data is deleted on request as described below.
Your choices and rights
Depending on where you live you may have the right to access, correct, export or delete personal data we hold about you, or to object to or restrict how it is used. To make a request, email hello@daxuspro.com from the address associated with your account. If you are a customer of a business that uses Daxus, you can also contact that business directly, and we will help it respond. We will verify your identity before acting and respond within the time the applicable law allows.
You can stop text messages from any business by replying STOP. You can disconnect a Google Calendar as described above. You can ask for your portal account to be closed at any time.
Security
Data is encrypted in transit and at rest. Credentials for connected services are stored encrypted, with keys held outside the application code. Access to data in the portal is restricted by role, so an agency sees only its own clients and a client sees only its own business. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.
Age requirement
Daxus is a business tool intended for businesses and for users aged 18 or older. It is not directed to minors, and Daxus does not knowingly collect personal information from anyone under 18. Consistent with COPPA, Daxus does not knowingly collect personal information from anyone under 13, and deletes any such information if it is discovered. If you believe personal information about a minor has been provided to Daxus, contact hello@daxuspro.com and we will remove it.
Changes to this policy
We will update this page when the platform changes in a way that affects it, and change the date at the top. Material changes will be announced to account holders by email.
Contact
Questions, requests and complaints about privacy: hello@daxuspro.com. Or write to TCBKitt, PO Box 147, Georgetown, TX 78626.