Privacy Policy

For Customer Data (the documents and records you upload), AXIOMIC LTD acts as a data processor. For account, billing, and website data, it acts as a controller.

• Account data: name, email, role, authentication metadata
• Customer Data: invoices, receipts, delivery notes, bank transactions, vendor records, employee data, tax IDs, and related documents — including photographs of documents captured with the mobile app
• Technical data: logs, device data, IP address, security events
• AI inputs and outputs: prompts and extraction results tied to Customer Data

• Providing the Service (performance of a contract)
• Security, fraud prevention, and service improvement (legitimate interests)
• Legal obligations (tax and accounting record retention)

Documents you upload or photograph are processed by artificial-intelligence models to read them and extract structured data (supplier, line items, totals, VAT). This processing uses Google Vertex AI (Gemini models), configured to EU-region endpoints. Other AI providers used by the platform (OpenAI, Anthropic) are likewise configured to EU endpoints only.

Extraction results are validated and, where confidence is low, flagged for human review. Automated processing does not produce legal effects for you without human review. Your documents are not used to train public AI models.

We share data only with vetted subprocessors for hosting, AI inference, email delivery, and payment processing, under data-processing agreements.

Data is stored and processed in the EU. If a transfer outside the EU or EEA were ever required, we would rely on EU Standard Contractual Clauses and notify customers.

• Accounting records (including scanned documents): 6 years, as required by applicable tax law
• Application logs: 12 months
• AI prompt logs: 30 days

Backups follow the same retention periods and are securely deleted at end of life.

You can delete your account at any time from the mobile app (Settings → Delete account) or by contacting support@axiomic.com.cy. Deletion removes your personal identifiers (email, name, credentials, external sign-in identities) and revokes all access immediately. Financial records processed for a business remain retained for the legal retention period above; they no longer identify you personally.

You have the rights of access, rectification, erasure, restriction, portability, and objection under the GDPR. You may lodge a complaint with your local supervisory authority.

We apply technical and organizational measures including encryption in transit and at rest, tenant isolation, and audit logging, as described in the Security Policy.

For privacy requests, contact support@axiomic.com.cy.