Privacy policy

Axis stores the data it needs to run your workspace and nothing more:

• Your account. Your name, email address, an optional phone number and username, your profile photo if you add one, and your settings. Like profile pictures on most services, a photo you upload can be viewed by anyone who has its address. If you sign in with Google or GitHub we receive your name, email address and picture from them; we never see your password for those services.
• Workspace content. Everything you and your team put into a workspace: projects, tasks, milestones, opportunities, notes, whiteboard items, ideas, meeting agendas and notes, comments, and the names of the people they are assigned to.
• Chat. Messages in channels, group chats and direct messages, with their threads, reactions and edits, and how far you have read in each conversation, so your unread count is the same on every device. Chat can be end-to-end encrypted. When it is switched on, messages are encrypted in your browser with keys that only the members of that conversation hold, and Axis stores only the encrypted form. We cannot read those messages, and if you lose your passphrase we cannot recover them for you.
• Uploaded documents. Files you upload or attach, and files you choose to connect from Google Drive, along with their names, sizes and who added them, who last changed them, and up to 50 earlier versions of each so you can restore one. To make documents searchable, Axis also keeps the text it reads out of them.
• Calendar events. Events, meetings and deadlines on the workspace calendar, and, if you connect Google Calendar, the events you choose to sync.
• Calls. When you hold a call in Axis, who joined and when. On the paid plans, if someone turns on transcription, the text of what each person said and when they said it; if someone records the call, the recording, saved as a document in the workspace. Everyone in the call can see while either is on, and the screen you join from says so before you join. The audio and video of a call are not stored unless it is recorded.
• Assistant history. The requests you give the Axis assistant, what it did in reply, short facts it has been asked to remember, and, if your workspace turns on automatic memory, facts it picks up from conversations itself.
• Billing. For paid plans: the plan, the number of members it covers, its renewal date, and the reference numbers Stripe gives us for the customer and subscription. Card details stay with Stripe.
• Usage and technical records. When you signed in, which workspace you last used, while you have Axis open that you are online and which part of it you are in (shown to the members of that workspace), when you were last there, notification preferences, the notification token of any phone you allow notifications on, and the server logs any web service keeps (such as the time of a request and the IP address it came from), which we keep only as long as we need them to keep the service secure and working.

UK data protection law asks us to say which legal basis each use rests on:

• To provide Axis (running your account and workspaces, sending the emails and notifications you expect, taking payment for paid plans): because it is necessary for our contract with you.
• To keep Axis secure and working (server logs, abuse prevention, fixing faults): because we have a legitimate interest in running a safe, reliable service.
• To keep billing records: because the law requires us to.
• Optional features you switch on (phone notifications, automatic assistant memory, connecting Google): because you or your workspace chose them. You can switch each one off at any time.

Workspace data, accounts and uploaded files are stored with Supabase, a managed database and storage provider. Access follows workspace membership: the database's row-level security enforces it for everything your browser asks for directly, and the server checks that you belong to a workspace before it reads or writes anything there on your behalf. The Axis website and app are served through Cloudflare, which also protects the service from abuse.

If you use Axis Go or the desktop app, your session is kept on that device so you do not have to sign in every time. It does not leave the device. If you turn on offline access, a copy of the workspace data you choose is kept in that browser or device so you can read it without a connection. It stays on the device, and turning offline access off removes it.

We use a small number of providers to run Axis. Each one receives only what its job needs and processes it on our behalf under its own security and data protection commitments:

• Supabase stores the database, sign-in and uploaded files.
• Cloudflare serves the site and app, protects them from abuse, carries call audio and video when it cannot travel directly (see Calls, below), and can turn speech into text for voice calls and call transcripts.
• Stripe takes payment for paid plans. It receives the card and billing details you enter at checkout, and sets its own cookies on the checkout page to prevent fraud. Axis never sees your card number.
• Resend delivers the emails Axis sends: invitations, receipts, replies to the contact form, and emails the assistant sends when someone asks it to.
• Google provides the Gemini AI models (when your workspace uses Gemini), Firebase Cloud Messaging (which carries the text of each notification to your phone if you allow notifications in Axis Go), Google sign-in, Calendar and Drive when you connect them, and the typefaces the site uses, which your browser downloads from Google Fonts, so Google sees your IP address when it does.
• OpenAI and Anthropic provide AI models, but only for workspaces that choose them.
• Groq can turn speech into text for voice calls and call transcripts.
• LanguageTool checks spelling and grammar. It receives the text you ask it to check, when you use the writing check in a document.
• GitHub handles sign-in for people who choose it, and hosts the downloads and updates for the desktop app and Axis Go.
• Services your workspace connects. A workspace administrator can connect other services to the assistant. When they do, the assistant sends those services what a request needs, under that service's own terms.

Some of these providers process data outside the UK, mainly in the United States. Where they do, the transfer is covered by the safeguards UK data protection law requires: the UK's adequacy regulations, including the UK extension to the EU-US Data Privacy Framework for certified providers, or the UK International Data Transfer Agreement or Addendum.

Axis includes an assistant and other AI features on the paid plans. The assistant works when someone asks it to: when you use it, when your workspace sets up a schedule or a rule for it (a morning summary, say, or a reply whenever a task is assigned to Axis), or when a teammate hands it a piece of work. Scheduled and handed-over work runs in the background, under the same rules as everything else in your workspace.

When it runs, the content it needs (for example the goal you typed, the document you asked about, or the meeting notes to summarise) is sent to the AI provider configured for your workspace. That is one of Google Gemini, OpenAI or Anthropic, or a local model running on a machine or phone you control, in which case nothing leaves it. Workspace administrators choose the provider and can supply their own keys, so the requests run under their own account with that provider.

Search by meaning and the Related lists work a little differently, because they have to be ready before anyone looks. When a page, an uploaded document, a saved scrape, an opportunity, an idea or a meeting is saved, its text is sent to Google Gemini (or to OpenAI, for a workspace that uses its own OpenAI key) and turned into search vectors, which Axis stores. Like every AI feature, this happens only on the paid plans; on Free, search and the Related lists match words.

When you talk to Axis on a voice call, your speech is turned into text either by your device or browser's own speech service (in Chrome, Google runs that service), or by Groq, Cloudflare or Google Gemini. Audio is sent only while a call is open, and Axis does not store it: the call is kept as the text of the conversation, like any other request.

In a call with your team, transcription is off until someone on a paid plan turns it on. While it is on, each person's speech is turned into text as they speak, by Groq, Cloudflare or Google Gemini, and the text is kept with the meeting. When the call ends, the transcript, the notes and the agenda are sent to your workspace's AI provider to write the summary and suggest action items. When Hey Axis is on in a call, each person's device listens for those words in their own speech only: while transcription is on, in the speech already being turned into text (what is said while Axis is talking is left out of the transcript), and otherwise only where the browser can recognise speech on the device itself, so no audio is sent for it; a request made that way, or by pressing Axis, is heard like a voice call and kept as its text.

Scanning a page in Documents happens on your device. On the paid plans, when the device cannot read the writing well (handwriting, mostly), the cleaned picture of the page is sent to your workspace's AI provider to read, and only the text comes back into the new page. On Free, and in a workspace whose AI is a local model, the picture never leaves the device.

Axis does not use your content to train models, and we do not sell it or share it with anyone for advertising. The AI providers handle the content under their own terms; we recommend reading them before choosing a provider for your workspace.

Calls in Axis connect people's browsers directly where they can, and the audio and video travel encrypted. When a network blocks a direct connection, the encrypted media passes through Cloudflare's relay, which cannot read it. Calls of five or more people, which only the paid plans can hold, are routed through Cloudflare's call servers: they receive the audio and video to pass it on, encrypted between each device and Cloudflare. The messages that set a call up travel through Supabase, sealed with a key only the workspace's members can get.

Connecting Google is optional. If you connect Google Calendar, Axis uses that access to create the calendar events and Meet links for meetings you schedule, and to keep those events in step when a meeting moves. If you connect Google Drive, Axis uses that access to list and preview your files in the Drive panel and to open or import the files you pick. On the paid plans, if your team meets on Google Meet, you can bring a meeting's Meet transcript into Axis: Axis asks once for read access to your Meet records, reads the transcript of that meeting and keeps its text with the meeting. The access token stays in your browser; Axis does not keep a copy of your Google data beyond the events you sync, the files you choose to import and the transcripts you bring in.

Axis's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google data for advertising, sell it, or use it to train AI models, and you can disconnect at any time from your Google account settings.

Axis sets one cookie of its own, and only to keep you signed in: it carries your session so the server knows who is asking, and it is removed when you sign out. Stripe sets its own cookies on the checkout page, because it needs them to prevent fraud. We do not use advertising or tracking cookies, and we do not run third-party analytics on the site.

Workspaces are private. Only the people invited to a workspace can see what is in it, and a guest portal shows a guest only the project you shared. The members of a workspace can see when you are online in it. Whether other Axis users can find you by username is controlled by your own profile settings.

We do not sell your data. We share it only with the providers named above, which process it for us, and when the law requires us to.

You can ask for a copy of the data Axis holds about you, ask us to correct it, delete it or hand it to you in a form you can take elsewhere, and object to or ask us to limit how we use it. Send the request through the contact page, choosing "Privacy request", from the email address on the account. We will confirm your identity, then act within one month.

Deleting your account removes your profile and sign-in details. Content you added to a shared workspace (a task, a document, a message) belongs to that workspace and stays with it, with your name detached, so your teammates' work is not broken. A workspace owner can delete a whole workspace, which removes its content for everyone.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk.

We keep your account and workspace data for as long as the account exists. When you delete your account or a workspace, the data is removed from the live service straight away and from backups within 30 days. Server logs are kept for no more than 90 days. Billing records are kept for six years after the end of the financial year they belong to, because UK tax law requires it. If you cancel a paid plan, nothing is deleted: the workspace simply moves to the Free plan.

Data travels between your device and Axis over encrypted connections, is stored on encrypted disks, and is protected by database-level access rules that follow workspace membership. Chat can additionally be end-to-end encrypted, as described above. No system is perfectly secure; if we ever learn of a breach that affects your data, we will tell you promptly and explain what happened.

Axis is for people aged 16 and over. We do not knowingly collect data from anyone younger. If you believe a child has created an account, contact us and we will remove it.

We will update this page when the way Axis handles data changes, and change the date at the top. If a change is significant, we will also tell you inside Axis or by email before it takes effect.

For anything about this policy, or to make a request under it, use the contact page. The email address for the team is shown there. You can also write to Kerfox Ltd at the registered office address above.