Axioree Privacy & Data Governance•Last Updated: March 2025

Privacy Policy

At Axioree (“Axioree,” “we,” “us,” or “our”), we take your privacy, proprietary code, and personal data with the utmost seriousness. As a technology consultancy and digital engineering collective delivering custom web applications, SaaS platforms, enterprise systems, and marketing campaigns to clients worldwide, we are committed to transparent data practices and compliance with international data privacy standards, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and the laws of Bangladesh.

This Privacy Policy explains how we collect, process, store, and safeguard your personal information when you visit axioree.com, use our free browser utilities (such as ToolsTrek and TinyWaveQR), interact with our machine-readable discovery interfaces (such as our OpenAPI catalog and LLM endpoints), submit project inquiries, or contract our engineering services. For details governing project milestones, billing, and code deliverables, please review our Terms & Conditions and Refund Policy.

Our Core Privacy Commitments
Zero Data Selling: We never sell, rent, or monetize your personal information or contact details to third-party data brokers.
NDA Protected: All client project briefs, source code, database credentials, and system architectures are guarded under strict confidentiality.
PCI-DSS Compliant Payments: We do not store raw credit cards. Transactions are processed via Stripe, SSLCommerz, and bKash.
Global Rights Respect: Full support for GDPR (EU/UK) and CCPA (California) data subject rights including access, deletion, and portability.

1. Scope & Commitment

This Policy applies to information collected through our website, web applications, customer support channels, email correspondence, online meetings, digital inquiry forms, staging servers, and live chat widgets.

When we act as an independent software consultancy developing applications for clients, Axioree operates primarily as a Data Controller regarding our direct business contacts and website visitors, and as a Data Processor when handling client-supplied test databases or credentials strictly for development, QA testing, and deployment purposes.

2. Information We Collect

Depending on how you interact with Axioree, we collect information in three principal categories:

A. Information You Provide Voluntarily

  • Contact Inquiries: Full name, corporate email address, telephone/WhatsApp number, company name, and job title submitted via our contact forms or consultation schedulers.
  • Project Scoping Details: Technical briefs, budget estimations, functional specifications, feature wishlists, brand guidelines, and design references.
  • Client Collaboration Credentials: Git repository invites (GitHub, GitLab), cloud hosting credentials (AWS, Vercel, DigitalOcean), DNS management access, and third-party API keys provided under NDA to facilitate development.
  • Billing & Tax Data: Legal entity name, registered business address, tax identification or VAT numbers, and accounts payable contact details.

B. Automatically Collected Technical Telemetry

  • Device & Network Identifiers: IP addresses (anonymized where feasible), browser type and version, language settings, operating system, and hardware platform.
  • Usage & Interaction Telemetry: Pages visited, referring URLs, time spent per page, click patterns, scroll depth, and Core Web Vitals telemetry collected via Vercel Web Vitals to optimize load speeds.
  • Spam Prevention & Security Logs: Request timestamps, user-agent strings, and bot verification tokens evaluated through Google reCAPTCHA (react-google-recaptcha) to protect our inquiry forms from malicious automated traffic.

C. Payment & Transaction Information

Axioree does never collect, store, or process raw credit card numbers, CVVs, or bank account login credentials on our servers. All digital payments are processed directly by certified third-party payment gateways:

  • Stripe: PCI-DSS Level 1 certified processing for international credit/debit cards and digital wallets.
  • SSLCommerz: Bangladesh Bank-authorized payment gateway for regional cards, internet banking, and local transfers.
  • bKash: Licensed Mobile Financial Services (MFS) provider in Bangladesh.

We retain only non-sensitive transaction records (such as transaction IDs, invoice numbers, currency, timestamps, and payment statuses) for accounting and tax compliance.

4. How We Use Your Information

We utilize the collected information strictly for legitimate commercial and technical purposes:

  • Architecting, developing, testing, and deploying custom Next.js web applications, SaaS platforms, and enterprise solutions.
  • Executing digital marketing retainers, creative graphic design deliveries, and social media scheduling.
  • Conducting authorized cybersecurity vulnerability assessments and web performance audits.
  • Providing 24/7 technical support, bug remediation under our 30-day warranty, and proactive infrastructure monitoring.
  • Communicating project sprint updates, milestone reviews, and scheduling discovery calls.
  • Generating formal Statements of Work, Change Orders, and billing statements.
  • Enhancing website security, preventing malicious automated spam, and diagnosing edge latency issues.

5. Cookies & Local Storage Technologies

Our website uses cookies, local browser storage, and related web telemetry to deliver a secure, fast, and personalized browsing experience:

Strictly Necessary & Preference Cookies

These files remember your display theme preferences (handled via next-themes for light/dark mode) and UI color presets (ColorPresetProvider). They do not track your activity across third-party websites.

Performance & Web Vitals Telemetry

We use Vercel Analytics and Google Analytics to monitor anonymous Core Web Vitals metrics (LCP, INP, CLS) and page load speeds, helping our developers keep our site running at 95+ PageSpeed performance without harvesting personally identifiable tracking records.

Functional & Communication Cookies

When you interact with our Tawk.to live chat widget or submit forms protected by Google reCAPTCHA, session identifiers are deployed to maintain continuous chat threads and verify human interaction.

You can configure your browser to reject all or certain cookies. Please note that disabling cookies may affect the visual persistence of dark mode and interactive chat features.

6. Client Project Data, Code Repositories & Confidentiality

Software development requires exchanging sensitive assets. Axioree adheres to strict engineering data hygiene standards:

  • NDA Protection: All proprietary code, database schema, business logic, and product roadmaps shared with Axioree are held under strict non-disclosure obligations.
  • Least Privilege Access: Access to client staging repositories, server keys, and database credentials is restricted exclusively to senior engineers assigned to your project.
  • Sanitized Test Data: We advise clients never to provide live production customer databases for staging environments. We utilize synthetic mock data or anonymized datasets during QA testing.
  • Credential Revocation: Following final deployment and handover, Axioree securely deletes temporary developer environment variables and requests clients to cycle shared API keys and server passwords.

7. Subprocessors & Third-Party Service Providers

To provide continuous high-availability agency operations, we partner with vetted third-party service providers and subprocessors:

  • Hosting & Edge Delivery: Vercel Inc. (Global CDN, Serverless compute, Edge Middleware, Analytics).
  • Payment Processors: Stripe Inc. (USA/Global), SSLCommerz (Bangladesh), bKash Limited (Bangladesh).
  • Security & Bot Defense: Google LLC (reCAPTCHA, Google Fonts, Google Workspace, Google Analytics).
  • Transactional Email: Nodemailer integration with authenticated SMTP infrastructure.
  • Customer Support: Tawk.to Inc. (Live chat widget) and WhatsApp Business / Meta Platforms Inc.
  • Code Repositories: GitHub Inc. / GitLab Inc. (Encrypted source code version control).

All subprocessors are evaluated for strict data protection compliance, security practices, and contractual confidentiality commitments.

8. International Cross-Border Data Transfers

Axioree is based in Dhaka, Bangladesh, while serving clients throughout North America, Europe, the United Kingdom, and the Asia-Pacific region. Operating globally means your information may be transferred to and processed on secure cloud servers located outside your home country.

When transferring personal data originating in the European Economic Area (EEA) or UK, we ensure adequate data protection safeguards are implemented, including Standard Contractual Clauses (SCCs), robust end-to-end encryption in transit (TLS 1.3), and adherence to equivalent data security standards.

9. Data Retention & Archival Policies

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected:

  • General Inquiries & Consultations: Retained for twenty-four (24) months to facilitate follow-up communications, after which inactive inquiries are securely archived or purged.
  • Active Client Contracts & Code History: Retained throughout the duration of our engagement and for up to thirty-six (36) months post-completion to support code warranty, version rollbacks, and maintenance retainers.
  • Accounting & Tax Records: Retained for five (5) to seven (7) years to comply with statutory accounting, VAT, and commercial audit mandates.
  • Server Telemetry & Access Logs: Rotated and automatically purged every thirty (30) to ninety (90) days.

10. Your Privacy Rights & Choices

Regardless of your geographical location, Axioree extends comprehensive data privacy rights to all visitors and clients:

Under the GDPR (EU/EEA & UK Residents):

  • Right of Access: Request a copy of the personal data we hold about you.
  • Right to Rectification: Request correction of inaccurate or incomplete personal records.
  • Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data where no overriding statutory or contractual basis requires retention.
  • Right to Restriction: Request limitation of data processing under certain contested circumstances.
  • Right to Data Portability: Receive your personal data in a structured, commonly used, and machine-readable format.
  • Right to Object: Object at any time to data processing carried out under our legitimate business interests.

Under the CCPA & CPRA (California Residents):

  • Right to Know: Know what categories of personal information we have collected, the sources, and the business purposes.
  • Right to Delete: Request deletion of personal information collected directly from you.
  • Right to Non-Discrimination: We will never deny services, charge different prices, or alter service quality for exercising your CCPA rights.
  • Notice on Selling/Sharing: Axioree does not sell or share personal information for monetary or other valuable consideration.

To exercise any of these rights, simply email our Privacy Officer at privacy@axioree.com or info@axioree.com. We will verify your identity and respond within thirty (30) calendar days.

11. Technical & Organizational Security Measures

As a technology company specializing in custom software and cybersecurity assessments, we implement defense-in-depth security across our entire infrastructure:

  • Encryption in Transit: Strict HTTPS with modern TLS 1.3 encryption across all domains, subdomains, and APIs.
  • Zero-Trust Developer Protocols: Mandatory Multi-Factor Authentication (MFA / 2FA) on all code repositories, cloud consoles, domain registrars, and communication accounts.
  • Automated Vulnerability Scans: Continuous dependency scanning, Dependabot alerts, and linting checks to prevent known Common Vulnerabilities and Exposures (CVEs).
  • Serverless Architecture: Static asset distribution via edge CDN nodes, reducing attack surfaces and eliminating persistent server vulnerabilities.

12. Children’s Privacy

Axioree’s website, engineering tools, and digital agency services are directed strictly to commercial businesses, adult founders, and professionals. We do not knowingly solicit or collect personal information from individuals under sixteen (16) years of age. If we learn that personal data of a minor has been collected without parental consent, we will promptly delete it.

13. Modifications to This Privacy Policy

We may periodically revise this Privacy Policy to reflect evolving technical capabilities, newly introduced features, or statutory regulatory updates. Any modifications will be posted directly to this page with an updated “Last Updated” timestamp. Continued engagement with our services following the publication of revised terms constitutes your acceptance.

14. Contact Us & Data Protection Officer

If you have questions, privacy concerns, or wish to exercise your data subject rights, please reach out to our privacy management team:

Phone & WhatsApp

Operating Hours

10:00am – 6:00pm (GMT+6), Saturday – Thursday

Registered Office

Dhaka, Bangladesh (Serving clients globally)