Axari Privacy Policy

1. Who we are and what this covers

Axari Technologies, Inc. (“Axari”, “we”, “us”) provides Axari: a service that gives each person on a security team a personal AI colleague (a “Twin”) that works inside messaging platforms such as Slack and Microsoft Teams, connects to tools that person chooses, and performs work with that person's approval.

This policy explains what information we collect, how we use it, who we share it with, how long we keep it, and the rights you have. It covers the Axari product (including the Slack and Teams apps and app.axari.ai) and our marketing website (www.axari.ai). It applies to Customers (organizations), their Users (individuals with a Twin), and visitors to our website.

Where Axari processes Customer Data on behalf of a Customer organization, the Customer is the data controller and Axari acts as a processor under the applicable agreement and Data Processing Agreement. This policy describes our practices in plain language; contractual terms live in the Terms of Service and any DPA.

2. Information we collect

2.1 Account and profile information

• Name, work email address, and organization, provided at signup or by the admin or colleague who invited you.
• Basic profile details from your messaging platform when you sign in (for example your Slack user ID, display name, title, and workspace), used to create your account and personalize your Twin.
• The role or roles you select (for example GRC lead, SOC lead), used to tailor what your Twin suggests and how it communicates.

2.2 Content you bring to your Twin

• Messages you send to your Twin, and conversation content you explicitly invoke it on (for example via a slash command or message shortcut in a thread).
• Data from integrations you personally connect (for example calendar, email, ticketing, or security tools). Each integration is a separate, scoped authorization that you grant and can revoke at any time. Axari accesses connected tools only to provide the service.
• Tasks, commitments, and preferences you ask your Twin to track or remember.

2.3 Proactive assistance

Your Twin can work proactively: it evaluates content from the sources you have connected or invoked it on, in order to track commitments, watch deadlines, and surface things that need your attention. It applies exclusions designed to leave sensitive personal content alone, and everything it does is recorded in an activity log you can review. It does not read channels or conversations you have not connected it to or invoked it in.

2.4 Memory

Your Twin learns how you work: formats, tone, priorities, and corrections you give it. This memory is private to you, visible to you, and deletable by you (ask your Twin to forget something, or manage memory in the app).

2.5 Service telemetry and session records

We record what the service does: sessions, actions taken, tools called, errors, latency, and credits consumed. Session content is summarized and redacted at ingestion for operational use; we use these records to run the service reliably, investigate problems, meter usage, and improve the product. We do not use Customer Data to train foundation models by default (see Section 3).

2.6 Organizational information from public sources

To give Twins useful context, we compile profiles of organizations from publicly available sources (for example a company's website, public filings, and security pages). This can include your Customer organization and, where a User runs vendor-risk work, third-party vendor organizations. These profiles describe organizations, not private individuals; they may include the names and roles of publicly listed leadership. Profiles can be incomplete or out of date, are marked with their sources, and should be verified before being relied on.

2.7 Billing information

For self-serve plans, payment is processed by our payment processor (Stripe). Axari receives billing status, plan, and card metadata (such as last four digits), never full card numbers. Enterprise billing is handled per the applicable Order Form.

2.8 Website visitors and cookies

Our marketing website uses necessary cookies for basic operation and, only with your consent, analytics cookies (Google Tag Manager and Google Analytics). The invite request form is provided by HubSpot, which may set cookies related to form delivery and spam prevention. You can accept or reject analytics on first visit and change your choice anytime via Cookie preferences in the footer. The product application uses cookies required to authenticate users and operate the service.

3. How we use information

• To provide the service: run your Twin, execute the work you approve, deliver briefs and notifications, and maintain your activity log.
• To keep the human in control: consequential actions (external sends, posts, and writes) wait for your explicit approval before executing.
• To personalize: apply your role, preferences, and memory so your Twin works the way you do.
• To operate and improve the product: monitor reliability, investigate errors, understand which capabilities are used, and identify failures. This uses summarized, redacted session records.
• To meter and bill: count credits consumed and administer plans, top-ups, and contracts.
• To secure the service: detect abuse, enforce isolation, and respond to incidents.
• To communicate: service notifications (approvals, billing receipts, account changes) and a limited set of lifecycle emails, governed by suppression rules. Account and security notices cannot be muted; other notifications can.

Model training default: Axari does not use Customer Data to train foundation models unless the Customer explicitly opts in and the use is documented and communicated.

4. The privacy of your Twin

A Twin works for one person. Its conversations, memory, and activity log are available to its owner. They are not made available to workspace admins, to the Customer's leadership, or to other users through Axari. Axari personnel access customer environments only through audited support processes. Aggregated, de-identified usage measures (for example seat counts and credit consumption) are visible to Customer admins for administration and billing; the content of a Twin's work is not.

5. Sharing and sub-processors

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only with:

• Model providers. Prompts and context are sent to large language model providers (for example via OpenRouter to Anthropic, OpenAI, and others) to generate responses, under agreements that prohibit training on this data. If your organization uses BYOK (bring your own key), inference traffic for agent work is sent to your organization's own model provider account under your organization's agreement with that provider; Axari continues to make limited platform model calls (for example message classification) on Axari's own keys.
• Platform providers. Slack and Microsoft, to operate the apps inside those platforms.
• Infrastructure and operations. Cloud hosting, payment processing (Stripe), product analytics (Mixpanel), observability and tracing, and email delivery providers.
• Legal and safety. Where required by law, to protect rights and safety, or in connection with a corporate transaction, with notice where required.

6. Retention and deletion

• Active accounts: data is retained while the account is active, per the practices in our Security Practices page.
• Memory: you can delete individual memories at any time; deletion is honored in your Twin's future work.
• Uninstall or termination: if the Axari app is removed from your workspace or your organization's contract ends, the service is suspended and data is retained for 30 days so your organization can export it. After 30 days, Customer Data is deleted and stored third-party authorizations (OAuth grants) are revoked, except where law requires retention. Backups expire on their own schedule thereafter.
• Removed users: if an admin removes a user, that user's Twin is deactivated and their personal data is handled per this retention schedule.

7. International transfers

Axari is a Delaware, USA company and processes data in the United States and other locations where our sub-processors operate. Where required, transfers are protected by appropriate safeguards such as Standard Contractual Clauses. Details are available in the DPA.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal information, and to object to certain processing:

• EU/UK (GDPR): the rights above, plus the right to lodge a complaint with a supervisory authority.
• California (CCPA/CPRA): the rights to know, delete, correct, and to non-discrimination. We do not sell or share personal information as those terms are defined in the CPRA.
• India (DPDP Act): the rights to access, correction, erasure, and grievance redressal.

To exercise rights, contact privacy@axari.ai. If you use Axari through your employer, we may direct your request to your organization, which controls Customer Data. We respond within the timelines required by applicable law.

9. Security

Our technical and organizational safeguards (encryption, access control, tenant isolation, incident response) are described on our Security Practices page. If we learn of a security incident involving your data, we will notify affected customers without undue delay, consistent with legal and contractual requirements.

10. Children

Axari is a workplace product and is not directed to children under 16. We do not knowingly collect personal information from children.

11. Changes to this policy

We will update this policy as the product evolves. Material changes will be announced on this page and, where appropriate, by email or in-product notice. The effective date above always reflects the current version.

12. Contact

Privacy questions and rights requests: privacy@axari.ai. Security: security@axari.ai. Axari Technologies, Inc.