Privacy Policy

Last updated: 25 October 2026 (draft)

Draft pending attorney review. This document has not yet been reviewed by counsel and is not final. Text in [square brackets] marks details still to be confirmed.

Operator

AEXOS is a product of AsymiLink Meta (“we”, “us”). [Legal entity name, registered address and jurisdiction to be confirmed by counsel.]

AEXOS is licensed to organisations under a written licence agreement. It is not available as a self-serve consumer product.

Contact for privacy matters: contact@asymilinkaexos.com or our contact page. [Dedicated privacy officer or privacy contact, if different, to be confirmed.]

What AEXOS Is

AEXOS is a multi-tenant enterprise AI governance and compliance platform. It provides oversight, strategy, risk, legal, and compliance capabilities across US federal and state jurisdictions. Each licensed organisation's data is logically isolated.

Our Role

For your account and for the security and operation of AEXOS, we decide how personal information is handled. For data that a licensed organisation puts into AEXOS, we act on that organisation's instructions under its licence agreement, and the organisation decides how that data is used. [Controller/processor roles and any data processing agreement terms to be confirmed by counsel.]

Information We Collect

When you use AEXOS as an authorised user of a licensed organisation, we may collect:

Account credentials (email address, hashed password)
Organisational data you or your organisation provide to AEXOS for governance, compliance, and decision-making purposes
Usage logs (actions taken, features accessed, timestamps) for audit trail and security purposes
AI interaction records (queries, model responses, decision outcomes) as part of the immutable decision log
Optional settings you turn on, such as voice calibration values and push notification subscriptions (see Cookies & Local Storage)

We collect this information from you, from your organisation's administrator (for example, when you are invited), and automatically as you use AEXOS. If you do not provide the required account information, you cannot use AEXOS.

How We Use Your Information

To provide governance, compliance, and decision-support services to your organisation
To maintain the immutable decision log and audit trail required by the platform
To enforce data classification and security policies
To improve service reliability and security

Cookies & Local Storage

This section lists everything AEXOS stores in your browser. We do not use analytics, advertising, social media or other third-party cookies or trackers, and we do not use cookies to build profiles. Fonts are served from our own domain.

If you are not signed in, the public website (including this page) stores nothing in your browser. Because there is no non-essential storage, there is no cookie banner. If that changes, we will ask for consent before setting anything that is not strictly necessary, and update this policy.

When you sign in, your browser connects to our authentication and database provider (Supabase) and the items below may be stored. Most are set only when you use the related feature.

Strictly necessary

Required for sign-in and security. AEXOS cannot work without them.

sb-rmkpcmhqynxymqhldckf-auth-token (may be split into .0, .1… chunks)
Type
First-party HTTP cookie (Supabase Auth)
Purpose
Keeps you signed in. Holds your Supabase Auth session (access and refresh tokens) so the server can confirm who you are on each request. Set only when you sign in.
Duration
Up to 400 days from the last session refresh. The access token inside it expires much sooner and is refreshed automatically. Removed when you sign out.
How to clear
Sign out, or delete cookies for asymilinkaexos.com in your browser settings.
sb-rmkpcmhqynxymqhldckf-auth-token-code-verifier
Type
First-party HTTP cookie (Supabase Auth)
Purpose
Temporary security value set only when you request a password-reset email, so the reset link can be completed safely in the same browser.
Duration
Removed once the reset link is used.
How to clear
Delete cookies for asymilinkaexos.com.

Functional (signed-in app only)

Remember choices and features you use. They contain no tracking identifiers and are not shared with third parties. [Counsel to confirm whether any of these requires consent for users in the EU/UK.]

aexos_active_org_id
Type
localStorage
Purpose
Remembers which of your organisations is selected.
Duration
Until cleared.
How to clear
Clear site data for asymilinkaexos.com.
aexos-recent-routes
Type
localStorage
Purpose
Lists the last four pages you opened from the command palette.
Duration
Until cleared.
How to clear
Clear site data.
aexos-pwa-dismissed
Type
localStorage
Purpose
Remembers that you dismissed the “install app” prompt.
Duration
Until cleared, or until you install the app.
How to clear
Clear site data.
aexos-voice-profile
Type
localStorage (also saved to your account)
Purpose
Voice calibration values (pitch range and a volume threshold) so the voice assistant responds to you. No audio is stored. Set only if you run voice calibration.
Duration
Until cleared or recalibrated.
How to clear
Clear site data to remove the browser copy. To delete the copy saved to your account, contact us.
aexos-war-room-thread
Type
sessionStorage
Purpose
Reopens the last War Room conversation in the same tab.
Duration
Until the tab is closed.
How to clear
Close the tab.
aexos:profile:<organisation-id>
Type
sessionStorage
Purpose
Short-lived copy of your organisation profile so the Company Profile page loads faster.
Duration
Until the tab is closed.
How to clear
Close the tab.
bo-back-<room-id>
Type
sessionStorage
Purpose
Remembers that you left a breakout room, so you are not sent back into it automatically.
Duration
Until the tab is closed.
How to clear
Close the tab.
Service worker /sw.js and Cache Storage aexos-v6
Type
Service worker and Cache Storage
Purpose
Lets the signed-in app install as an app, show an offline page and receive notifications. Caches only public static files (app code bundles, icons, manifest). Pages, account data, API and sign-in responses are never cached.
Duration
Until replaced by a newer version or cleared.
How to clear
Clear site data, or unregister the service worker in your browser’s developer or site settings.
Push notification subscription
Type
Browser push subscription, plus a server record
Purpose
Only if you turn on notifications in Settings and your browser grants permission. The browser’s push endpoint and keys, and a short browser description, are stored against your account so we can deliver notifications.
Duration
Until you turn notifications off, revoke permission, or the browser rotates the subscription.
How to clear
Turn notifications off in Settings, or revoke notification permission for asymilinkaexos.com in your browser.

Analytics

None. AEXOS does not use analytics cookies or analytics scripts.

Managing storage

Signing out removes the session cookie. To remove everything else, clear cookies and site data for asymilinkaexos.com in your browser settings. If you block the strictly necessary cookies, you will not be able to sign in.

Data Residency and Classification

AEXOS is hosted in the United States. Organisations can enable restricted-data mode, which excludes classified records from AI processing and outbound integrations. AI requests use the organisation's own model provider key.

Data classification levels (ITAR, PHI, CUI, Confidential, Internal) are enforced at the infrastructure level. The Local Guardian agent has veto authority over any data transmission that violates classification policies.

Data Sharing

We do not sell, rent, or trade your organisational data. Data is shared only:

With service providers that host and run AEXOS for us, including Netlify (web hosting) and Supabase (database and authentication). [Full sub-processor list and the countries where each processes data to be confirmed.]
With AI model providers when classification policies permit and the interaction is required for service delivery (logged and auditable)
As required by applicable law or regulation
With your explicit consent

Data Retention

Organisational data is retained for the term of the organisation's licence unless otherwise specified in the licence agreement or data processing agreement. The immutable decision log is retained as a permanent audit record unless deletion is required by applicable law.

[Retention periods for account data and usage logs after a licence ends, or after a user is removed, to be confirmed.]

Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include encryption in transit (HTTPS), database access rules that isolate each organisation's data, role-based access, and audit logging. We destroy or de-identify personal information we no longer need, unless the law or a licence agreement requires us to keep it. No system is completely secure. If a data breach is likely to cause you serious harm, we will notify you and the relevant regulator where the law requires.

Your Rights (United States)

Depending on your state of residence (for example under the California Consumer Privacy Act), you may have rights to access, correct, delete, or port your personal data. To exercise these rights, use our contact page or speak with your organisation's AEXOS administrator.

Australia: Privacy Act 1988 and the Australian Privacy Principles

Where the Privacy Act 1988 (Cth) applies to us, we handle personal information in line with the Australian Privacy Principles (APPs). [Counsel to confirm whether the operator is an APP entity, including whether the small business exemption applies.]

APP 1 (open and transparent management): this policy explains what we collect, why, how we hold it, who we disclose it to, whether it goes overseas, and how to access, correct or complain. We keep it up to date and provide it free of charge.
APP 5 (notice of collection): the sections above, including Cookies & Local Storage, describe what we collect, how and why we collect it, the consequences of not providing it, and who we usually disclose it to.
APP 6 (use and disclosure): we use and disclose personal information only for the purpose we collected it for, for related purposes you would reasonably expect, with your consent, or where the law requires or authorises it.
APP 8 (cross-border disclosure): AEXOS is hosted in the United States, so personal information of Australian users is disclosed to and stored with service providers outside Australia, including in the United States. [Other countries where service providers process data to be confirmed.] We take reasonable steps, including contractual terms, so that overseas recipients handle it consistently with the APPs.
APP 11 (security): see Security above.
APP 12 and 13 (access and correction): you can ask to access the personal information we hold about you, or ask us to correct it. Contact us as set out under Operator. We will respond within a reasonable period, usually within 30 days, and will not charge you to make a request. If we refuse, we will tell you why in writing and how to complain.

Complaints: please contact us first so we can try to resolve your concern. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

If the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to our handling of your personal data, the following applies in addition to the rest of this policy.

Lawful bases

Contract (Art. 6(1)(b)): to provide AEXOS under the licence agreement, including your account and sign-in.
Legitimate interests (Art. 6(1)(f)): to provide AEXOS to the authorised users of licensed organisations, keep it secure, prevent misuse, and maintain the audit trail. You can object to processing on this basis (see below).
Legal obligation (Art. 6(1)(c)): where we must keep or disclose information by law.
Consent (Art. 6(1)(a)): for optional features such as push notifications. You can withdraw consent at any time without affecting earlier processing.

Where we process data on a licensed organisation's instructions, that organisation is responsible for the lawful basis. [Lawful-basis mapping to be confirmed by counsel.]

Your rights (Articles 15 to 22)

Access to your personal data (Art. 15)
Rectification of inaccurate data (Art. 16)
Erasure (Art. 17). Some records, such as entries in the immutable decision log, may be kept where an exemption applies, for example a legal obligation or the establishment, exercise or defence of legal claims. We will tell you if so.
Restriction of processing (Art. 18)
Notification to recipients of any rectification, erasure or restriction (Art. 19)
Data portability (Art. 20)
Objection to processing based on legitimate interests (Art. 21)
Not to be subject to a decision based solely on automated processing that has legal or similarly significant effects (Art. 22). AEXOS provides recommendations; human authority remains final on all decisions.

To exercise these rights, contact us as set out under Operator, or ask your organisation's AEXOS administrator. We will respond within one month, which may be extended by up to two further months for complex requests; we will tell you if so.

International transfers

AEXOS is hosted in the United States, so personal data from the EEA or UK is transferred outside those areas. Where required, we rely on an appropriate safeguard. [Transfer mechanism (for example EU Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or an adequacy decision) to be confirmed by counsel.] You can ask us for more information about these safeguards.

Representatives and data protection officer

[Whether an EU and/or UK representative (Art. 27) or a data protection officer (Art. 37) is required, and their details, to be confirmed by counsel.]

Complaints

You have the right to lodge a complaint with a supervisory authority, in particular in the EU or EEA country where you live, work, or where the alleged infringement took place. In the UK, this is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first.

Changes to This Policy

We will update this policy when our practices change and show the date of the latest version at the top of the page.

Contact

For questions about privacy, email contact@asymilinkaexos.com or use our contact page.