Your privacy, in plain terms.

Information We Collect

We collect information you provide directly to us, such as when you create an account, use our services, or contact us for support. This includes your name, email address, and usage data generated while interacting with our AI tools.

We also automatically collect certain technical information when you use our platform, including IP addresses, browser type, operating system, referring URLs, and pages visited. This data helps us maintain security and improve performance.

When you purchase credits or receive creator payouts, payment is handled by our payment processor, Stripe. We receive transaction records (amounts, timestamps, status) and store your credit balance and ledger, but full card details are handled by Stripe and are never stored on our servers.

How We Use Your Information

We use the information we collect to provide, maintain, and improve our services; process transactions; send you technical notices and support messages; respond to your comments and questions; and monitor usage patterns to enhance the platform.

We do not sell your personal information to third parties. We may share aggregated, anonymized data that cannot reasonably be used to identify you.

Data Storage and Security

We store the account, workflow, and product data needed to operate the platform. Current safeguards include protected sessions, server-side access checks, rate limits on selected public endpoints, and API-key encryption before storage.

Some infrastructure is provided by third-party services such as Supabase and PostgreSQL-backed systems. No internet service can promise absolute security. If you have specific retention, residency, or compliance requirements, confirm them with us before uploading regulated or highly sensitive data.

Cookies and Tracking

We use HttpOnly cookies to maintain web sessions and browser storage for some client-side preferences. We use a privacy-conscious product analytics tool to understand how our marketing site and product are used (aggregate events like page views and feature usage); we do not use it to build advertising profiles. Disabling cookies can affect sign-in and session continuity.

We do not use third-party advertising cookies or sell your browsing data to advertisers.

Your Rights

You can update your profile information and delete your account directly in account settings. Account deletion takes effect after a 14-day grace window during which you can restore the account; personal data is then permanently erased, while records we must keep for accounting are retained without identifying information. For access, export, or correction requests that are not self-service, email support@axeron.ai so we can verify the request and respond appropriately.

Connected Accounts

You can connect third-party accounts — LinkedIn, Google, and others listed in the app — so that a team can act in them on your behalf. Connecting uses the provider's own OAuth screen: we never see or store your password for that account, and we only ever receive the permissions shown to you on that screen.

What we store: an encrypted access token (and refresh token, where the provider issues one), the account label we display so you can tell connections apart, the permissions granted, and the token's expiry. Tokens are encrypted before they are written to our database.

What we do with it: only the specific actions listed for that connector, and nothing else the token would technically permit. Every action that writes, sends, or publishes requires your explicit approval of that particular item first — approving one post or one email does not authorize the next. Content a team reads from a connected account is passed to the AI model handling your request so it can act on it; it is not used to train models, and it is not sold or shared for advertising.

Disconnecting: removing a connection in Settings deletes the stored tokens and immediately withdraws the team's ability to act in that account. You can also revoke our access from the provider's own security settings at any time.

What Each Connection Can Access

Google (Gmail, Drive, Docs, Sheets, Slides, Calendar, YouTube, Search Console). Each Google service is connected on its own, and we request only that service's permissions, plus your email address (userinfo.email) so the connection is labelled with the account it belongs to.

Gmail (gmail.modify). We read and search your mail so a team can understand a thread and write a real reply. When you ask, we create a draft, send or forward a message as you, change a message's labels (for example to archive it or mark it read), or move a message to Trash, where you can restore it for 30 days. We never permanently delete mail. Every send, forward, label change and trash requires your approval of that specific message first.

Google Drive, Docs, Sheets and Slides (drive, drive.file, drive.readonly, documents, spreadsheets, presentations, and their read-only forms). We find and read your files, documents, spreadsheets and presentations. When you ask, we create new ones; edit the text of a document or presentation; add rows to or update cells in a spreadsheet; create a folder; move a file; share a file with a person you name (as a viewer, unless you say they should edit); or move a file to Trash, where you can restore it for 30 days. We never permanently delete a file. Every change requires your approval of that specific action first.

Google Calendar (calendar). We read your events and find free time. When you ask, we create, change or cancel an event; Google emails the event's guests about a change or cancellation, and a cancelled event cannot be restored. Each of these requires your approval first.

YouTube (youtube.readonly, youtube.force-ssl). We list your channel's videos and the comments on them. When you ask, we reply to a comment, hold, publish or reject a comment, or edit a video's title, description or tags — each only after your approval. We cannot upload, delete or unpublish a video.

Google Search Console (webmasters.readonly). Read-only: we list the sites you have verified and read their search performance. We cannot change anything in Search Console.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to train generalized models, we do not sell it, and we do not transfer it except as needed to provide the feature you asked for, to comply with law, or with your explicit consent.

Microsoft (Outlook, OneDrive, SharePoint). We request the ability to read your mail, send mail as you, and read the files your work or personal account can reach across OneDrive and SharePoint. We cannot move, flag, or delete mail, and we cannot create, change, or delete files. Sending requires your approval of that specific message.

Dropbox. Read-only, and only three permissions: file metadata so a team can search for a document by describing it, file contents so it can read what it finds, and basic account information so we can show you which account is linked. We request no write permission of any kind — the integration cannot upload, modify, move, rename, or delete anything in your Dropbox, and no code path attempts to. File contents are passed to the AI model handling your request so it can act on them; they are not used to train models, not sold, and not shared for advertising.

HubSpot. We request read access to your contacts, companies, and deals, and write access limited to deals. That lets a team log a note on a record and move a deal to another stage, each only after you approve that specific action. We deliberately do not request write access to contacts, so an agent cannot edit a contact's details. We cannot delete records or change your pipeline settings.

LinkedIn. We request four permissions and no others: ‘openid’ and ‘profile’, which LinkedIn requires so we can tell which member an action belongs to; ‘email’, so the connection is labelled with your LinkedIn email address and you can tell one connected account from another; and ‘w_member_social’, which lets us publish a post, add a comment, or react — each one only after you have approved that specific item. If a post carries an image, we fetch it from the address given and pass it to LinkedIn; we do not keep a copy. We do not read your feed, your connections, or your messages, and we cannot delete anything. The only LinkedIn data we retain is your member identifier, needed to attribute an action to you, and your email address, shown as the connection’s label.

LinkedIn Pages. LinkedIn Pages is a separate connection, through a separate LinkedIn app with its own consent screen. If you connect it, we request these four permissions and no others: ‘rw_organization_admin’, which we use to list the Company Pages you administer and your role on each, and to read those Pages’ follower counts and post statistics (impressions, clicks, reactions, comments, shares); ‘r_organization_social’, to read those Pages’ own posts; ‘w_organization_social’, to publish a post, add a comment, or react as a Page you choose; and ‘w_member_social’, to publish, comment, react, or reshare a post as you. Every post, comment, reaction, and reshare happens only after you have approved that specific item and who it posts as. Statistics and posts are read when you ask and shown to you; we do not keep copies. We do not read your feed, your connections, your messages, or a Page’s followers as individuals, we do not change Page settings or admins, and we cannot delete anything. We retain only your LinkedIn member identifier, to tell your connection apart from others.

Slack. Post-only. A connected Slack account can post a message after you approve it, naming the channel. It cannot read channels, history, or direct messages.

Plaid (your bank accounts). We use Plaid Technologies, Inc. ("Plaid") to connect to your bank. You sign in to your bank inside Plaid's own window, or on your bank's own site — we never see your bank username or password. By connecting, you acknowledge that Plaid collects and processes your bank data under the Plaid End User Privacy Policy (https://plaid.com/legal/#end-user-privacy-policy). We request only Plaid's Transactions product, which is read-only: a team can read the accounts at the bank you connect, their balances, and their transactions. We cannot move money, make payments, see full account or routing numbers, or change anything at your bank. We store an encrypted Plaid access token for each bank you connect. Balances and transactions are fetched from Plaid when a team asks for them; what a team produces from them (an answer, a report, a run's results) is kept with that work like anything else you create here, and is deleted with it or with your account. Disconnecting the bank in Settings deletes our token and tells Plaid to remove the connection immediately, and you can also revoke access at any time at my.plaid.com.

Facebook Pages. We request the ability to list the Pages you manage, read those Pages' own posts and the comments on them, publish a post to a Page, reply to a comment as the Page, and hide or unhide a comment. Every one of those last three requires your approval of that specific item first — approving one post does not authorize another. Actions are taken as the PAGE and never as your personal profile: Meta has not permitted posting to a personal timeline through an API for years, and we request no permission that would reach one. We cannot delete a post or a comment, cannot run or pay for ads, and cannot change your Page's settings, roles, or audience.

Instagram. Connecting Instagram authorizes through the Facebook Page your account is linked to, because that is the only route Meta offers to a Business or Creator account; a personal Instagram account cannot be connected at all. We request the ability to read your posts with their like and comment counts, read the comments on them, publish an image post, reply to a comment, and hide or unhide one. Publishing and replying each require your approval of that specific caption, image, or reply. We cannot post Stories or Reels, send or read direct messages, delete anything, or follow and unfollow on your behalf.

For both, what we store is what we store for every connection: an encrypted access token, the account label, the permissions granted, and the expiry. Post and comment text we read is passed to the AI model handling your request so it can act on it; it is not used to train models, not sold, and not shared for advertising. Disconnecting in Settings deletes the stored tokens immediately, and you can revoke our access at any time from Facebook's Business Integrations settings.

Xero, QuickBooks, Ramp, DocuSign. Xero is read-only: invoices, bills, contacts, and reports, with no ability to create, edit, or delete anything in your books. QuickBooks is the one exception to our narrow-scope rule, because Intuit publishes a single accounting permission that carries write access and offers no read-only alternative; nothing is written without your explicit approval of that specific invoice or bill. Ramp consent is granted at the business level, so a connected administrator exposes company-wide card spend rather than only their own; changing a card limit requires your approval. DocuSign lets a team see the status of signature requests and, after your approval naming the signer, send a document out for signing; it cannot void or alter an envelope once sent.

Browser Extension

The Axeron browser extension adds an optimize button to the prompt box on supported AI sites (ChatGPT, Claude, Gemini, Perplexity, Poe, and Grok).

What it sends: only the prompt text in the field, and only at the moment you click the button. It does not read, log, or transmit anything as you browse or type, it does not track which sites you visit, and it has no analytics of its own. The prompt is sent to the same Axeron API the website uses, processed like any other prompt rewrite, and billed to your account. It is never sold or shared with third parties, and never used for advertising.

What it stores on your device: your Axeron sign-in token (read from an open Axeron tab so the extension needs no second login) and the API server address. Both live in your browser's local extension storage. The optimized result is also copied to your clipboard as a fallback in case it cannot be written back into the field.

Why it asks for the permissions it does: access to your Axeron domain to read your sign-in; access to your Supabase authentication domain to renew that sign-in when it expires; storage to keep the token between sessions; and clipboard write for that fallback. It requests no access to any site beyond the supported AI sites listed above.

Removing it: uninstalling the extension deletes everything it stored locally. Signing out of Axeron in your browser also invalidates the stored token.

Text Messages (SMS)

Businesses on Axeron can give their AI agents a phone number. An agent texts people who texted or called it first, or who gave their number and asked to be texted, about the questions and requests they raised. Each agent says who it is, which company it works for, and that it is an AI agent.

What we collect: your phone number, the texts you exchange with the agent, and whether you have opted out. The business that runs the agent can see these conversations. We use them only to deliver the messages and to answer you.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. Phone numbers and message content are passed only to the carriers and messaging providers that deliver the texts, such as Twilio and Telnyx, and are never sold.

Reply STOP to any agent number to stop receiving texts from it, and START to resume. Reply HELP for help, or email support@axeron.ai. Message frequency varies. Message and data rates may apply.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a prominent notice on our platform. Your continued use of our services after changes take effect constitutes acceptance of the updated policy.