Privacy Policy
What Axonplane collects, why, and what you can ask us to do about it.
In effect since: 15 September 2026 · Last updated: 7 October 2026
Axonplane takes two different roles with personal data, and which one applies changes what you should do about it.
- Your account - your name, email address and how you sign in. Axonplane decides how these are used, so Axonplane is the controller.
- What your workspace holds - tasks, chat messages, employee records, customer contacts, support tickets, files. The organisation that runs the workspace decides what goes in and why. Axonplane is the processor, acting on its instructions. If you want that data changed or removed, ask the workspace's owners or admins; we act on their instruction, not directly on yours.
Who we are
Axonplane is operated by Daniyal Hussain Siddiqui, a sole proprietor trading as Axonplane, based in Karachi, Pakistan.
Privacy questions and requests: [email protected].
We are not established in the EU or the UK. We are appointing a representative in each under Article 27 of the EU and UK GDPR, and will name them here once they are appointed. Until then, write to us directly at the address above.
What we collect
Your account
Your name, email address and password (stored hashed, never in readable form), a profile picture if you add one, your two-factor settings if you turn them on, and when you accepted our Terms. If you sign in with Google or GitHub we receive your name and email address from them, never your password. If your workspace signs you in through its own identity provider (SAML), we receive the name and email address it sends.
Your devices
If you allow notifications, a push token for the Axonplane phone app, or a push subscription for your browser, so notifications can reach you while the app is closed.
Records the service keeps
- Security and audit records of actions such as signing in, changing a role or removing a member, each with an IP address and browser identifier.
- Product analytics - which features are used, recorded by Axonplane in its own database against your workspace. No outside analytics service is used.
- AI connection records - see AI apps you connect below.
What your workspace puts in
This is the widest category, and some of it is sensitive:
| Kind | Examples |
|---|---|
| Work | Projects, tasks, comments, time logs, files |
| Chat | Messages, shared files and voice notes in channels and direct messages |
| People | Employee records, time off, performance reviews, onboarding |
| Pay and benefits | Payroll runs, payslips, benefit enrolments |
| Documents | Contracts, certifications, identity documents |
| Recruitment | Candidates, applications, interview notes |
| Customers | CRM contacts, deals, support tickets and their correspondence |
Payroll, identity documents and benefit records are sensitive. They are held because an administrator of that workspace chose to put them there.
Calls
Voice and video calls go directly between the two devices where the network allows it, encrypted end to end. When it does not, they pass through a relay server that forwards the encrypted stream and cannot read it. Calls are not recorded, and nothing said or shown in one is stored.
Why we use it
| Purpose | Legal basis under UK and EU GDPR |
|---|---|
| Running your account and the service you or your organisation signed up for | Performance of a contract |
| Keeping the service secure: audit records, rate limits, abuse reports | Our legitimate interest in protecting the service and its users |
| Understanding which features are used, and fixing errors | Our legitimate interest in improving the service |
| Billing records | Legal obligation |
| Push notifications on your phone or browser | Your consent, given in the device's own prompt and withdrawn in its settings |
| Data in your workspace | The workspace's instructions, as its processor |
We do not sell personal data, do not share it for advertising, and do not use workspace data to train AI models.
Who else sees it
These companies process data for us because the service needs them to work:
| Who | What for | What reaches them |
|---|---|---|
| Hetzner Online, Helsinki | Servers, database and cache | Everything the service stores, apart from uploaded files |
| Cloudflare | Network delivery and protection | All traffic to and from Axonplane passes through it, encrypted in transit |
| Amazon Web Services | File storage (S3) | Uploaded files, chat attachments and voice notes |
| Polar | Subscriptions and payment, as merchant of record | Billing email, plan and subscription state. Card details go to their processor and never touch Axonplane |
| Resend | Sending email | Recipient address and message contents |
| Sentry | Error diagnostics | Technical error data, which can incidentally include a user identifier |
| Google (Firebase Cloud Messaging) | Notifications on the phone app | The device's push token and the notification's text |
| Your browser's push service (Google, Mozilla or Apple) | Notifications in a browser | An encrypted notification it cannot read |
| Anthropic | The in-app AI assistant, only if a workspace uses it | The text submitted to the assistant |
| Google, GitHub | Sign-in, only if you use it | Your name and email address, from them to us |
Services a workspace connects
A workspace's owners and admins can connect other services, and individual people can connect their own calendars. These are chosen by the workspace or the person, not by Axonplane, and what each provider does with the data is governed by the workspace's or the person's own terms with it:
- Slack and Microsoft Teams - the notifications and records a workspace sets them up to receive, and anything someone shares to a channel.
- Google Calendar and Outlook - your assigned tasks that have a due date, as entries in your calendar, and events you create from Axonplane.
- Jira - when a workspace imports from it, Axonplane reads the projects and issues it asks for, using the access the workspace provides.
- The assistant's outside tools (Enterprise) - servers a workspace connects so the in-app assistant can look things up in its own systems. They receive the requests the assistant makes on behalf of whoever is chatting.
- AI apps - see the next section.
Data from your Google account
When you connect Google Calendar, Google asks you to let Axonplane see your Google account's email address and view and edit events on your calendars. Axonplane uses that access only to:
- show which account is connected,
- put your assigned tasks that have a due date on your primary calendar as all-day entries, and keep them in step with the task,
- show your upcoming events in Axonplane, and create an event when you ask it to.
Events read from your calendar are shown to you and not stored. Axonplane stores the connection's access tokens, encrypted, and which calendar entry belongs to which task. No person at Axonplane reads your calendar, and your Google data is never sold, used for advertising or used to train AI models. It is not sent to Axonplane's in-app assistant or to any AI app you connect.
Disconnecting under Settings → Integrations takes Axonplane's task entries off your calendar, revokes the access and deletes the tokens. You can also revoke it at any time from your Google account's security settings.
Axonplane's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
AI apps you connect
On the Pro and Enterprise plans, people in a workspace can connect an AI app of their own - Claude, ChatGPT, Cursor, VS Code, or another app that supports the Model Context Protocol - so that it can read and update the workspace for them.
When someone does, workspace data goes to that app's provider - Anthropic for Claude, OpenAI for ChatGPT, and so on - each time the app reads something on their behalf. Axonplane sends it because the person asked it to, under their workspace's rules. The provider is not one of Axonplane's processors: the workspace chose it, and what it does with the data is governed by the workspace's own terms with that provider, not by this policy.
What can reach an app is limited three ways:
- The person connecting it chooses which areas it may reach - tasks, projects, members, notifications, the CRM, the support desk, chat, and on Enterprise a narrow set of HR records - and it can never do more than that person could do themselves.
- The workspace's owners and admins can switch AI apps off, keep them to owners and admins, or limit any area to read-only or nothing. HR is off unless an Enterprise workspace turns it on, and never includes salary, phone numbers or addresses.
- Anyone can disconnect their own app, and owners and admins anyone's, under Settings → Connect AI. It stops working at once.
Axonplane keeps a record of each connection - which app, who connected it, what it may reach and when it was last used - and an audit entry for every request an app makes: the tool it used, the records it touched, how it ended and the IP address it came from. The entry does not hold the content that was read or written. A connection's record is deleted 90 days after the connection ends.
Reports and blocks
You can report a message or a person in chat, and block someone. A report goes to your workspace's owners and admins with a copy of the reported message, and never names who made it. A block is between you and the other person within that workspace, and they are not told.
Where your data is
The servers, the database and the cache are in Helsinki, Finland, inside the EU. Uploaded files are held in Amazon S3 in Mumbai, India. India is not the subject of a UK or EU adequacy decision either, and Amazon Web Services covers that transfer with the Standard Contractual Clauses in its data processing terms. Cloudflare carries traffic through whichever of its data centres is nearest to you.
Axonplane is run from Pakistan, and we administer and support the service from there. Pakistan is not the subject of a UK or EU adequacy decision, so our access to your data from there is a restricted transfer. We are putting the EU Standard Contractual Clauses and the UK International Data Transfer Addendum in place to cover it, and will make them available to customers as part of a data processing addendum.
How long it is kept
Your account is kept while it exists. You can delete it yourself under Settings → Profile, on the web or in the app. Deletion takes effect 30 days later, and signing in before then cancels it. Your name, email address, password, profile picture, sign-in links, keys and devices are then removed. What you added to a workspace - tasks, comments, messages - stays in that workspace under the name "Deleted User", because it belongs to the workspace.
A workspace is kept while it exists. To close one, its owner writes to [email protected] from the owner's account address, and the workspace and everything in it is deleted within 30 days.
Security, audit and analytics records are kept for as long as the workspace they belong to.
AI connection records are deleted 90 days after the connection ends.
Keeping it safe
Passwords are hashed. Traffic is encrypted in transit. Calls are encrypted end to end. Stored credentials for outside services are encrypted. Access is controlled by role, and every record is confined to its own workspace at the database level. Two-factor authentication is available.
No system is perfect, and saying otherwise in a document like this would be a promise nobody can keep.
What you can ask for
If the UK or EU GDPR applies to you, you have the right to ask for a copy of your data, to correct it, to delete it, to take it elsewhere, to restrict or object to some uses, and to withdraw a consent you gave. You can also complain to a supervisory authority - the ICO in the UK, or your national authority in the EU.
You can download your account's data and delete your account yourself under Settings → Profile. For anything else about your account, write to [email protected]. For anything inside a workspace, ask whoever runs it - we will help them, but the instruction has to come from them.
We answer within one month. If a request is complex we may extend that by up to two further months, and will tell you within the first month if we do.
Children
Axonplane is a service for organisations and is not meant for anyone under 16.
Cookies and browser storage
Axonplane stores only what it needs to work:
| What | Kind | Why |
|---|---|---|
access_token, refresh_token | Cookies, httpOnly | Keep you signed in |
locale | Cookie | Remembers your language |
saas-auth | Session storage, cleared when the tab closes | Your name and workspace list, so pages draw without waiting |
theme, onboarding_dismissed | Local storage | Light or dark mode, and that you closed the getting-started guide |
The phone app keeps its sign-in and the same preferences on the device.
There are no advertising cookies and no third-party analytics. Everything above is either strictly necessary or remembers a choice you made, so there is no consent banner. Product analytics is recorded on our servers and stores nothing on your device.
Changes
Material changes are announced in the product and by email at least 30 days before they take effect.