Beta Privacy Notice - Private Draft

1. Draft Status, Operator and Scope

PRIVATE DRAFT - NOT READY FOR PUBLICATION. Axolect Beta is a shared AI research workspace for investment teams. Legal operator name, individual/company status, country/state and business address: [OWNER CONFIRMATION REQUIRED].

This private notice covers the website at axolect.com and the workspace: intake requests, accounts, shared research, AI processing and supporting records. Controller/processor roles, production configuration and applicable jurisdictions: [OWNER CONFIRMATION REQUIRED].

This text describes source-supported flows and unresolved drafting questions. It is not an adopted privacy policy, a blanket consent request or an assurance of compliance. Owner confirmation and legal review are required before publication.

2. Website and Workspace Data

2.1 Submitted Data

Website intake and workspace activity are separate flows. The table describes the submitted categories supported by current source; actual production operation must be confirmed.

2.2 Operational and Collaboration Data

2.3 External Inputs

The source supports external authentication and research/provider responses when the corresponding integrations are configured:

• Supabase Auth supports workspace email/password accounts. Other authentication providers, OAuth scopes and profile fields in production require owner confirmation; the website intake does not implement account sign-in.
• Configured AI providers receive research instructions and return output. External research/data sources and tool responses depend on the run configuration; the active routes require owner confirmation.

3. Source-Supported Processing

Current code uses data for the following operations:

• Store waitlist and beta requests in Supabase so the operator can review research workflow fit.
• Authenticate workspace users and apply workspace membership and role checks.
• Send beta request details through configured Slack and Resend routes, including a Resend receipt to the requester.
• Use request origin checks, validation, honeypot detection and IP-derived in-memory rate-limit keys for website abuse prevention.
• Stream configured AI output, retain run records and collect usage metrics and diagnostic traces; external monitoring depends on configuration.
• Record guidance, proposals and human review decisions. The matching Terms & Conditions remain a private draft and do not establish adopted enforcement powers.
• Any use for marketing, product improvement, legal requests or purposes beyond the verified workflow: [OWNER CONFIRMATION REQUIRED].

AI runs generate research output and proposals; authorized review actions control proposed canvas changes under workspace policies. This does not establish a policy on every form of automated decision-making or profiling.

3.1 Notices and Communication Choices

Communication preferences, marketing notices, consent grounds and withdrawal methods: [OWNER CONFIRMATION REQUIRED]. Questions can be sent to privacy@axolect.com . An automatic unsubscribe or consent-management flow is not represented as verified.

4. Processing Roles and Legal Grounds

The operator and intended participant regions are unknown. Applicable privacy law, controller/processor roles and a purpose-by-purpose lawful basis assessment: [OWNER CONFIRMATION REQUIRED]. The following are review topics, not adopted legal grounds:

• Website intake: identify its purposes, required fields and processing grounds - [OWNER CONFIRMATION REQUIRED].
• Workspace accounts and shared research: confirm operator instructions, team responsibilities and processing grounds - [OWNER CONFIRMATION REQUIRED].
• AI, diagnostics and usage metering: assess providers, data minimization and processing grounds - [OWNER CONFIRMATION REQUIRED].
• Optional communication and any required consent: identify choices, notices and withdrawal mechanisms - [OWNER CONFIRMATION REQUIRED].

Questions about processing grounds or communication choices can be sent to privacy@axolect.com . Applicable procedures and response periods: [OWNER CONFIRMATION REQUIRED].

5. Recipients and Visibility

Source-supported recipients are described below. A supported integration is not proof that it is active in production or bound by a verified contract.

5.1 Supported Service Routes

Current website and workspace source supports these service routes, depending on configuration:

• Supabase: website request records and configured workspace authentication and database storage.
• Slack and Resend: beta request notification details; Resend also sends the receipt email to the requester.
• AI providers: OpenAI, Anthropic, Groq, OpenRouter, Ollama and custom compatible endpoints can receive prompts and run context according to configuration.
• Sentry and Langfuse: optional error reporting and run traces. Traces can include prompts, output, tool information, identifiers and usage.
• Lago metering and hosting/synchronization services: supported usage delivery and workspace operation. Active vendors, data fields and deployment locations require confirmation.

Active recipients, access by staff, provider training/retention policies, contracts, subprocessors and processing regions: [OWNER CONFIRMATION REQUIRED]. No provider no-training assurance or executed data processing agreement is assumed.

5.2 Workspace Participants

Authorized workspace participants can see shared canvas content, presence, cursors and research/review records according to workspace access and configuration. Exports and teammate copies can outlast a participant account. Public indexing is not asserted.

5.3 Other Disclosure Policies

Disclosure for legal demands, business transfers, sale/sharing of personal data and secondary uses: [OWNER CONFIRMATION REQUIRED]. No universal no-sale/no-sharing or advance-notice policy is adopted by this draft.

6. Retention and Deletion

Removing an account or canvas does not establish deletion from audit records, runtime storage, backups, provider systems or teammate exports. Retention criteria, erasure exceptions, legal holds and deletion verification: [OWNER CONFIRMATION REQUIRED].

7. Security and Credential Handling

Security controls exist in source, but production configuration and operating practices require separate confirmation:

• Transport security, infrastructure encryption and any credential encryption guarantees: [OWNER CONFIRMATION REQUIRED]. Configured HTTPS is not proof of encryption for every storage location.
• The workspace supports configured Supabase authentication and verifies caller identity and workspace permissions. Offline mock authentication exists for testing and development.
• Database adapters include workspace access checks; website intake uses a server-only Supabase service-role client. The service-role path is not governed by end-user RLS in the same way as workspace user access.
• Provider credentials configured in workspace settings are stored in browser local storage and forwarded in runtime requests. They should not be entered as research content; the runtime/provider routes can process them for authentication.
• The runtime receives provider keys in run parameters and holds run configuration in its run records. Separately, configured lifecycle storage persists state, events, usage and votes. Credential retention and redaction across storage, traces, logs and exports: [OWNER CONFIRMATION REQUIRED].
• Website actions include validation, origin checking, a honeypot and an in-memory IP-derived limiter; notification text is sanitized for Slack and plain-text email. These controls are not a complete security assurance.
• Access review, credential rotation, incident response, staff access and independent security certification: [OWNER CONFIRMATION REQUIRED]. No certification is established by the source review.

Security and privacy commitments require owner approval and deployment verification. Technical features alone do not establish a universal security guarantee.

8. Browser Storage and Tracking

Workspace browser storage includes authentication session information, connection settings and provider credentials. Collaboration sync separates graph state from presence/cursor maps. This draft does not promise that all such data is absent from document snapshots.

Production cookies, hosting logs, analytics, tracking/advertising tools, consent choices and browser privacy signal handling: [OWNER CONFIRMATION REQUIRED]. Website Sentry reporting is conditional on configuration; unverified analytics products are not asserted as active.

9. Privacy Requests

Requests about access, correction, deletion or export can be raised with the contact below. Applicable rights, verification, authority to act for a team and fulfillment procedures: [OWNER CONFIRMATION REQUIRED]. No automatic universal deletion right or deadline is promised.

9.1 Region-Dependent Rights

Rights and complaint authorities depend on the operator, processing grounds and applicable law. The regional assessment is [OWNER CONFIRMATION REQUIRED]; this draft does not assume GDPR coverage worldwide.

9.2 Applicable Request Processes

California or other region-specific request and opt-out procedures, applicability thresholds and required notices: [OWNER CONFIRMATION REQUIRED]. No unrestricted lookback or no-sale assurance is made.

9.3 Request Verification and Scope

The owner must confirm these practical request-handling topics before adopting a policy:

• Identify the website request or workspace and the relevant data categories - procedure [OWNER CONFIRMATION REQUIRED].
• Verify the requester and any authority to act for other participants - procedure [OWNER CONFIRMATION REQUIRED].
• Evaluate deletion alongside review/audit records, backups, providers and legal holds - policy [OWNER CONFIRMATION REQUIRED].
• Identify complaint, correction, objection and consent-withdrawal routes where applicable - procedure [OWNER CONFIRMATION REQUIRED].
• Explain request limits and the relevant response period under applicable law - policy [OWNER CONFIRMATION REQUIRED].

Privacy requests can be sent to privacy@axolect.com . Inbox monitoring, designated representatives, verification steps and response timelines: [OWNER CONFIRMATION REQUIRED].

10. Locations and International Transfers

Website and workspace services can process data in different locations according to hosting and provider configuration. Actual countries, cross-border flows and residency commitments: [OWNER CONFIRMATION REQUIRED].

• Any required contractual transfer safeguards and access to their documentation: [OWNER CONFIRMATION REQUIRED]. This draft does not assert executed standard contractual clauses.
• Any applicable adequacy decision or other transfer mechanism: [OWNER CONFIRMATION REQUIRED]. No universal protection guarantee is asserted.

Jurisdiction-specific transfer restrictions and the provider chain must be reviewed after operator and participant locations are known: [OWNER CONFIRMATION REQUIRED].

11. Regional Policies Requiring Review

Regional policies are pending. The existing regional reference link is preserved for review; its presence does not establish the applicability of Indian or any other law.

11.1 Age and Children

Minimum age, child-related processing restrictions, age checks and any required parental/guardian process: [OWNER CONFIRMATION REQUIRED]. No compliant child consent mechanism is represented as implemented.

11.2 Contacts and Regional Complaints

Contact channels are retained, but appointment of a privacy or grievance officer and regional complaint procedures: [OWNER CONFIRMATION REQUIRED].

• Privacy questions: privacy@axolect.com . Designation and monitoring of any regional officer or grievance contact: [OWNER CONFIRMATION REQUIRED].
• Legal draft questions: legal@axolect.com . Escalation ownership and procedure: [OWNER CONFIRMATION REQUIRED].

Regional complaint handling and legally applicable response periods: [OWNER CONFIRMATION REQUIRED]. No fixed grievance timeline is adopted here.

The existing regional authority reference for Data Protection Board of India is retained. Whether it is the relevant authority and what complaint process applies to this operator and processing: [OWNER CONFIRMATION REQUIRED].

11.3 Incident Notification Policies

Incident notification procedures require owner and legal review before adoption:

1. Applicable regulators, notification triggers and reporting periods: [OWNER CONFIRMATION REQUIRED]. This draft does not adopt a fixed regulator notification deadline.
2. Participant notification triggers, timing, message contents and contact procedure: [OWNER CONFIRMATION REQUIRED]. No monitored emergency response commitment is established.

11.4 Regional Transfer Rules

Any region-specific restrictions on providers and international processing: [OWNER CONFIRMATION REQUIRED]. These must be assessed against actual configuration and applicable law.

11.5 Future Commercial Disclosures

If a paid arrangement is introduced, required operator, commercial and privacy disclosures must be confirmed first. Pricing has not been announced; regional disclosure obligations: [OWNER CONFIRMATION REQUIRED].

12. Authentication Providers

The current workspace source supports Supabase email/password authentication. The website intake does not provide Google sign-in. Any additional authentication providers must be verified before making provider-specific disclosures.

12.1 Authentication Configuration

The following describes configuration topics to confirm, not verified OAuth scopes:

Authentication provider, enabled methods, identity fields and production scope settings: [OWNER CONFIRMATION REQUIRED]. No Google Drive, Gmail or other API access configuration is assumed.

12.2 Account Data

The workspace auth adapter handles account identifiers, email, optional name and session tokens. The actual production configuration must be confirmed:

• Email and user identifier: used in configured authentication and workspace membership.
• Optional account name: supported by the workspace auth adapter; source support does not establish all profile fields collected in production.
• Access token and session expiration: used to authenticate workspace requests and synchronization.

Any social-provider fields, avatar data, scopes or provider tokens, and their storage/access rules: [OWNER CONFIRMATION REQUIRED]. No blanket statement about all Google account data is adopted.

12.3 Proposed Account Data Rules

Proposed account data use requires explicit owner confirmation:

1. Draft proposal: use account identifiers to authenticate participants and apply workspace access controls.
2. Draft proposal: document any additional account field use and allow corrections through an agreed process.

The following provider-account policies remain unresolved:

• Secondary use, sale or sharing of account data: [OWNER CONFIRMATION REQUIRED].
• Advertising, profiling or automated use of account data: [OWNER CONFIRMATION REQUIRED].
• Service-provider contracts, permitted disclosures and account-data retention: [OWNER CONFIRMATION REQUIRED].

12.4 Provider Policy Review

The existing Google API Services User Data Policy reference is retained for provider-policy review. If Google APIs are enabled later, applicability, scope verification and Limited Use requirements must be reviewed: [OWNER CONFIRMATION REQUIRED]. No present compliance assurance is made.

• Approved authentication purposes and data minimization rules: [OWNER CONFIRMATION REQUIRED].
• Provider-specific notices, consent and configuration records: [OWNER CONFIRMATION REQUIRED].
• Provider-specific disclosures, contracts and transfer restrictions: [OWNER CONFIRMATION REQUIRED].

13. Contacts and Publication Blockers

Existing inboxes are retained for this private draft. Legal operator, business address, monitored contact ownership, effective date, data roles, retention and provider policies must be confirmed before publication: [OWNER CONFIRMATION REQUIRED].

• Privacy draft and data-flow questions: privacy@axolect.com .
• Legal operator and policy questions: legal@axolect.com .
• Security and credential questions: security@axolect.com .