Privacy
Aximary records product usage events, chat state, artifacts, and server logs needed to operate the small-business agent team. Do not submit sensitive credentials, payment data, health data, legal records, or regulated customer records until a signed business agreement and production security controls are in place.
Account and contact details you provide, phone numbers you submit or use to message Aximary, operator messages, iMessage, SMS, and WhatsApp message content, Realtime voice audio and transcripts when you choose to use the microphone, generated outputs, usage events, browser metadata, and diagnostic logs.
Aximary requires an account. If you use Sign in with Apple or Google, we receive and retain the provider account identifier, the name and email address you authorize that provider to share, and an authorization record needed to maintain or revoke the connection. Aximary does not retain a Google profile photo. We support Apple's private email relay. If you use email and password, Aximary stores a one-way password hash and email-verification records, not your readable password. We use these records to keep workspaces separate and restore only the matching account after logout.
To provide the operator workspace, store outputs, improve reliability, detect abuse, support billing, and respond to business inquiries.
When a production model provider is connected, prompts may be sent to that provider under its data-processing terms and configured retention settings. If you start Realtime voice, microphone audio is streamed to the configured provider and voice transcripts or commands may be retained with the corresponding chat and activity records.
Aximary uses contracted service providers only to operate functions such as cloud hosting, identity, email delivery, model inference, browser sessions, monitoring, and messaging. They process information on Aximary's instructions and are required to apply confidentiality, security, and data-protection safeguards. If information is processed in another country, Aximary requires the same or equivalent protection through applicable contractual and legal transfer safeguards. Aximary does not sell personal information.
Google Ads and Meta Ads data should only be connected through authorized API credentials. Customer-list uploads, pixels, and retargeting audiences require owner approval.
When you start a browser task, Aximary sends the requested navigation to Browserbase and processes session identifiers, visited URLs, live-view information, run status, and diagnostic metadata needed to operate and display the run. Aximary disables Browserbase session recording and session logging for these live runs; the live view remains available while the session is active. Do not enter a connected-service credential into an Aximary prompt. Sign in to Gmail, LinkedIn, or another service only through that service's own authorized page, and disconnect it when access is no longer needed.
If you separately authorize Gmail read-only access, Aximary receives and processes the identifiers, sender, subject, date, and short snippet for up to the latest five inbox messages requested by the feature. Aximary also retains the OAuth scopes and encrypted or otherwise protected access and refresh credentials needed to keep that authorized connection working. Disconnecting or deleting the account removes the stored connection as described below.
Aximary uses Twilio to send and receive SMS at +1 646-466-7948. Message frequency varies. Reply STOP to opt out, START to resubscribe, or HELP for help. See SMS consent.
When you use a private iMessage route, Apple delivers the conversation to an Aximary relay Mac. Aximary uses the route code and a one-way fingerprint of the sender address to connect messages to the correct account and assistant. Rotating the route revokes its existing sender connections. Message content may be sent to the configured model provider to generate a reply.
Logging out removes the active device session but retains the account and workspace so the same identity can return. Account profiles, chats, generated outputs, and saved workspace records are retained while the account remains active and are removed from active systems when account deletion completes; encrypted disaster-recovery copies, if any, expire within 30 days. Browser-run objectives, visited-URL metadata, run status, and saved monitoring records follow the same account lifetime, while live-view capabilities are short-lived and kept only in memory. Routine application and diagnostic logs are retained for up to 30 days. The first-party local_ai_vid visitor cookie, when used on the public website, expires after 12 months; authenticated iOS app requests do not create it. Security, abuse-prevention, transaction, or legal records are retained longer only when reasonably required by law, fraud prevention, dispute resolution, or enforcement, then deleted or de-identified.
The in-app Delete Account control permanently removes the Aximary account, provider mapping, active sessions, and stored workspace data covered by the deletion flow. When an identity provider requires it, Aximary also requests revocation of the provider authorization before erasure.
For privacy, access, or deletion questions, email support@aximary.com.