Privacy Policy

Section 1 — Introduction

This Privacy Policy describes how AXYION LLC, an Oklahoma limited liability company ("Axyion," "we," "us," or "our"), collects, uses, and shares information when you visit axyion.agency, use our client portal at app.axyion.agency, or engage our services. Axyion is a web design, AI automation, and digital marketing agency based in Broken Arrow and Tulsa, Oklahoma, USA. Our services are intended for businesses and the people who operate them; they are not directed to children. By using our website, portal, or services, you agree to the practices described in this policy.

Section 2 — Our Role (Controller vs. Service Provider)

For personal information about our clients and prospective clients (name, business contact details, billing information, portal activity), Axyion acts as a data controller. For data we process on behalf of clients — including website-visitor analytics collected on client websites, advertising and email data accessed through connected accounts, and information that a client's own customers and prospects submit to that client through tools we provide (such as lead, work-order, and estimate forms) — Axyion acts as a service provider/processor; our client is the controller and we process that data only to provide our services under our agreement with the client. Visitors to and customers of our clients should consult that client's own privacy policy.

Section 3 — Information We Collect

We collect the following categories of information:

• Information you provide directly: your name, email address, phone number, business name, and project details when you submit a contact form, get-started form, or otherwise communicate with us. Our contact and get-started forms are submitted directly to our own client portal at app.axyion.agency, where the information is stored in our database (see the providers listed in Section 13). With each submission we also record your browser's user-agent string and a one-way, salted hash of your IP address, which we use to prevent spam and abuse. If you RSVP to an Axyion event, we collect the name, email address, business name, and any note you provide, with the same anti-abuse details.
• Advertising campaign details: if you reach axyion.agency through one of our ads or another link we have tagged, the link can carry campaign parameters (such as utm_source and utm_campaign) and a click identifier assigned by the advertising platform (Google's gclid, Meta's fbclid, or TikTok's ttclid). We keep the ones your visit arrived with in your browser's session storage for the length of that visit. If you send us a get-started form during that visit, we submit them with your form, store them with your enquiry in our client portal, and include them in the notification our team receives. We also send the campaign source and campaign name to Google Analytics when you send the form, with whether a click identifier was present but not the identifier itself. We use this information to understand which of our ads lead to enquiries. We do not use it to build a profile of you or to track you on other websites.
• Electronic signature data: when you sign a Statement of Work or other document in the portal, we record your typed name, the date and time of signing, your account identifier, your IP address and browser user-agent string at the time of signing, the consent statements you accepted, and a cryptographic fingerprint (hash) of the document, for legal verification. When you first accept our Terms of Service in the portal, we record the date, time, and IP address of that acceptance and the version of the documents you accepted. If those documents later change, the portal shows you a notice, and we record the same details when you acknowledge it.
• Uploaded files: project-related files you upload to the portal.
• Portal messages: messages you send through the portal's support channel to Axyion, and messages exchanged through the portal's internal team-chat channel among your own invited team members.
• Billing information: billing details and payment method information processed through our third-party payment processor. We do not collect or store full payment card numbers.
• Website analytics: on axyion.agency and on client websites we manage, we automatically collect the page path visited, the referrer (the referring URL), device type, browser type, operating system, and an approximate location (city, region, and country) derived from IP address by our hosting provider. To count unique visitors, each page view carries a visitor identifier that is either generated by our hosting provider's analytics service or is a one-way, salted hash of the IP address and browser details that changes every day. The IP address itself is not stored in our analytics records. This data is collected through our own cookieless beacon and through a cookieless third-party analytics service. Separately, axyion.agency itself (not client websites and not the client portal) uses Google Analytics, which does set cookies; see Sections 6 and 15.
• Website audit tool: if you use the free website audit on axyion.agency, the website address you enter is sent to a third-party website-testing service to run the test.
• OAuth tokens and connected-account data: when you connect a third-party account (Gmail, Microsoft Outlook, Google Ads, Meta/Facebook Ads, or TikTok Ads) via OAuth, we store the encrypted access and/or refresh tokens for that connection, record the address or name of the connected account, and access the data described in Sections 8 through 12.
• Gmail and Microsoft Outlook email data: where you connect a Gmail or Microsoft Outlook account, we access email content and related data through Google's or Microsoft's APIs solely to provide the email features you enable.
• Advertising-account data: for ad accounts you connect, the list of ad accounts you authorize (and, for Meta, the Facebook Pages available to them), campaign names, status, budgets, and performance data such as spend, impressions, clicks, and conversions, and, where you have engaged us to manage campaigns, the campaign, audience-targeting, and creative settings we create or change on your behalf, as described in Section 10.
• Team-member data: the names, email addresses, assigned roles, and optional nicknames and job titles of team members an Account Owner invites to the portal, and when each member first signed in and was last active.
• Portal preferences and activity: display and email-notification preferences, an optional email signature and logo, ideas or feedback you submit, the notifications we send you, and a log of account activity such as messages sent, files uploaded, and documents signed.
• Shared credentials: if you choose to share a login for a third-party service with us through the portal's credentials feature, we store its label, website address, and the email address of the person who submitted it, and we store the username, password, and any notes encrypted using AES-256. Our staff view a shared credential only to perform the work you asked for, and the stored secret can be erased at any time on request.
• Email delivery records: a log of the emails our systems send (recipient, subject, delivery status and, for some message types, the content of the email), kept so that we can confirm delivery and re-send a message when needed.
• Information about our clients' own customers, processed on the client's behalf (see Section 2): leads and enquiries submitted through forms on a client's website (such as name, email address, phone number, and message), with the browser user-agent string and a one-way, salted hash of the IP address for spam and abuse prevention; work-order and service requests, which can include a street address, vehicle details, and photos; contact lists a client imports; and estimates a client sends through the portal, including a record of when the estimate link was opened (with IP address and user-agent string) and, where the customer signs electronically, the customer's typed name, email address, IP address, user-agent string, the consent statements accepted, and a copy of the document signed.
• Referral-program data: information needed to administer our referral program, including the identities of referring and referred clients and the resulting discounts.
• Referred-business data: when one of our clients refers your business to us, that client gives us your name, business name, email address, and website address, and may add a short note addressed to you, before you have contacted us yourself. We use this information to send you a referral invitation by email, to prepare the referral page that invitation links to (which shows the information back to you), and to credit the client who referred you. We tell that client when you open the referral page and when you send us your details, and we notify our own team of the same. For each client who refers you, we send one invitation and at most one reminder; if that client later re-sends an invitation that has expired, no further reminder is sent. More than one client can refer the same business, so you may receive an invitation and a reminder for each of them. You can stop further email at any time using the unsubscribe link in any of these messages.

Under U.S. state privacy laws, the information above falls into the following categories: identifiers (such as name, email, phone, IP address, online visitor identifiers, advertising click identifiers, and account identifiers); commercial information (such as services purchased and billing records); internet or other electronic network activity information (such as analytics, page path, referrer, campaign parameters, device, browser, and operating system); and approximate geolocation information (city-level at most, derived from IP address; we do not collect precise geolocation). A login you choose to share through the credentials feature is account log-in information, which some state laws treat as sensitive; we use it only to perform the work you requested.

Section 4 — How We Use Your Information

We use the information we collect to: respond to your inquiries and provide requested services; deliver web design, development, automation, and digital marketing services; grant and manage access to the client portal and team-member permissions; process payments and manage billing and subscriptions; generate and store electronically signed legal documents including Statements of Work; operate the email and advertising integrations you choose to enable; provide support and operate portal messaging; administer our referral program; provide clients with analytics reporting on their website performance; improve our website and service offerings; protect the security and integrity of our services; and comply with applicable legal obligations.

Section 5 — Electronic Signatures and Legal Documents

When you sign a Statement of Work or other document through our client portal, we record your typed name as an electronic signature, the date and time of signing, your account identifier, your IP address and browser user-agent string at the time of signing, the consent statements you accepted, and a cryptographic fingerprint (hash) of the document. This information is retained as part of the legally executed document record for the period described in our retention schedule in Section 14.

Electronic signatures collected through our portal are legally binding under the Electronic Signatures in Global and National Commerce Act (ESIGN Act, 15 U.S.C. § 7001 et seq.) and the Uniform Electronic Transactions Act (UETA). Signed documents are stored securely and are available to both parties upon request.

Section 6 — Website Analytics

Our website analytics rely on two cookieless systems. The first is a custom beacon we operate, which sends the page path, the referrer (referring URL), device type, browser type, and operating system to our infrastructure. The second is a third-party, cookieless analytics service provided by our hosting provider, which collects page-view and visitor data. Neither system uses cookies or advertising identifiers or performs cross-site tracking. From the IP address we derive only an approximate location (city, region, and country) and, where our hosting provider's service does not supply a visitor identifier, a one-way, salted hash that changes daily and is used to count unique visitors; the IP address itself is not stored in our analytics records.

In addition, our own marketing website at axyion.agency uses Google Analytics 4, a service of Google LLC, to understand how visitors find and use the site and to measure enquiries. Google Analytics sets first-party cookies (such as _ga) and collects page views, interactions, device and browser information, and approximate location; Google processes this information as described in its Privacy Policy (see Section 21). We do not use Google Analytics on client websites or in the client portal. You can prevent it from recording your visits by blocking cookies in your browser or by installing Google's opt-out browser add-on (https://tools.google.com/dlpage/gaoptout).

For client websites we manage, our custom beacon may be deployed to provide clients with performance reporting on their own website traffic. In that case Axyion acts as a service provider to the client, who is the controller of that visitor data. In all cases we collect only the page-view, device, and approximate-location data described above, and we do not build individual user profiles from analytics data.

Section 7 — Portal Messaging and Team Chat

The portal includes a support channel for communicating with Axyion and an internal team-chat channel for communication among your own invited team members. You acknowledge and agree that Axyion personnel and systems may access, monitor, and review messages sent through both channels for purposes of providing support, ensuring security, investigating abuse or violations of our Terms, and complying with law. Do not use portal messaging to share information you do not wish Axyion to be able to access. Support messages are automatically deleted one year after they are sent; internal team-chat messages are automatically deleted 7 days after they are sent. Deletion runs on an hourly schedule. Where we email someone to tell them a new message has arrived, that email contains a short preview of the message; the email remains in the recipient's mailbox, and in our email delivery records, after the message itself has been deleted from the portal.

Section 8 — Google User Data and Limited Use

When you connect a Gmail account to the Axyion portal, you authorize us to access certain Google user data through Google's APIs, including the ability to read, compose, send, organize (for example, applying labels or changing read status), and display email messages associated with your connected account, solely to provide the email features you enable within the portal.

Axyion's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy).

Specifically:

• We access Google user data only to operate the email features you choose to use.
• We do NOT use Google user data, including the content of your emails, to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.
• We do NOT allow humans to read your email data, except (a) with your affirmative consent, (b) as necessary for security, (c) to comply with applicable law, or (d) where aggregated and anonymized.
• We do NOT sell Google user data and do not transfer it to third parties except as necessary to provide the features you enable, to comply with law, or in a merger or acquisition.
• We do NOT store the content of your mailbox on our servers; messages are read live through Google's APIs when the portal displays them, including the recent messages shown alongside a lead when you open that lead. We record only the address of the connected account and, when you send an email to a lead from the portal, the subject line and recipient of that email in the lead's activity history. Files you attach to an email you are composing are held temporarily and deleted once the email is sent, or within 48 hours if it is not.
• OAuth tokens are stored using AES-256 encryption. They are permanently deleted from our systems immediately when you disconnect the account, at which point we also ask Google to revoke the authorization, and when your Axyion account is deleted.

Section 9 — Microsoft Outlook Email Data

When you connect a Microsoft Outlook account to the Axyion portal, you authorize us to access your Outlook mail through the Microsoft Graph API (Mail.Read, Mail.Send, and Mail.ReadWrite, together with User.Read to identify the connected account and offline_access to keep the connection active) solely to provide the email features you enable within the portal. As with Gmail, we do not store the content of your mailbox on our servers; messages are read live through Microsoft's APIs when the portal displays them and are not used to train artificial-intelligence or machine-learning models. The same limited records described in Section 8 apply (the connected account's address, and the subject line and recipient of emails you send to a lead from the portal). OAuth tokens are stored using AES-256 encryption and are permanently deleted from our systems immediately when you disconnect the account and when your Axyion account is deleted; you can also remove Axyion's access at any time from your Microsoft account settings. Our use of Microsoft data complies with the Microsoft APIs Terms of Use and the Microsoft Privacy Statement.

Section 10 — Advertising Platform Data

Separately from the email integrations described in Sections 8 and 9, Axyion integrates with advertising APIs provided by Google (Google Ads), Meta (Facebook and Instagram Ads), and TikTok (TikTok Ads) to manage ad campaigns on behalf of clients who have explicitly authorized this access. Through these advertising integrations we access only the ad accounts the client authorizes (and, for Meta, the Facebook Pages available to those ad accounts), campaign names, status, budgets, and performance data such as spend, impressions, clicks, and conversions, and, where the client has engaged us to manage campaigns, the campaign, audience-targeting, and ad-creative settings we create or change on the client's behalf. We do so only for the client who authorized the connection, solely for the purpose of campaign management and reporting.

For these advertising platforms only, we do not access personal messages, organic posts, contact lists, or any data outside the scope of advertising management. (This limitation does not apply to the separate email integrations described in Sections 8 and 9, which by design access the email data you authorize.) We do not sell advertising platform data, and we do not use it for any purpose other than providing services to the client who authorized the connection. Tokens provided by these platforms are stored using AES-256 encryption and are permanently deleted from our systems immediately when the client disconnects the ad account and when the client's Axyion account is deleted. You can also remove Axyion's authorization from within each platform's own settings.

Section 11 — Requesting Deletion of Data Obtained Through Meta

If you connected a Meta (Facebook/Instagram) advertising account and wish to request deletion of data we obtained through Meta, email hello@axyion.agency with the subject "Meta Data Deletion Request." We will delete the associated Meta Platform Data and confirm within 30 days. Disconnecting your Meta ad account in the portal also immediately deletes the credentials we hold, which ends our access.

Section 12 — TikTok Platform Compliance

For the TikTok Ads integration, we comply with the TikTok Developer Terms of Service and the TikTok Marketing API policies. We access only advertiser-account, campaign, budget, and performance-report data for the client who authorized the connection. TikTok tokens are stored using AES-256 encryption and are permanently deleted from our systems immediately when the client disconnects the account and when the client's Axyion account is deleted.

Section 13 — Third-Party Service Providers and Subprocessors

To deliver our website and services, we share data with the following categories of third-party service providers, each of which processes data only to perform its specific function:

• Payment and billing processing — third-party payment processor — USA
• Database and encrypted file storage — third-party cloud infrastructure provider — USA
• Authentication and account management — third-party authentication provider — USA
• Website hosting, content delivery, and cookieless website analytics — third-party hosting and infrastructure provider — USA
• Email delivery (transactional and service emails, referral invitations, and client newsletters) — third-party email-delivery provider — USA
• Website analytics on axyion.agency — Google Analytics (Google LLC) — USA
• Website performance testing — third-party website-testing service, which receives only the address of the website being tested — USA
• Email account integrations — the email providers you choose to connect, as described in Sections 8–9 — USA
• Advertising account integrations — the advertising platforms you choose to connect, as described in Sections 10–12 — USA
• Fulfillment partners — certain subcontracted services such as content and SEO production — location varies, including outside the U.S.

All providers are bound by confidentiality and process data only to perform their function. We do not sell your personal information, and we do not use it for our own advertising; we manage advertising campaigns only on behalf of clients who authorize it, using their own connected accounts.

Section 14 — Data Retention

This is our canonical data retention schedule. Where our Terms of Service reference data retention, they refer to this schedule:

• Account and project records — duration of engagement plus up to 3 years
• Support-channel messages — auto-deleted one year after sending
• Internal team-chat messages — auto-deleted 7 days after sending
• Email delivery records, including message-notification previews — retained while the account exists and deleted when the account is deleted
• Client-uploaded files — auto-deleted 30 days after upload; any remaining files are deleted when the account is deleted
• Signed SOWs / executed agreements, with their signature records — at least 7 years after the engagement ends, including after the account itself has been deleted
• Analytics data — retained for the duration of the engagement, so a client can view its site's analytics from the start of tracking to today, and deleted when the account is deleted. Google Analytics data for axyion.agency is retained by Google for the period set in our Google Analytics account, which is no more than 14 months
• OAuth tokens (email and ad accounts) — deleted from our systems immediately on disconnect, and when the account is deleted
• Email content — not stored (accessed live via API), other than the subject line and recipient of emails sent to a lead from the portal, which are kept in that lead's history
• Leads, work orders, estimates, and other records about a client's own customers — retained for the duration of the engagement, unless the client removes them sooner, and deleted when the account is deleted. A client can download all of its signed estimates, with their signature records, from the portal at any time
• Shared credentials — until the client or Axyion erases them, or the account is deleted
• Referral invitations and referred-business data — retained while the referring client's account exists; a referred business may ask us to delete its information at any time
• IP-based rate-limiting records — 24 hours
• Payment/billing data — held by our third-party payment processor per its policies

Certain data may be retained beyond the periods above where required by law, regulation, or ongoing legal proceedings. You may request deletion of non-legal-record data at any time by contacting hello@axyion.agency.

Section 15 — Cookies

Our main website at axyion.agency does not use advertising cookies. It does use Google Analytics, which sets first-party analytics cookies (such as _ga) to distinguish visitors and sessions, as described in Section 6; you can block these in your browser settings or with Google's opt-out add-on. The other website analytics described in Section 6 are cookieless: our custom beacon uses the browser's sendBeacon mechanism, and our hosting provider's analytics service operates without cookies. The website also uses your browser's local storage to remember display preferences such as reduced motion, and session storage, for the length of your visit, to remember a referral link and any advertising campaign details your visit arrived with (see Section 3).

Our client portal at app.axyion.agency uses functional authentication cookies provided by our third-party authentication provider to maintain your logged-in session; these are required for the portal to operate. The portal also sets functional cookies of its own that remember your display theme and which business account you are working in, and short-lived cookies that secure the sign-in step when you connect a third-party account. Our payment processor may set its own cookies for fraud prevention when you pay an invoice. The portal uses local storage to remember interface preferences. No advertising cookies are used on any Axyion property.

Section 16 — Your Privacy Rights

Depending on your state, you may have rights to know/access, correct, delete, obtain a portable copy of, and opt out of the sale or targeted-advertising use of your personal information. We do not sell your personal information or use it for cross-context behavioral or targeted advertising. We will not discriminate against you for exercising these rights. To exercise a right, email hello@axyion.agency; we verify by matching information against our records and respond within 45 days (extendable 45 more where permitted). You may use an authorized agent.

Appeals: If we decline, email hello@axyion.agency with subject "Privacy Request Appeal." We respond within 45 days (60 for Texas residents); if denied you may contact your state Attorney General.

California (CCPA/CPRA): you may request the categories of personal information collected, sources, purposes, and categories disclosed, and may limit use of sensitive personal information.

Texas (TDPSA): the rights above apply; we do not sell sensitive personal data without consent.

Section 17 — International Users

Axyion is based in the United States and our providers are primarily in the United States. If you access our services from outside the U.S. (including the EEA, UK, or Switzerland), your information will be transferred to and processed in the United States. Where we process EEA/UK personal data on a client's behalf, we act as a processor and will enter a Data Processing Addendum on request. We honor access, correction, and deletion rights for all users regardless of location.

Section 18 — Security

We implement commercially reasonable technical and organizational measures to protect your personal information, including access controls, private file storage, and secure authentication. Data is encrypted in transit using TLS, and OAuth access tokens for connected accounts are encrypted at rest using AES-256. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

In the event of a data breach affecting your personal information, we will notify you and applicable authorities as required by law, including the Oklahoma Security Breach Notification Act.

Section 19 — Children's Privacy

Our services are business-to-business and are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, please contact us at hello@axyion.agency. Where a client's own website is directed to children, compliance with the Children's Online Privacy Protection Act (COPPA) and similar laws for that website is the client's responsibility.

Section 20 — Changes to This Policy

We may update this Privacy Policy from time to time. We will update the Last Updated date at the top of this page and, for material changes, will notify active clients by email. Continued use of our website or services after any changes constitutes acceptance of the updated policy.

Section 21 — Third-Party Platform Privacy Policies

Our integrations are subject to the privacy policies of the respective platforms. We encourage you to review the privacy policies of any platform whose services are connected to your Axyion account:

• Google Privacy Policy: https://policies.google.com/privacy
• Microsoft Privacy Statement: https://privacy.microsoft.com/privacystatement
• Meta Privacy Policy: https://www.facebook.com/privacy/policy
• TikTok Privacy Policy: https://www.tiktok.com/legal/page/us/privacy-policy

Section 22 — Contact

For privacy-related inquiries, contact AXYION LLC at hello@axyion.agency or (918) 416-8951.