Privacy Policy
Last updated: 2026-10-20 · Controller: Axiom-Trace · Contact: privacy@axiom-trace.eu
1. What we collect
1.1 Browsing data (access logs)
Our web server records every request in JSON access logs: IP address, URL, timestamp, User-Agent, response status and size. This is required to operate the service securely (abuse detection, troubleshooting, availability monitoring).
Legal basis: legitimate interest (art. 6.1.f GDPR) — infrastructure security and operation. Retention: 90 days, then deleted or anonymized.
1.2 Waitlist and contact forms
If you join the waitlist or write to us, we collect the data you submit: name, email address, company name (optional). Used only to contact you about the product — never sold, never shared for marketing.
Legal basis: your request / pre-contractual steps (art. 6.1.b GDPR). Retention: until the launch list is exhausted or you ask for deletion.
1.3 Account registration and billing
Creating a tenant requires an email address and account credentials. Payments are processed by Stripe: card details go directly to Stripe and never transit our systems. We receive only the billing result (plan, invoice status).
Legal basis: contract performance (art. 6.1.b) and legal obligations for invoicing (art. 6.1.c GDPR).
1.4 Service data (for tenants)
For customer tenants, the platform processes operational data (machine events, audit records, operator identities) as data processor under art. 28 GDPR. The customer remains the controller of its production data. A Data Processing Agreement is available on request.
2. Cookies and tracking
This website uses no profiling cookies and no third-party analytics. The service subdomains (app., cp.) use only technical session cookies required for authentication. Server-side access logs (§1.1) are the only traffic record.
3. Recipients and processors
| Processor | Role | Location |
|---|---|---|
| Aruba Cloud | Infrastructure hosting | EU (Italy) |
| Stripe | Payment processing | US — SCCs / EU-US DPF |
No other third party receives personal data. Service sub-processors are listed in the DPA.
4. Your rights
Under arts. 15–22 GDPR you may request: access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Write to privacy@axiom-trace.eu — we answer within 30 days. You may also lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it).
5. Security
Access is limited to the operations team; logs and service data are stored on EU infrastructure with TLS in transit. Node-side cryptographic signing and hash-chained audit trails are part of the product's integrity model — see the compliance note for the verifiable mechanisms.
6. Automated decisions
None. No profiling, no automated decision-making within the meaning of art. 22 GDPR.