Privacy Policy

Version 1.0. Last updated [DATE].

1. Two different sets of people

This policy covers two groups, and the difference matters.

• You, our customer. You have an AXONIC account. We decide what we collect about you and why, so for your data we are the controller.
• Your end users. If your agent acts on behalf of people using your product, their data passes through AXONIC because you sent it. You decide what is collected and why. We only process it to run the service for you, and we act on your instructions.

2. What we store

Your account

• Email address, and a display name if you give one.
• A password hash, never the password. Hashing is scrypt, and the original cannot be recovered from it.
• The version of the terms you accepted, and when.
• Session records, stored as a SHA-256 of the cookie value rather than the value itself.

Billing

A Stripe customer identifier, your subscription status and the date your paid period ends. Card details never reach us. Payment happens on Stripe's own hosted page, this product has no card field anywhere in it, and there is no code path here that could accept one.

Your workspace

• Projects, tool definitions, connection settings, agent configuration and guardrail rules.
• Credentials for the APIs you connect. These are sealed with an encryption key before they are written to the database, and are decrypted only at the moment a call is made.

The call log and audit trail

This is the part to read carefully. So that you can see what your agent actually did, AXONIC records each brokered tool call: the tool, the validated input, the response body, the outcome, retries, latency, and which of your end users it was scoped to. If the API you connect returns personal data, that data is in the call log.

Privileged actions are also written to an audit log whose rows are hash-chained, so a later edit to the history can be detected.

Operational data

IP addresses on sign-in attempts, for rate limiting and abuse prevention, plus ordinary server logs.

3. Why we hold it

• To run the service you are paying for.
• To bill you, through Stripe.
• To keep accounts secure, including rate limiting sign-ins.
• To show you what your agent did, which is the point of the call log.
• To meet legal obligations such as keeping financial records.

We do not sell your data, we do not use it for advertising, and we do not use your content or call logs to train models.

4. Who else processes it

• Railway, which hosts the application and its database.
• Stripe, which handles payment and holds the card details we never see.
• The model providers you configure, such as Anthropic or OpenAI. Prompts and tool results are sent to whichever provider you choose. Their terms govern what they do with it, so read them.
• The APIs you connect. AXONIC calls them because you told it to, with your credentials.

If you enable off-site backups, encrypted backups are also written to the object storage you configure.

5. How it is protected

• Traffic is served over HTTPS.
• Connection credentials are encrypted before storage and decrypted only in memory, at the moment of use.
• Passwords are scrypt hashes. Session cookies are httpOnly and signed, and only a hash of each is stored.
• Access to your workspace is role-checked on every request, not just hidden in the interface.
• The audit log is tamper-evident. It is not tamper-proof, and we would rather say so than imply otherwise.

6. How long it is kept

• Account and workspace data, while your account exists.
• Call logs and audit rows, until you delete them or close your account.
• Billing records, for as long as tax and accounting law requires.
• After you close your account, we delete or anonymise what we no longer need, other than backups already taken, which age out on their own cycle.

7. Your rights

Depending on where you live, you can ask for a copy of your data, ask us to correct or delete it, or object to some processing. Write to the address below and we will respond within the time the law allows.

If a request concerns one of your end users, they should contact you rather than us, because you decide what is collected about them. We will help you answer.

8. Cookies

One cookie, for your signed-in session. It is httpOnly and signed. There is no advertising or analytics cookie on the application.

9. Changes

We will update this policy as the product changes, and will tell you before a material change takes effect.

10. Contact

Privacy questions and data requests: [CONTACT EMAIL].

Operator: [LEGAL ENTITY NAME AND ADDRESS].

The highlighted fields still have to be filled in, and this has not been reviewed by a lawyer. It is an accurate description of what the software stores, which is the hard part to get right, but it is not legal advice. If you have users in the EU or UK you will also need to decide on a lawful basis and, if applicable, a data processing agreement.