Privacy Policy

This Privacy Policy explains how Axoix Technologies Private Limited ("we", "us", "our") — an MSME-registered micro enterprise (CIN: U62099DC2026PTC471359, GSTIN: 07ABFCA7413E1ZY, Udyam: UDYAM-DL-10-0120748, D-U-N-S: 581637158, DPIIT: DIPP270090) with registered office at B-59, Second Floor, Southern Side, Block B, Rama Park Road, Uttam Nagar, New Delhi, Delhi - 110059, India — collects, uses, and protects information when you use our corporate website axoix.in, our marketing site axoix.com, our tenant dashboards at *.axoix.io, and any related services (collectively, the "Services").

1. Information We Collect

• Account data — name, email address, phone number, company name, and credentials you provide when signing up, requesting a quote, or applying as a contributor.
• Usage data — pages visited, features used, timestamps, IP address, device and browser information collected via server logs and analytics tooling.
• Tenant content — on AXOIX, any data you or your users upload (documents, emails, chats, voice recordings, images, etc.) is stored in your tenant's isolated database and object storage.
• Communications — messages you send us via forms, email ([email protected]), or chat.
• GitHub identity — if you sign in with GitHub (e.g. as a contributor), we receive your GitHub handle, user id, avatar URL, name, and verified primary email via the GitHub App OAuth flow.
• Google account data — if you connect a Google account, we receive the account's email address, name, and profile picture, plus the Gmail, Calendar, Drive, Docs, Sheets, Google Ads, Analytics, YouTube, Business Profile or Classroom data covered by the scopes you approve. See section 6 for the full scope-by-scope breakdown and our Limited Use commitment.

2. How We Use Your Information

• To provide, operate, and maintain the Services.
• To process signups, payments, invoicing, and tenant provisioning.
• To respond to enquiries, support requests, and contributor applications.
• To improve our products through aggregated, anonymised analytics.
• To send service-related emails (account notices, receipts, policy changes).
• To comply with applicable laws, including Indian tax and GST requirements.

3. AI Processing — Default vs. BYOK

By default, AXOIX runs on self-hosted AI infrastructure (fine-tuned local LLM, Whisper STT, Coqui TTS, image/video generation) on our own GPU server. Your tenant content is processed inside our servers, is not shared with any external AI provider, and is not used to train any shared or public model.

Bring Your Own Key (BYOK) is an optional fallback. If you explicitly add an API key for a third-party AI provider (currently supported: OpenAI, Anthropic, Groq) via your account settings and route a request to that provider, then the prompt and any attached content you send will leave our servers and be processed by that third-party provider under their own terms and privacy policy. We encrypt your stored API key at rest but we do not control what happens to your content once it reaches the third-party provider. Enabling BYOK is your informed choice; you can deactivate or delete your BYOK key at any time from Account → API Keys.

Examples of features where BYOK, when enabled, sends content out: AI chat, AI costing, AI content generation, AI image generation. Features that never leave our servers regardless of BYOK: database queries, file storage, email IMAP/SMTP via our own mail server, voice transcription on our Whisper instance, and TTS on our Coqui instance.

4. Sharing & Third Parties

We do not sell personal data. We share data only with the categories of service providers and integrations listed below, and only to the extent necessary to operate the Services. Each provider is subject to its own terms and privacy policy.

Always involved (infrastructure)

• Backblaze B2 — private per-tenant object storage for files you upload (documents, images, audio). Region: eu-central-003 (Frankfurt, Germany). Tenant bucket credentials are encrypted at rest before being stored in your tenant database.
• Cloudflare — DNS, TLS, WAF, and CDN edge caching. File URLs served via cdn.axoix.io are validated with HMAC signatures, proxied through a Cloudflare Worker to Backblaze B2, and cached at Cloudflare edge locations globally so that repeat viewers are served from the nearest edge.
• Hostinger / VPS host — our dedicated virtual private server located in India hosts our application, databases, and email server.

Used when you choose to use the feature

• Razorpay — payment processing. Receives only the billing information and payment details needed to complete the transaction.
• Brevo (Sendinblue) — transactional email delivery for platform notices sent by us to you (signup confirmation, password reset, receipts, service notices). Does not process email in your tenant mailboxes.
• GitHub — for contributors only, to verify identity via the GitHub App OAuth flow and manage repository invitations.
• Social media OAuth providers — Meta (Facebook, Instagram, Messenger, WhatsApp), LinkedIn, X (Twitter), Threads, and Telegram. Used only when you explicitly connect an account from your tenant dashboard (e.g. CHORUS social media posting). We receive the access tokens each provider issues you; we do not receive your social login password.
• Google — Gmail, Calendar, Drive, Docs, Sheets, Google Ads, Analytics, YouTube, Business Profile and Classroom, only when you connect a Google account yourself. See section 6 for the exact scopes requested and how Google user data is handled.
• Telephony — self-hosted FusionPBX on our VPS handles SIP routing. Outbound calls and SMS leave our network via our upstream DID/SMS carriers (e.g. LINK DID). Call audio is never sent to any AI provider without your BYOK configuration.
• Third-party AI (BYOK) — OpenAI, Anthropic, Groq. Only when you add a BYOK key and actively invoke a BYOK-routed feature. See section 3.

Legal

• Legal obligations — when required by law, court order, or to protect our rights.

5. MCP Connector — Connecting Claude & Other AI Assistants to AXOIX

AXOIX offers an optional remote MCP (Model Context Protocol) connector at mcp.axoix.io that lets you operate your AXOIX tenant from an AI assistant such as Claude, ChatGPT, or Cursor — for example, checking bookings, summarising invoices, or reviewing leads by chatting with the assistant instead of logging into the dashboard. This section explains what happens to your data if you choose to connect it. The MCP connector is off by default and only activates when you explicitly authorise a specific AI assistant from your tenant settings.

• You authorise the connection yourself. Connecting an assistant uses the OAuth 2.1 standard (with PKCE): you log in with your own AXOIX credentials on an AXOIX-hosted consent page and approve exactly which scopes the assistant may use (e.g. read-only, CRM, finance, Chorus content). The assistant provider (e.g. Anthropic) never sees your AXOIX password.
• The connector is a proxy, not a copy of your data. mcp.axoix.io does not maintain its own database of your tenant content. Each tool call from the assistant is translated into a request against our existing tenant API, authenticated with a token scoped to your account and role, and the response is returned to the assistant in that moment. Your business data is not additionally stored, cached, or retained by the MCP gateway itself.
• Only the data you ask about is shared with the assistant. When you ask the assistant a question or give it an instruction, the specific tenant data needed to answer — and nothing else — is sent to that assistant's provider so it can generate a response, in the same way it would be if you pasted that information into a chat yourself. That exchange is governed by the AI assistant provider's own privacy policy and terms once the data reaches them.
• Actions that change data require your confirmation. Read requests (e.g. "show me this week's occupancy") run directly. Actions that create or modify records (e.g. sending an invoice reminder, updating a lead) are flagged to the assistant as requiring your explicit confirmation before they execute.
• Every call is logged. We keep an audit log of MCP tool calls made against your tenant (tool name, timestamp, and result status) so you can review what an assistant did on your behalf. Sensitive values (passwords, OTPs, tokens, card numbers) are redacted from audit records before they are stored.
• Tenant isolation is enforced. A connected assistant can only ever act as the tenant user who authorised it — it cannot access another tenant's data under any circumstances.
• You can revoke access at any time from Account → Connected Apps, which immediately invalidates the assistant's access to your tenant.

6. Google User Data

This section is the complete statement of how AXOIX requests, uses, stores and deletes Google user data, and it governs every Google service listed below. AXOIX’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6.1 Connecting is opt-in, and granted one service at a time

Nothing is requested until you start the connection yourself and approve it on Google’s own consent screen. Connecting your Google account initially grants sign-in only, and every other capability is a separate, later consent. You can hold any combination of the services below, or none of them, and the rest of AXOIX works either way.

Two details about how those later consents work, because they affect what you see at Google and what you need to do to withdraw access:

• YouTube is a separate connection. Since 19 August 2026 YouTube is served by its own Google OAuth client, distinct from the one behind Calendar, Drive, Docs, Sheets, Ads, Analytics, Business Profile and Classroom. Both clients belong to the same Google Cloud project and share one consent screen, so the permissions we ask for are unchanged — but your Google account now holds two independent grants with us rather than one. Section 6.8 explains what that means when you revoke.
• A capability may sit on a different Google account. You can assign services to different Google accounts — for example sign-in and Calendar on your work account and YouTube on the account that owns the channel. A later consent is therefore not necessarily an addition to an existing connection; it may create a new one.

For the non-YouTube services you are not signed out to add a capability, and are not asked to re-approve one you already granted. YouTube is different: its consent carries all six of its permissions in a single request, so approving it to reach one screen also approves the rest — opening the Revenue screen re-approves upload, comment moderation and analytics alongside it.

Two services are available only to particular customers: Google Classroom is offered only to organisations running our Education module, and this is enforced on our servers, not merely hidden in the interface. Google Ads additionally requires a developer token issued to us by Google.

6.2 Every scope we request, and why

These are the exact permission strings shown on Google’s consent screen. We request nothing outside this list — twenty-three permissions across ten services.

• Sign-in — openid, userinfo.email, userinfo.profile. To identify which Google account is connected and display its name, email address and avatar.
• Google Calendar — calendar. To read the events in your calendar, to write the bookings and class sessions you create in AXOIX back into it, and to attach a Google Meet link where the booking is a meeting. AXOIX reads your calendar list and creates, updates and deletes events — including events it did not create, when you delete them from the AXOIX calendar. It does not create or delete calendars.
• Google Drive (AXOIX files only) — drive.file. AXOIX can only ever see files it created itself or that you explicitly hand to it through the Google Picker. It cannot list, search or open anything else in your Drive.
• Google Docs — drive.file. To create and edit the Google Docs that AXOIX generates for you, such as proposals, contracts and HR letters, and any document you hand to AXOIX yourself through the Google Picker. We no longer request documents, which would have meant access to every Google Doc in your account; AXOIX can reach a document only if it created it or you picked it.
• Google Sheets — drive.file. To create and fill the Google Sheets that AXOIX generates when you export a report or table, and any workbook you hand to AXOIX yourself through the Google Picker. We no longer request spreadsheets, which would have meant access to every Google Sheet in your account.
• Google Ads — adwords. To read the performance of the Google Ads accounts you connect, and to create and manage campaigns, ad groups, keywords, ads, budgets, bids, targeting and conversion actions. Google publishes no read-only variant of this permission, so a customer who only wants reporting grants the same scope as one who makes changes; who can actually change anything is decided by role inside AXOIX, and that is enforced on our servers.
• Google Analytics — analytics.readonly, analytics.edit, analytics.manage.users. To read your GA4 reports, to administer properties, data streams and custom dimensions, and to manage who has access to the account.
• YouTube — youtube.readonly, youtube.upload, youtube.force-ssl, yt-analytics.readonly, yt-analytics-monetary.readonly, youtube.channel-memberships.creator. To upload the videos you publish from CHORUS; to read your channel name, avatar and subscriber and view counts; to edit, delete and thumbnail your uploads and to read, reply to, moderate and delete comments on your channel; to show watch time, audience retention and traffic sources; to show your channel’s earnings, CPM, ad impressions and monetised playbacks; and to list your channel members, their tier and how long they have been a member. The two analytics permissions come from the YouTube Analytics API, a separate service whose figures cannot be derived from the Data API. Since 19 August 2026 a single YouTube consent covers all six of these permissions at once — they are not requested one screen at a time. A channel connected before that date keeps only the permissions it was granted then, and shows no Revenue or Members screen until you reconnect it, which grants the full set.
• Google Business Profile — business.manage. To manage the business listing you connect in AXOIX — its details and hours, reviews and replies, posts, questions and answers, and the Search and Maps performance behind them.
• Google Classroom (Education customers only) — classroom.courses, classroom.rosters, classroom.coursework.students, classroom.announcements, classroom.topics, classroom.profile.emails, classroom.courseworkmaterials. To synchronise courses, rosters, coursework, materials, submissions, grades and announcements in both directions with the AXOIX Education module. classroom.profile.emails is what allows a Classroom course member to be matched to the corresponding student record in AXOIX.

Permissions we deliberately do not hold.

• No Gmail permission of any kind. AXOIX does not request gmail.modify, gmail.send, gmail.readonly, gmail.metadata, gmail.compose, gmail.labels or mail.google.com. No part of AXOIX can read, send, label or delete mail in your Gmail mailbox, and no Google connection you make with us can be granted the ability to. The mail features inside AXOIX run on mailboxes we host ourselves on our own mail server; they are unrelated to your Google account.
• No permission to browse your Drive. drive, drive.readonly and drive.metadata.readonly are not requested. Everything AXOIX generates for you — proposals, contracts, letters, exported reports and spreadsheets — works under drive.file, which can only ever see what AXOIX created or what you handed to it.
• No permission to open your existing Docs or Sheets. documents and spreadsheets — each of which means every Google Doc or every Google Sheet in your account — were withdrawn from our Google client on 9 September 2026 and can no longer be granted on any AXOIX connection. Both the Docs and the Sheets features run on drive.file instead, so AXOIX reaches a file only when it created that file or you chose it yourself in the Google Picker.
• No YouTube partner or content-owner permission. youtube (the broad variant), youtubepartner and youtubepartner-channel-audit are not requested. The per-feature permissions listed above cover everything CHORUS does.

6.3 We request no “restricted” permission

Google classifies permissions as non-sensitive, sensitive or restricted. Restricted is the highest tier and is reserved for permissions that expose the whole of a mailbox or the whole of a Drive.

AXOIX requests no restricted permission. Every permission in section 6.2 is non-sensitive or sensitive.

Earlier versions of this policy described two restricted permissions — gmail.modify, for a full Gmail mailbox inside AXOIX, and drive, for browsing your whole Drive. Both have been withdrawn from our Google client and neither can be granted on any AXOIX connection today. The Gmail feature is switched off in the product entirely; Drive browsing continues on drive.file and simply lists only the files AXOIX created or that you handed to it.

If we ever reinstate either of them, this page changes first, they go through Google’s restricted-scope verification and an independent Cloud Application Security Assessment (CASA), and you would still be asked to approve the new permission on Google’s own consent screen before anything was granted.

6.4 Limited Use — how we use Google user data

Google user data is used solely to provide the feature you enabled. Specifically, it is:

• Never sold, licensed, rented or transferred to a data broker or any other party.
• Never used for advertising, ad personalisation, retargeting, audience building or measurement of any kind.
• Never used to develop, improve or train generalised AI or machine-learning models — including the self-hosted models described in section 3.
• Never sent to a third-party AI provider. Google user data is excluded from Bring-Your-Own-Key routing, so it is not forwarded to an external model provider — OpenAI, Anthropic, Groq or Google Gemini — even if you have configured a BYOK key under section 3.
• Never aggregated across customers, benchmarked, warehoused for secondary use, or resold in derived form. Google Ads, Analytics and YouTube performance data is fetched on demand to display to your own authorised users.
• Never read by AXOIX personnel, except with your explicit consent (for example when you raise a support request), where strictly necessary for security purposes, or where required by law.

6.5 Where tokens and data are stored

The access and refresh tokens Google issues are transmitted only over TLS and are never returned to your browser or exposed in any AXOIX API response. Where they rest depends on which service you connected:

You may connect more than one Google account, and assign different services to different accounts. Each connected account holds its own set of tokens, stored and encrypted separately from the others, and disconnecting one leaves the rest untouched. Where this section refers to a connected account it means each of them individually, not a single account per user.

• Sign-in, Calendar, Drive, Docs, Sheets, Ads, Analytics, Business Profile and Classroom — tokens are stored only in your own tenant’s isolated database, against your individual user record, and are encrypted at rest with authenticated encryption (Fernet — AES-128-CBC with HMAC-SHA256, from a key derived with PBKDF2-HMAC-SHA256 at 100,000 iterations).
• YouTube — because CHORUS publishing runs from our central platform rather than inside your tenant, this token is stored in our central AXOIX platform database, tagged to your tenant and project, and encrypted at rest. It is used only to publish to, and report on, the channel you connected.

We do not create a copy of your Drive or ad account. File content, ad performance and analytics are fetched from Google when you open the screen that displays them. What AXOIX stores persistently is limited to what a feature genuinely needs: the identity of the connected account, the set of permissions granted, a record linking a Drive file you chose to the AXOIX record you attached it to, a record of AXOIX bookings that have been written into your calendar so they can be kept in step, and — for Education customers — the Classroom courses, rosters, coursework and grades being synchronised with your Education module.

6.6 How long we keep it, and the one copy that leaves our servers

• Tokens are kept only while the connection exists. Disconnecting deletes them in the same request; we do not archive an expired or revoked token.
• Records derived from a Google service — the link between a Drive file and the AXOIX record you attached it to, the record of which AXOIX bookings have been written into your calendar, and, for Education customers, the Classroom data being synchronised — are kept for as long as the AXOIX record they belong to, because deleting them would break the AXOIX feature rather than protect you. They go when you ask us to remove them, and when you delete your account.
• File content is not retained at all. It is fetched from Google each time you open the screen that shows it and is not written to our database.

Backups — stated plainly, because it is the one place a copy of Google user data exists outside our own machines. Every database is dumped nightly and encrypted with AES-256 before it goes anywhere. Because your Google tokens and the derived records above live inside your tenant database, they are inside that encrypted dump. Whether the dump then leaves our servers follows the same rule as the rest of your data in section 9: on a paid plan only with your cloud-storage consent, and on the free plan always, as a stated condition of that plan. The one exception is our central platform database, which holds the YouTube token and is always included, because it is what a recovery of the platform itself depends on.

The off-site copy is held by Backblaze B2 in the EU (eu-central-003, Frankfurt) for seven days, and on our own servers for thirty. Backblaze stores ciphertext and holds no key: the encryption key is kept in our secret store and is deliberately never written into the same bucket as the backups it opens. A storage provider holding an encrypted copy on our behalf is not a transfer of your Google data to anyone for any other purpose, and the Limited Use commitments in section 6.4 apply to it unchanged.

6.7 What cannot reach your Google data

• Third-party AI providers. Google user data is excluded from Bring-Your-Own-Key routing (section 3). Configuring an OpenAI, Anthropic, Groq or Google Gemini key does not put your files, calendar or Classroom records in front of that provider.
• The MCP connector. The AI-assistant connector described in section 5 works from a fixed catalogue of AXOIX operations that is closed by default — an operation is unreachable unless it has been explicitly added — and no Google-backed operation is in it. An assistant you connect cannot read your Drive, Calendar or Classroom data through AXOIX.
• Our other integrations. Google user data is never sent to Razorpay, Brevo, the social-media platforms, our travel or e-commerce providers, or our telephony carriers. Those providers appear in section 4 for their own purposes and receive nothing from a Google connection.

6.8 Revoking access and deletion

You can disconnect at any time, and you can revoke our access directly at myaccount.google.com/permissions.

• Sign-in, Calendar, Drive, Docs, Sheets, Ads, Analytics, Business Profile and Classroom — disconnecting from Settings → Google Workspace sends a revocation request to Google and deletes the stored access and refresh tokens immediately.
• YouTube — disconnecting from CHORUS sends a revocation request to Google for the underlying grant and deletes the stored account record and its token from our platform database.

Because the two grants are independent, each of these disconnects now affects only the services named in it — disconnecting YouTube leaves Calendar, Drive and Classroom working, and disconnecting the others leaves a connected channel publishing. Revoking a grant stops all future access to the services that grant covers, immediately; it does not touch the other grant. To also have any Google content AXOIX retained on your behalf removed — synchronised Classroom records, calendar sync records, or Drive file links — email [email protected] and we will delete it within 30 days. We will not claim to edit a backup that has already been written: encrypted dumps taken before your request are not rewritten, they expire on the schedule in section 6.6 — seven days off-site, thirty on our own servers — and nothing is ever restored from them except to recover the platform after a failure. Deleting your AXOIX account removes all of it, as described in section 9 and on our data deletion page.

AXOIX’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Where Your Data Lives

• Compute, databases, email server — our VPS in India.
• Object storage (uploaded files) — Backblaze B2 eu-central-003 region (Frankfurt, Germany). Each tenant has a dedicated private bucket.
• CDN edge cache — Cloudflare globally distributed edge servers cache publicly-accessed file responses (signed URLs) transiently to reduce latency and bandwidth cost. Cached copies are purged on a rolling TTL; you can request a purge at any time.
• BYOK AI responses — if enabled, processed by the chosen provider in their region (see their documentation).

If your jurisdiction (e.g. EU GDPR, UK GDPR, DPDP Act India) imposes specific data residency or cross-border transfer obligations on you as a data controller, you are responsible for assessing whether this architecture meets those obligations before using AXOIX.

8. Data Security

Credentials and secrets are stored in HashiCorp Vault. Tenant B2 storage credentials and mailbox passwords stored in your tenant database are encrypted with Fernet (AES-128-CBC with HMAC-SHA256 authentication), using a key derived via PBKDF2HMAC-SHA256 with 100,000 iterations. All public traffic uses HTTPS with TLS certificates from Let's Encrypt. We restrict administrative access on a least-privilege basis. No system is impenetrable, but we take reasonable steps to protect your data against unauthorised access.

9. Data Retention & Backups

We retain account and tenant data for as long as your account is active. After account closure we retain minimum records required by law (e.g. invoices, tax records) and otherwise delete tenant content on request. Contact [email protected] to request deletion. Note that deletion of tenant content includes the contents of your Backblaze B2 bucket; Cloudflare edge caches for your files are purged on request within 24 hours.

Off-site backups and cloud-storage consent. Whether a copy of your data leaves our own servers depends on your plan, and on paid plans it is your choice:

• Paid plans — you decide. We hold an off-site copy in Backblaze B2 (EU) only if you have given us cloud-storage consent. Without that consent your data is backed up on our own servers only and never reaches a third-party storage provider. You can withdraw the consent at any time from your dashboard, and we stop sending anything further immediately. Copies already stored are not deleted automatically — withdrawing consent is not a deletion request, and destroying files because you changed your mind about where they live could lose you data. Ask us and we will erase them, or migrate them back to our servers first; either way we action it without delay.
• Free plan — included, and not optional. Free accounts are closed automatically after 40 days of inactivity, so the off-site copy is the only thing that makes an unintended closure reversible. For a free account the realistic alternative is not “stays on our servers” but “permanently destroyed”, so it is a condition of the free plan rather than a choice. Upgrading to any paid plan gives you the control described above.

10. Your Rights

Subject to applicable law, you may: request a copy of the data we hold about you; correct inaccurate data; request erasure; object to processing; or withdraw consent where processing is based on consent. Email [email protected] to exercise any right.

11. Cookies

We use a minimal set of cookies for authentication sessions and basic analytics. You can control cookies via your browser settings; disabling cookies may impair parts of the Services that require sign-in.

12. Children

The Services are not directed to individuals under 18. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or a notice on the Services. Continued use after changes means you accept the revised policy.

14. Contact

Questions, complaints, or requests? Email [email protected] or call +91 89292 22212.

Registered office: Axoix Technologies Private Limited, B-59, Second Floor, Southern Side, Block B, Rama Park Road, Uttam Nagar, New Delhi, Delhi - 110059, India.
CIN: U62099DC2026PTC471359  |  GSTIN: 07ABFCA7413E1ZY  |  Udyam: UDYAM-DL-10-0120748  |  D-U-N-S: 581637158  |  DPIIT: DIPP270090

See also our Terms of Service.