Legal
Privacy Policy
Axi is an executive assistant that reads your mail so it can triage it, draft replies and schedule your time. That only works if it can see your inbox, so this page sets out exactly what it accesses, what it keeps, what it never keeps, and who else sees it.
Who we are
Axi is operated by AXEED L.L.C. For any privacy question, or to ask us to delete your data, contact privacy@axdaxi.com.
What Axi accesses
Axi connects to Google only after you grant access, and asks for these permissions. You can review or revoke them at any time in your Google Account permissions.
- Read your Gmail messages — to sort your inbox by what matters and summarise what needs you.
- Modify Gmail messages — to archive, star, and mark as read or unread when you ask.
- Create and send mail — to write drafts and, only on your instruction, send them.
- Read your calendar — to show what your day looks like.
- Create calendar events — to book time when you confirm it.
What Axi stores — and what it does not
This distinction is the core of how Axi is built, so it is worth being exact rather than reassuring.
- Your received email is not stored. Message subjects, bodies and senders are fetched, used to work out priority and to draft a reply, and then discarded. What persists about a message is derived only: a priority score, an importance and sensitivity label, a status, and the reasons behind them — never its text.
- Drafts Axi writes for you are stored, encrypted, so a draft survives until you send or discard it.
- Your conversation with Axi is stored, encrypted, so it can remember what you told it. Days are sealed and kept as an archive you can read back.
- Things you tell Axi to remember — your priorities, contacts, rules, writing style — are stored so it behaves consistently.
- Connection credentials — your Google token and any AI provider key you supply — are stored encrypted.
Encryption, stated honestly
Everything sensitive is encrypted with AES-256-GCM before it is written, and our database holds only ciphertext. It is not end-to-end encrypted: the encryption key is held by our server, not by your device, so we are technically capable of decrypting what we store. We are telling you this rather than describing it as end-to-end, which it is not. Device-held keys are planned.
Data is separated per account at the database level using row-level security, so one user's rows cannot be read by another user's session. Administrators can manage accounts — approve, reject, change roles, remove — and that is all they can do: an administrator cannot read another user's mail, chat, archive, memory, drafts or keys. That boundary is enforced by the database, not by convention.
AI processing
To triage and draft, Axi sends the relevant message content to a large-language-model provider — Anthropic, OpenAI, Google or OpenRouter, depending on what you choose. This happens with your own API key, under your own account with that provider, and their terms govern that processing. Content is sent to produce your result and is not used by us to train any model.
Google user data
Axi's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Google user data is used only to provide and improve the features you see in Axi; it is never sold, never used for advertising, and never used to train generalised AI or machine-learning models. No human reads your Google data except where you explicitly ask us to for support, where it is necessary for security, or where the law requires it.
Who else processes your data
- Supabase — database and authentication.
- Vercel — application hosting.
- Your chosen AI provider — as described above.
We do not sell your data, and we do not share it with advertisers.
Keeping and deleting your data
- Disconnect a mailbox and the stored credential for that account is removed, and Axi stops syncing it.
- Delete your account and everything belonging to it is deleted with it — signals, drafts, archive, memory, rules and credentials — by database cascade, not by a cleanup job that might not run.
- You can also revoke Axi's access directly from your Google Account at any time.
To request deletion, email privacy@axdaxi.com.
Access is by approval
Anyone can create an account, but creating one grants no access to anything. Every new account starts as pending: an administrator must approve it before it can reach the app, and until then it can see nothing but a waiting screen. The approval, not the signup, is the door.
Changes
If this policy changes materially we will update the date above and, where the change affects how your data is handled, tell you in the app.