The short version

• Your work belongs to you. Files, prompts, chats, Docs, apps and credentials live on your Axis server: your own computer if you run Axis yourself, or the dedicated server we run for you on Axis Cloud.
• Axis Cloud gives each customer their own server. It runs in the European Union, has no open ports, and only lets people in after Axis Edge has checked their Axis sign-in. Edge passes your traffic along but does not store your content.
• Backups are encrypted. Cloud backups are encrypted on your server before they leave it and are kept in a private bucket in Frankfurt for up to 30 days. We hold the key so we can restore them for you.
• Your AI keys stay with you. When you bring your own model key, requests go from your server straight to the provider you chose. We don't proxy them.
• Published sites are public by design. If you publish something as a site, anyone with the link can see it unless you add a password. Visitors reach it through Cloudflare, and we add no tracking to it.
• When you cancel, your data is deleted. You get an export link. Your server stops when your paid period ends and is permanently deleted 14 days later, along with its snapshot and backups.
• We don't sell your data, and we don't use your content to train models. Website measurement is content-free. Your Axis server sends us daily usage counts, such as how many minutes you were active and how many sessions ran, but never your content. In-product analytics and session interactions are off unless you turn them on. Session interactions are a masked replay that never shows your words, your files or anything you type.
• You have rights. Email privacy@tryaxis.so to access, export, correct or delete your information.

1. Who we are

Axis is provided by Expressline LLC, a Wyoming limited liability company. Privacy questions may be sent to privacy@tryaxis.so. General questions may be sent to contact@tryaxis.so.

2. Two ways to run Axis

Axis always runs on an Axis server (also called an Axis node) that holds your projects and does the work. You can run that server in one of two ways:

• Self-hosted. You install Axis on a computer you control, such as a Mac, a Linux machine or your own cloud server, and reach it from your other devices.
• Axis Cloud. You subscribe and we run a dedicated server for you, reachable at your own address under cloud.tryaxis.so from a browser, phone, desktop app, or AI assistants such as Claude and ChatGPT.

Sections 3 and 5 to 16 apply to both. Section 4 explains the extra things that happen when we host your server.

3. Your content stays on your Axis server

Your source files, project files, prompts, transcripts, chats, Docs, Slides, videos, apps, commands, artifacts, credentials, and agent work are stored on your Axis server rather than in the Axis commercial control plane (the account, billing and licensing service we run at api.tryaxis.so).

Content leaves your server when you direct Axis to send it to an AI provider, integration, paired device, AI assistant, or notification service, when you publish something on purpose (such as a shared site), or when a feature clearly requires that transfer. Those third parties process information under their own terms and privacy policies. We do not sell your content and we do not use it to train AI models.

4. Axis Cloud

4.1 Your dedicated server

Each Axis Cloud subscription gets its own virtual server. It is not shared with other customers. Today, Axis Cloud servers run in data centers in the European Union (Germany or Finland), operated by Hetzner Online GmbH. If Hetzner capacity is unavailable, we may create your server with Amazon Web Services in Frankfurt, Germany. If we offer other regions later, we will tell you which region your server runs in.

Your server accepts no inbound connections from the internet. Remote login (SSH) is turned off. The server opens an encrypted WireGuard tunnel outward to Axis Edge, and that tunnel is the only way traffic reaches it.

To run and protect the service, your server sends our control plane signed health and usage reports: CPU, memory and disk use, the number of active projects and running sessions, software versions, and backup status. We use these to keep your server healthy, tell you when you are running out of room, and recommend a larger plan when you need one. These reports do not include your content.

4.2 Axis Edge

Axis Edge is a server we operate in Germany. It sits between the internet and your server. When you visit your Cloud address, Edge checks that you are signed in to an Axis account allowed to use that server, then forwards your request through the tunnel. Requests without a valid sign-in never reach your server.

Secure connections (TLS) end at Edge, so Edge handles your traffic unencrypted in memory while forwarding it, and re-sends it inside the encrypted WireGuard tunnel. Edge does not store or inspect the content of your requests, and it keeps no per-request access log. It writes short operational log lines for sign-in handoffs (your server address and account identifier), connection errors, and tunnel changes. These are kept in the Edge server's system log for troubleshooting and security, and are rotated automatically. To limit abuse, Edge counts requests per IP address for unauthenticated pages. Those counters are held only in memory and reset every minute. Edge passes your IP address on to your own server.

4.3 Signing in and cookies

You sign in to Axis with an emailed code, Sign in with Apple, or Google. We receive your email address, a provider account identifier, and your name if you choose to share it. With Sign in with Apple you can hide your email, in which case we receive Apple's relay address. Email sign-in is protected by Cloudflare Turnstile, which processes browser and device signals to tell people from bots.

When you open your Cloud server, tryaxis.so creates a single-use code that is valid for two minutes and only works for your server. Edge exchanges it for a session cookie on your server's address. That cookie is limited to that one address, cannot be read by page scripts, expires after 24 hours, and stops working if your server is replaced or reassigned. Signing out clears it. Edge also sets a cookie that remembers which page to return you to after sign-in; it expires after 10 minutes.

4.4 Backups

Your server backs itself up every night, with one weekly backup each week. It also takes an extra backup before each Axis update, server resize, or restore. Each backup is encrypted on your server with AES-256-GCM, using a new key for every backup, before it leaves the server. Backups are stored in a private Amazon S3 bucket in Frankfurt, Germany, which blocks all public access and adds its own encryption at rest. Your server never holds storage credentials; it receives a one-time upload link for each backup.

Only the Axis control plane holds the private key needed to unlock a backup. That lets us restore your server when you, your server's settings, or an Axis operator request it. Backups expire automatically: nightly backups after 8 days, weekly backups after 29 days, and pre-update backups after 30 days. We also take a provider snapshot of your server's disk when it is suspended (see 4.5).

4.5 Export, cancellation and deletion

When paid access to Axis Cloud ends, we email you a link to download a full export of your server (projects, sessions and files) and tell you when your server will stop and when it will be deleted. The export is a plain, unencrypted archive so you can open it anywhere. Keep the link private.

• You cancel: your server keeps running until the end of the period you have paid for.
• A payment fails: your server stops 48 hours after the first failed payment unless you pay in that time.
• A refund or a revoked subscription: your server stops right away, or within 48 hours at most while your export is being prepared.

When your server stops, we power it off, take a private snapshot of its disk, confirm the snapshot, and then delete the server. If you resubscribe within 14 days, we rebuild the same server from that snapshot. Fourteen days after your server stops, we permanently delete the snapshot, your remaining backups, and your export. Some backups may already have expired sooner under the schedule in 4.4. We keep basic records that the server existed, and its billing and audit history, as described in section 13.

4.6 When Axis staff can access your server

Axis staff do not sign in to your server or read your content as part of normal operations. Our systems can tell your server to run a backup, restore a backup, or prepare an export, and can resize, power off, snapshot, or delete it. Those commands are recorded in an audit log. Any administrative access goes through a private, authenticated network limited to authorized Axis staff, never the public internet. Section 8 describes the automatic health reports, status snapshots and logs we collect from Axis Cloud servers, and the support access you can approve.

We access content on your server or in a backup only when you ask us for help, to restore or recover your data, to investigate a security incident or a serious breach of our Terms, or when the law requires it. Our hosting providers have physical control of the hardware under their own security programs.

4.7 Team members

Team sharing on Axis Cloud is coming but is not available yet. Today, only the subscription owner signs in to their server. If you add team members once team sharing is available, each person will sign in with their own Axis account, and Edge will tell your server which account is making each request so actions can be attributed to the right person. Anyone you add will generally be able to see and change the projects and files on that server, subject to the permissions Axis offers. The subscription owner will decide who has access and will be responsible for the people they add. We will update this policy if team sharing works differently.

4.8 Claude, ChatGPT and other AI assistants (MCP)

You can connect AI assistants such as Claude or ChatGPT to your server using the Model Context Protocol. These connections are approved through your server's own sign-in and permission screen, and Edge forwards them without using your browser cookie. Once connected, the assistant's provider (for example Anthropic or OpenAI) receives whatever content its tools read from or write to your server, under that provider's own terms. You can disconnect an assistant at any time.

5. AI models and bring-your-own keys

Axis works with the AI models and providers you choose, using your own API keys, subscriptions, or OAuth sign-ins. Those credentials are stored on your Axis server. When an agent calls a model, the request goes directly from your server to that provider. It does not pass through Axis Edge as a proxy or through the Axis control plane, and we do not see your prompts or the model's answers. The provider handles that content under its own terms, and bills you directly.

Your server keeps usage records (provider and model names, request and token counts, estimated cost) so you can track spending. It also sends our control plane daily totals of those records for each provider and model, so we can support you and understand how Axis is used. These totals contain no prompts, answers or other content.

6. Sites you publish

Axis lets you publish things you make, such as a Doc, Slides, a design or an app, as a static website at an address like your-title-x7k2m9q4pd.sites.tryaxis.so. Publishing needs a paid plan or an active trial.

What we store. The files you publish are stored in Cloudflare R2 object storage. We keep the current version and up to four earlier versions of each site, and delete older ones automatically. Our control plane stores the site's title, address, and visibility setting, its file list and size, and a history of when it was published, republished, or unpublished, all linked to your account. If you set a password, we store only a scrypt hash of it, not the password itself.

Who can see it. A public site can be opened by anyone and may appear in search engines. An unlisted site tells search engines not to index it, but anyone with the link can still open it. A password-protected site asks for the password first; entering it correctly sets a cookie for that site that lasts 8 hours. The address includes your site's title, so choose one you are happy to share. Do not publish anything confidential unless it is password-protected, and share the password with care.

Visitors. Visits to published sites pass through Cloudflare, which delivers and caches the site and protects it from attacks and abuse. Cloudflare processes visitors' IP addresses, browser details, and requested addresses under its own policies. Our site gateway, hosted on Railway, logs each request it serves: the time, method, site address and path, response status and timing, and the network address of the Cloudflare connection, not the visitor's own IP address. Those logs are kept by our hosting provider for a limited period for troubleshooting and security. To limit abuse, the gateway also counts requests per site and per connection in memory. Axis adds no analytics, tracking pixels, or advertising to published sites. A site you publish can include your own scripts or embedded content; if it collects information from visitors, you are responsible for that and for telling them.

Unpublishing. Unpublishing takes a site offline right away by deleting the records that route visitors to it. Copies already cached by Cloudflare or by visitors' browsers can stay visible for a short time. The files themselves remain in our private storage after you unpublish, where nobody can visit them, until you ask us to delete them at privacy@tryaxis.so or we process a verified deletion request for your account. If your paid access ends, your sites stop being served when your paid or grace period ends.

7. Information Axis processes

• Account and access information, such as email address, name, account identifiers, sign-in provider identifiers, authentication state, plan, and billing state.
• Installation and device information, such as pseudonymous device and installation identifiers, platform, architecture, app/runtime versions, entitlement state, and last-seen timestamps.
• Daily usage counts from your Axis server: active minutes, messages sent, sessions started, agent runs completed, the number of projects, Routines, bots and connected apps, the names of connected AI providers from a fixed list, and customisation settings (see section 8), plus daily model usage totals (see section 5).
• Axis Cloud server information, such as server and region identifiers, your server address, provider server identifiers, tunnel addresses, health and usage reports, backup and export records, lifecycle events, and audit records of commands sent to the server.
• Security and reliability information, such as access IP history, coarse country, health heartbeats, update state, bounded error categories, and operational logs, including the Axis Edge logs described in 4.2.
• On tryaxis.so, content-free website measurements: random pseudonymous visitor and session identifiers, desktop or mobile device class, and explicit interactions with allowlisted navigation and platform-download controls.
• When you separately opt in, content-free in-product analytics such as stable signup, setup, onboarding, activation, and feature identifiers; bounded status or provider categories; pseudonymous user/account and installation identifiers; app/runtime versions; platform; product interactions; and timestamps.
• When you separately opt in, masked session interactions from the Axis app (see section 8): a replay of the page layout with all text, typed input and images hidden; your clicks, scrolling and pointer movement; the Axis screen you are on, without project, session or file identifiers; window size; timing; browser, operating system and device type; and your pseudonymous account identifier.
• Published-site information, such as site titles, addresses, visibility settings, password hashes, file lists and sizes, the published files themselves, publish and unpublish history, and site gateway request logs (see section 6).
• Affiliate and referral information, such as a referral cookie and, when you sign up after following a partner link, your account identifier, email address, and name (see section 8).
• Billing evidence from payment providers, including customer, subscription, product, transaction, and webhook information. We do not receive your full card number.
• Feedback and support messages you deliberately submit, including anything you choose to attach.
• Emails we send you and their delivery status. If you turn on the daily brief email, the summary your server writes passes through our control plane to the email provider for delivery. We keep a delivery record, not the summary.
• Legal acceptance evidence, including policy versions, acceptance time, account/authentication identifiers, and acceptance surface.
• Paired-device and notification information, including device identity, token digests, notification preferences, push tokens, approval keys, titles, identifiers, approval text, and deep links needed to deliver enabled notifications.

8. Website measurement, product analytics, session interactions, daily usage counts, affiliate tracking, and operational logs

On tryaxis.so, Axis uses narrow first-party website measurement to count pseudonymous browser sessions and explicit clicks on allowlisted page-navigation and download controls. The browser stores random visitor and session identifiers in local storage and sends only fixed event names, desktop or mobile device class, navigation destination, download platform, button placement and availability, and timestamps to PostHog’s European Union cloud. It does not send form values, email addresses, raw URLs or query strings, page text, advertising identifiers, or fingerprinting data. tryaxis.so does not use browser autocapture or session replay. Optional session interactions inside the Axis app are described below.

In-product analytics is optional and off by default. If you separately choose “Share anonymous product analytics,” Axis sends minimal content-free first-party events to PostHog’s European Union cloud to understand where setup succeeds or fails, improve reliability, and guide product improvements. In-product analytics is limited to the closed categories described above. It does not include prompts, files or file contents, commands, project or session names, paths, free-form error text, secrets, or credentials. Axis does not use product analytics to track you across apps or websites owned by other companies and does not request AppTrackingTransparency permission.

Your in-product choice does not affect signup or access. You can withdraw it at any time in Account & devices; withdrawal stops new in-product analytics events and removes undelivered analytics records. It does not disable website measurement or operational security and reliability logs needed to operate and improve the service.

Session interactions (optional)

Session interactions are optional and off by default. They are a separate choice from in-product analytics: agreeing to analytics, to our Terms or to this policy never turns them on, and signup and access do not depend on them. If you choose “Share masked session interactions,” the Axis app in your browser or the Axis desktop app records a masked replay of your session (your clicks, scrolling and which screen you are on) so we can see where people get stuck, which steps they repeat, and what to fix. The replay travels through your own Axis server to PostHog’s European Union cloud in Frankfurt, Germany.

What the replay shows. The layout of the Axis window, with every piece of text and every image replaced by placeholders; your clicks, scrolling and pointer movement; which Axis screen you are on, with project, session, file and other identifiers removed from the address; your window size; the timing of each step; and your browser, operating system and device type. The recorder keeps a random session identifier in your browser’s local storage. Each replay is linked to your pseudonymous Axis account identifier, not your email address, and to your in-product analytics events if you also share those.

What the replay never contains. Masking happens in the app before anything is sent. Session interactions never contain text shown on screen, anything you type, your prompts, chats, agent output, terminal output, files or file contents, Docs, Slides, images, videos, published sites or previews, the names of your projects, sessions, files, bots or connections, links, network requests, console logs, passwords, API keys or other credentials. The Axis app does not pass your IP address to PostHog, and session interactions are not used to work out your location.

Where they are collected. Only in the Axis app in a browser and in the Axis desktop app. Never on tryaxis.so, on sites you publish, or in the Axis iOS or Android apps.

Who sees them. Axis staff, and AI tools working for Axis staff, may watch and analyse session interactions to find problems and improve Axis. Those AI tools use models from Anthropic and OpenAI (see section 11). Because the replays are masked, people and AI tools see the same placeholders. We do not sell session interactions, use them for advertising, or use them to train AI models.

How long we keep them. Each replay is kept for 30 days. PostHog then deletes it automatically by destroying its encryption key.

Turning them off. You can turn session interactions off at any time in Axis under Account & devices. Collection stops right away on the device where you turn it off and within about a minute on your other open devices. Replays already collected are deleted when their 30 days end; to have them deleted sooner, email privacy@tryaxis.so and we will ask PostHog to delete them.

Changes. If we change what session interactions can include, how long we keep them, or who processes them, we will ask you again, and session interactions stay off until you agree.

Axis runs an affiliate program through Affonso. The Affonso script loads on the tryaxis.so home page, sign-up page, and checkout confirmation page and sets a referral cookie that lasts 30 days, so we can credit partners who send people to Axis. When you create an account, your account identifier, email address, and name are sent to Affonso so a referral can be matched and commissions paid. Affonso does not receive your Axis content.

Operational logs are separate from optional in-product analytics. They may include allowlisted request routes, pseudonymous runtime identifiers, timing and status information, bounded error categories, and sanitized performance measurements. Axis excludes prompts, files, commands, project or session names, paths, and free-form errors from hosted operational logs.

Daily usage counts

Every Axis server that is signed in to an Axis account, whether it runs on your own computer or on Axis Cloud, sends our control plane a short daily summary of how much Axis was used. We use it to see whether Axis is actually working for the people who sign up, to notice when someone gets stuck, and to decide what to improve. It is part of running the service, so it does not depend on the optional product analytics choice above, and we never send it to PostHog or any other analytics company.

The summary contains only counts, yes/no settings and provider names, worked out on your server for each day (UTC):

• Active minutes: the number of minutes in which a person used Axis. A minute counts only when an Axis window was open and in front and someone typed, clicked, tapped or scrolled in it, or sent a message. A window nobody is using, a background tab, or your server simply being switched on does not count.
• Messages sent: how many messages people sent to agents.
• Sessions started and agent runs completed: how many agent sessions began (including ones started by Routines and sub-agents) and how many agent turns finished.
• Setup counts: how many projects, active Routines, bots and connected apps your server has.
• AI providers connected: which AI providers are set up, named from a fixed list (for example “anthropic” or “openai”). A provider that is not on the list, such as a custom model server you named yourself, is reported only as “other”.
• Customisation: whether a custom theme or a wallpaper is set, and how many projects have a custom icon or background.

The summary never includes your prompts, messages, conversations, agent output, files or file contents, or commands, nor the names of your projects, sessions, files, bots, Routines or connected accounts, nor any paths, links or other free-form text. It is linked to your Axis account and installation, so Axis staff can see, for example, when you last used Axis, how many days you used it in the last week and month, and which providers you have connected. We keep each day’s summary for 180 days.

Axis Cloud servers

Automatic health reports. When something fails on an Axis Cloud server we host for you (for example, a session that cannot start, an AI provider or model that is unavailable, a failed Claude Code install or sign-in, a failed update, or an Axis service that crashes), the server automatically sends us a short report so we can fix the problem, often before you notice it. A report contains only: the type of failure, when it happened and how many times, an opaque session identifier, the AI provider and model name, the Axis version, a short error code, and a short error message with credentials, email addresses and home-folder paths removed on the server before it is sent. Reports never contain your prompts, conversations, agent output, files, file contents, commands you run, or any password, API key or token. Each server sends at most one batch a minute and a limited number of reports per hour. We keep reports for 30 days and then delete them. Only Axis staff with a support, security or administrator role can read them, and every read is logged.

Server status snapshots and logs. To investigate a problem, Axis staff with a support, security or administrator role can request a status snapshot and recent service logs from your Axis Cloud server without asking you each time. Every request records who asked, when, and the stated reason. The server collects them itself, removes credentials (and email addresses, unless needed for the investigation) before anything leaves it, and sends them over an encrypted connection. A snapshot lists technical state, such as service status, versions, session identifiers, session states, model names and failure reasons. It never includes session titles, prompts, conversations or file contents. Collected logs are deleted after 7 days; the record of the request is kept.

Support access you approve. If you approve a support request from Axis, Axis support staff, and Axis support agents working with them, can run commands in a shell on your Axis Cloud server as your user account until your approval expires or you end it. This gives the same access to your files and sessions that you have. You see when access is active, every command is logged and listed for you on your server, and you can end access at any time. Command output is deleted after 7 days; the record of each command is kept. Without your approval, Axis staff cannot open a shell on your server.

9. Emails

We send sign-in codes, account and billing notices, Axis Cloud setup, usage, backup, and cancellation notices, and, if you turn them on, daily brief emails. We may also send occasional product emails about features you use. Emails are delivered through Resend. You can unsubscribe from non-essential emails using the link in them; account, security, and billing notices are part of the service.

10. Why we use information

We use information to create and secure accounts, operate Axis, provision and run Axis Cloud servers, route your traffic to your server, back up and restore your server, host and protect sites you publish, activate installations, provide access and updates, process billing and affiliate commissions, prevent fraud and abuse, diagnose failures, improve the product, provide support, enforce our Terms, and comply with law.

Where laws such as the EU or UK GDPR apply, we rely on performance of our contract with you (running the service you signed up for), our legitimate interests (security, fraud prevention, reliability, understanding how the website is used in a content-free way, and understanding whether and how much Axis is used through content-free daily usage counts), your consent (optional in-product analytics, optional session interactions and optional emails, which you can withdraw), and legal obligations (tax, accounting, and responding to lawful requests).

11. Service providers (subprocessors)

We use these providers to run Axis. Each processes only what it needs for its role:

• Hetzner Online GmbH (Germany and Finland): Axis Cloud servers, server snapshots, and the Axis Edge server.
• Amazon Web Services (Frankfurt, Germany): encrypted Axis Cloud backups and exports, software delivery to new servers, and fallback Axis Cloud servers.
• Railway: hosting for the Axis control plane (accounts, billing state, licensing, Cloud server and published-site records) and for the published-site gateway, including its request logs.
• Polar: checkout, subscriptions, invoices, and tax, as merchant of record. Polar and its payment processors handle your payment details under their own terms.
• Resend: email delivery.
• Cloudflare: DNS for tryaxis.so and Cloud addresses (DNS only; Cloudflare does not carry your Cloud server traffic); Turnstile bot protection on email sign-in; delivery, caching, and attack and abuse protection for published sites, which means it processes site visitors' requests; and R2 object storage for published site files.
• PostHog (European Union cloud): website measurement, optional in-product analytics, optional masked session interactions, and allowlisted operational logs.
• Anthropic and OpenAI: AI models that Axis staff use to analyse masked session interactions. They receive masked replays only, under business terms that do not use that data to train their models.
• Affonso: affiliate referral tracking and commission payouts.
• Apple and Google: sign-in with your Apple or Google account, if you choose it.
• Let's Encrypt: security certificates for Cloud addresses. It receives domain names, not personal information.

AI providers, integrations, and AI assistants that you connect are not our subprocessors. You choose them, and they process content under their agreements with you.

12. Other disclosures

Apple and Google may process App Store or Play Store account, storefront, purchase, subscription, transaction, crash, and diagnostic information under their own policies when they distribute Axis or provide store services. Axis may receive store transaction identifiers and status needed to provide purchases or subscriptions. Apple Push Notification service and browser push providers process device/push tokens and the notification fields needed to deliver notifications. AI providers and integrations you configure receive the content you choose to send them.

We may disclose information when required by law, to protect users or the service, to investigate abuse, or in connection with a business transaction subject to appropriate safeguards. We do not sell personal information or share it for cross-context behavioral advertising.

13. Retention, deletion, and security

We retain information only as long as reasonably necessary for account security, service delivery, billing, support, fraud prevention, product improvement, and legal obligations. Retention varies by system and provider. Specific periods we follow today:

• Axis Cloud backups: 8 days (nightly), 29 days (weekly), 30 days (before updates, resizes, and restores).
• Axis Cloud after paid access ends: the server stops as described in 4.5, and its snapshot, backups, and export are deleted 14 days after it stops. Export files also expire automatically after 15 days.
• Cloud sign-in codes: single use, valid for 2 minutes. Edge session cookies: 24 hours.
• Exact commercial access-IP observations expire after 30 days and are removed during security-history cleanup.
• Axis Cloud health reports: 30 days. Logs and status snapshots collected from your Cloud server for an investigation, and support-shell command output: 7 days.
• Daily usage counts from Axis servers: 180 days.
• Session interactions: 30 days.
• Affiliate referral cookie: 30 days.
• Published sites: the current version and up to four earlier versions per site. Unpublished site files stay in private storage until you ask us to delete them or we process a verified account deletion request. Password unlock cookies on published sites: 8 hours.

No shorter analytics-specific retention period is promised until the pending retention review is approved.

Verified deletion requests cover applicable Axis-held account and analytics records and, where applicable, a deletion request to PostHog, including any session interactions. If you have an Axis Cloud server, a deletion request includes ending your subscription and deleting your server, snapshot, backups, and export as described in 4.5, and deleting the files of sites you have published. Some billing, security, fraud-prevention, dispute, legal, suppression, audit, or backup records may remain for their required or rolling retention periods. Apple, Google, and other providers control deletion and retention for information they hold under their own policies.

We use reasonable technical and organizational safeguards, including encrypted tunnels, servers with no open ports, encrypted backups, and least-privilege access, but no system is completely secure. If a breach affects your personal information, we will notify you as the law requires. You are responsible for securing your devices, your self-hosted Axis server, your Axis account, provider credentials, API keys, and connected accounts, and for the people you give access to your server.

14. Your choices and rights

You may leave optional product analytics and session interactions off during signup, turn either on separately, or turn either off at any time in Axis under Account & devices. You may also disable optional integrations, AI assistants, notifications, and daily brief emails through their available controls.

Daily usage counts (section 8) are part of operating Axis and are not controlled by the product analytics setting. You can object to them, or ask us to delete the counts we hold about you, by emailing privacy@tryaxis.so.

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy in a portable format, object to or restrict certain processing, withdraw consent, and not be discriminated against for using these rights. For Axis Cloud, the export described in 4.5 gives you a full copy of your server's content, and you can also ask us for one while your subscription is active.

To make a request, email privacy@tryaxis.so. We may verify your identity first, and we will respond within the time required by applicable law. We may retain information where required for security, billing, fraud prevention, backups, dispute resolution, or legal compliance. If you are in the European Economic Area or the United Kingdom, you can also complain to your local data protection authority.

If you use Axis inside an organization's Axis server, that organization may control your information there. Contact them first; we will help where we can.

15. International use and children

Expressline LLC is based in the United States. Axis Cloud servers, Axis Edge, and Cloud backups are located in the European Union. Published sites, account, billing, and control-plane information may be processed in the United States and other countries where our providers operate. Where we transfer personal information out of the EEA or UK, we rely on appropriate safeguards, such as standard contractual clauses, where the law requires them.

Axis is not directed to children under 13, and we do not knowingly collect their personal information.

16. Changes

We may update this Privacy Policy as Axis changes. Material updates may require renewed acceptance. The version shown on this page identifies the policy currently in effect.