Get started
07 / Legal

Privacy policy

Last updated 2026-04-02

1. What we collect

  • Account information. Name, email address, and company name provided during registration via Google OAuth.
  • CRM data. When you connect your CRM (Salesforce, HubSpot, or another supported platform), we access object metadata, field schemas, and record data as authorized by your OAuth permissions. Used exclusively to train models and generate scores for your organization.
  • Model configuration. Score definitions, success criteria, field selections, and filter rules you configure within the platform.
  • Usage data. Pages visited, features used, and actions taken in the product.
  • Technical data. Browser type, device information, IP address, and error logs.

2. How we use your data

  • Provide the predictive scoring service, including training models and generating scores.
  • Display analytics, dashboards, and model results.
  • Write scores back to your CRM fields when you configure this feature.
  • Improve platform reliability, performance, and user experience.
  • Communicate with you about your account, service updates, and support requests.
  • Process payments and manage your subscription.
  • Comply with legal obligations.

We do not sell your data. We do not use your data to train models for other customers. We do not perform cross-customer data analysis.

3. CRM data handling

  • Read access is used to retrieve schemas, field metadata, and records for model training.
  • Write access (when granted) is used only to update designated score fields in your CRM.
  • CRM connections can be revoked at any time from within ax1om or from your CRM provider's settings.
  • Upon disconnection, cached CRM data is purged within 24 hours.
  • We do not store raw CRM records long-term. Data is processed for model training and the trained model artifacts (not raw data) are retained.

4. AI and machine learning

  • ax1om uses machine learning (LightGBM) to build predictive models from your CRM data.
  • Models are trained on your data and scoped exclusively to your organization. No customer data is shared across organizations or used to train shared models.
  • The platform may include an AI assistant powered by Anthropic's Claude. Conversations with the assistant may be processed by Anthropic's API subject to their data processing terms.
  • The assistant does not have persistent memory of your data between sessions beyond what is provided in the current conversation context.

5. Data storage and security

  • All customer data is hosted on Google Cloud Platform (GCP) in the United States, specifically us-central1.
  • Encryption in transit: TLS 1.2 or higher for all connections.
  • Encryption at rest: AES-256 for stored data.
  • Token storage: OAuth tokens and API keys stored in Google Cloud Secret Manager, separate from application data.
  • Access controls: organization-scoped data isolation at the database and storage level, with no cross-tenant data access.
  • Infrastructure: Google Cloud Run (serverless), Supabase (managed PostgreSQL), Google Cloud Storage.

For detailed security information, visit ax1om.ai/security.

6. Cookies and tracking

  • PostHog analytics. We use PostHog to collect usage analytics including page views, feature usage, and user interactions. PostHog data is hosted in the United States. PostHog may set cookies or use local storage to track sessions.
  • Authentication cookies. We use local storage tokens to maintain your authenticated session.
  • No third-party ad tracking. We do not use advertising trackers, retargeting pixels, or share usage data with advertising networks. You can disable PostHog tracking via a browser extension without affecting platform functionality.

7. Third-party services

  • Google Cloud Platform. Hosting, storage, compute for all platform data.
  • Supabase. Database for account and model data.
  • Anthropic (Claude). AI assistant conversation context only.
  • Stripe. Payment processing for billing information.
  • PostHog. Product analytics for usage events.
  • Resend. Transactional email delivery.
  • Cloudflare. CDN and DDoS protection for network traffic metadata.
  • Salesforce and HubSpot. CRM integration via OAuth tokens and score values on writeback.

We do not sell data to third parties.

8. Data retention

  • Account data. Retained while active, deleted within 30 days of account closure.
  • CRM data cache. Purged within 24 hours of CRM disconnection.
  • Model artifacts. Retained until you delete them or close your account.
  • AI assistant conversations. Retained for 90 days, then automatically deleted.
  • Usage analytics. Retained for 24 months, then anonymized or deleted.
  • Billing records. Retained as required by tax and accounting regulations (typically 7 years).

9. Your rights

  • Access your data via the platform's admin console and data export features.
  • Delete your account and data by contacting [email protected] or through in-app account settings.
  • Disconnect your CRM integration at any time, immediately revoking ax1om's access.
  • Export your model configurations and results.
  • Object to specific processing activities by contacting us at [email protected].

10. GDPR (European users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland:

  • Legal basis: contractual necessity, legitimate interest, and consent where applicable.
  • Data controller: ax1om, LLC for account and usage data. For CRM data, you are the data controller and ax1om is the data processor.
  • A Data Processing Agreement is available on request for Enterprise customers. Contact [email protected].
  • International transfers are governed by Standard Contractual Clauses (SCCs).
  • You have the right to lodge complaints with your local data protection authority.

11. CCPA (California users)

If you are a California resident, you have additional rights under the CCPA:

  • Right to know the categories and specific pieces of personal information we collect.
  • Right to delete your personal information, subject to certain exceptions.
  • Right to opt out of sale. We do not sell personal information, so no opt-out is necessary.
  • Right to non-discrimination for exercising your CCPA rights.

To exercise these rights, contact [email protected].

12. Children's privacy

ax1om is a business-to-business platform designed for professional use. The service is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 16, we will delete it promptly.

13. Changes to this policy

We may update this privacy policy from time to time. We will notify you of material changes via email or in-app notification at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.