Privacy Policy

This Privacy Policy explains how Staxaxis ("Staxaxis", "we", "us") handles information when you use our value-intelligence platform. It is written to describe our data practices in plain language; it is not a substitute for legal advice.

Data we process

Staxaxis processes two broad categories of data: account data you provide when you create a workspace (name, email, organization) and business data from the systems you choose to connect or upload. Connected-system data is used solely to generate findings, evidence, and value analysis for your own organization.

How we use data

• To operate the platform: run Axis Scans, generate findings, and compute your Axis Score.
• To ground Ask Stax answers in your organization's own evidence.
• To secure your account, enforce access controls, and maintain audit trails.
• To provide support and improve reliability of the service.

Tenant isolation

Your data is scoped to your organization. Every query is organization-scoped, and access is governed by role-based access control. We do not use one customer's business data to serve another customer.

Data retention

We retain workspace and finding data for as long as your workspace is active. You can request deletion of your workspace data, and connected-system data is removed according to your data-lifecycle settings.

Security

We apply defense-in-depth: authenticated access, optional multi-factor and step-up authentication, least-privilege connector credentials, encryption in transit, and audit logging of sensitive actions.

Website analytics & cookies

On our public website we use only first-party cookies — no third-party advertising, retargeting, or social-media tracking pixels. We record an anonymous, cookieless count of page and call-to-action activity to measure our conversion funnel; because it stores nothing on your device and cannot identify you, it runs under legitimate interest.

Everything that could identify a visitor is optional and off until you consent. With analytics consent we record a first-party visit profile: pages viewed, engagement (time on page, scroll depth, section attention), coarse location (country/region/city from network edge headers), device and browser type, referral and campaign source, your account identity if you are signed in, and your organization via a reverse-IP company lookup. For that lookup your IP address is used transiently and is never stored — we keep only the resulting company name and domain. This data is first-party, never sold, and used only to understand and improve our site. Full details are in our Cookie Policy.

You can change your choice at any time: Cookie preferences. We honor a Global Privacy Control (GPC) signal by keeping analytics off unless you explicitly turn it on.

Operational telemetry

To keep the service reliable we collect server-side error and performance telemetry (for example, stack traces and request timing) through our observability provider. This is operational data used to detect and fix problems; it is not advertising or cross-site tracking, and it does not place tracking cookies in your browser.

Sub-processors

We rely on a small set of vendors to run Staxaxis, each under contract and used only for its stated purpose:

• Vercel — application hosting and content delivery.
• Neon — managed PostgreSQL database.
• Upstash — rate limiting and ephemeral caching.
• IPinfo — reverse-IP company lookup (IP used transiently, not stored).
• Resend — transactional email (verification, password, notifications).
• Stripe — payment processing for paid plans.
• Sentry — server-side error and performance telemetry.

Contact

Questions about this policy or your data can be directed to your Staxaxis workspace administrator or your account contact.