Privacy notice Version 1.0 · 2026-09-10 How Axentrio uses, retains and protects personal data, and how you can exercise your rights. 1. Who is responsible? Achraf Lamrani Makhloufi CommV, trading as Axentrio, Passtraat 248/B, 9100 Sint-Niklaas, Belgium, enterprise number 0789.355.217 and VAT BE0789355217, is responsible for its own website, commercial contacts, account and subscription administration and its own security purposes. Privacy contact: info@axentrio.com. Account data assistance: support@axentrio.com. When a business uses Axentrio to help its customers, that business determines why it processes customer data. Axentrio processes it on that business’s instructions under the data processing agreement. If you spoke with another business’s assistant, contact that business first. We help route a misdirected request to the appropriate controller. 2. What data do we receive? When you contact us, we receive the information you provide, such as your name, business, work email address, enquiry and any files. Account data includes user and business information, VAT and billing details, subscription, payment status and relevant communications. Payment details are processed through Stripe. Conversations and bookings may involve message content, contact details, channel, sender, timestamps, conversation summaries, enquiries, notes and appointment data. What is necessary depends on the business and service. Connected channels, calendars and authorised users may supply this information. For unrelated busy calendar events, the described integration uses their date and time to determine busy periods. Delivering and securing online services also involves technical information such as network and device information, connection data, session identifiers and security logs. The cookie notice describes browser storage. Do not provide data unnecessary for your enquiry, such as passwords, payment card details or sensitive case information. 3. Purposes and legal bases Answering enquiries, handling an introduction and providing an account or subscription: steps before or performance of a contract where you are a party. Communication with a business customer’s staff relies on our legitimate interest in business communication and service delivery. Billing and mandatory administration: compliance with applicable legal duties. Security, incident investigation and establishing or defending specific claims: legitimate interests, with an assessment of necessity and your rights. Data is limited to what the relevant purpose needs. Processing customer conversations for your business follows your documented instructions and legal basis as controller. Axentrio does not use this content to train or fine-tune AI models itself. Where consent is required, we request it separately and you can withdraw it. Acceptance of terms does not provide consent to advertising. Required account and billing details are needed to provide the relevant service. Without sufficient information we may be unable to handle an enquiry, booking or account. The current website form prepares an email locally; its content is sent to us only when you send the email yourself. 4. The digital assistant and OpenAI The assistant uses AI to understand messages and formulate replies. Axentrio uses the OpenAI API directly for this. Content and relevant context needed for the task are sent to that service. Axentrio has approved, active Zero Data Retention for its OpenAI project. No specific OpenAI data region is configured. Zero Data Retention limits retention for eligible API functions and excludes customer content from the usual abuse monitoring logs. It is not a general guarantee that every API feature, cache or exceptional case operates without any retention. Official documentation explains the limitations. It also does not mean that all processing happens in Germany. The assistant supports replies, leads and bookings; you can request human help. Fictional demonstrations on this website are not real customer bookings. Using the assistant is not consent to decisions outside the purpose of your enquiry. 5. Which services are involved? Hetzner hosts the Axentrio application, platform database and database backups in Germany. OpenAI provides direct AI processing. Stripe handles subscription payments. Resend delivers booking emails. Clerk delivers registration and password recovery emails. Combell currently hosts the info@axentrio.com and support@axentrio.com mailboxes. Facebook Messenger, Instagram and WhatsApp connect directly through Meta; calendar integrations connect directly through Google or Microsoft. Only selected and connected services are relevant to your use. These providers may also be independent controllers for their own purposes, such as account management or security, under their own terms. The marketing website is hosted separately through ChatGPT Sites. Google Fonts supplies fonts. The chat may load the Socket.IO code library from its distribution network, whose provider receives the technical connection information needed for the download. Sentry is used for error monitoring; the configuration is intended not to send customer email addresses, IP addresses or chat content. GitHub is used for development, not to store customer conversations. Authorised people may view data when necessary for the service, support or security. Under the current setup, superadmin access and direct technical support take place from Belgium. A legal basis or duty may also require disclosure to competent authorities; there is no general unrestricted access to customer conversations. 6. Locations and international transfers German hosting covers the Axentrio application, database and associated backups. External services have their own infrastructure and international organisations. Using a European service or account does not automatically mean all processing remains in the European Economic Area. Transfers outside the EEA must have the applicable safeguards: a valid adequacy decision covering the recipient or appropriate contractual safeguards, such as EU standard contractual clauses, with supplementary measures where needed. Contract documents of providers including OpenAI, Stripe, Clerk and Resend describe their transfer arrangements. The relevant basis depends on the service, recipient and transfer. Contact info@axentrio.com for information or a copy of relevant safeguards, subject to protection of confidential information. 7. How long do we retain data? Customer conversations: twelve months after the last message, then deletion or genuinely irreversible anonymisation. Prospects without an ongoing relationship: twelve months without genuine interaction. The business’s own automated message does not restart that period. Completed appointments: twelve months after the appointment date. Cancelled appointments: twelve months after cancellation. Contacts through our own website form and chat without a customer relationship are retained for twelve calendar months without substantive contact. For an ongoing quote, order, customer relationship or warranty, only data necessary for that purpose is retained while the purpose exists. A new interaction does not automatically extend retention of every old conversation or appointment. A free account does not mean unlimited storage. Recovery backups: at most thirty days from creation. Superadmin logs: twelve months from the logged action. For a specific incident or dispute, only relevant necessary evidence is kept separately for longer, with restricted access, a documented reason and review. Invoices, payment records, acceptance evidence and other legally required documents follow their applicable retention duties. The period depends on matters including the document type, financial year and any ongoing claims. These records are distinguished from ordinary customer conversations. Data no longer needed and without a valid exception is not retained indefinitely. 8. Access and security Two-factor authentication is mandatory for superadmin accounts. The platform records which superadmin views or changes customer data. Access should remain limited to what the task requires. Logs support purposes including incident investigation and follow the retention described above. These measures do not guarantee the absence of every risk. A data incident is subject to applicable investigation, protection and notification duties. Customers must also manage their own account access, connected channels and calendars with care. 9. Your rights and deadlines Subject to applicable conditions, you have rights of access, correction, erasure, restriction, portability and objection. You may object to processing based on legitimate interests, and always to direct marketing. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. For Axentrio’s own processing, email info@axentrio.com. For platform data assistance, contact support@axentrio.com. We request only information reasonably necessary to check identity and authority. Account export or deletion requests require prior confirmation through the linked email address. Where that route is unavailable, we consider a reasonable alternative check; lack of an account login does not automatically exclude a statutory request. For GDPR requests, we respond without undue delay and normally within one month of receipt. Where complexity or the number of requests justifies it, this may be extended by at most two months; the extension and reasons must be communicated within the first month. Variable ordinary export volumes or a planned account waiting period do not remove these statutory deadlines. Exercising statutory rights is normally free and does not require a paid subscription. Manual export support is free. Rights are not absolute: statutory retention, others’ rights or other applicable exceptions may matter. If refusing a request, we explain why and provide information about complaints and judicial remedies. 10. Export and account deletion Conversations are exportable as .txt and leads as CSV or Excel. Contact support for additional data. Ordinary timing depends on the request and data volume; statutory deadlines continue to apply. There is no separate booking export, while booked appointments also appear in your connected calendar. Full account deletion through settings is still in development. The general terms describe the planned thirty-day waiting period, separate reactivation button and subscription consequences. Existing data erasure rights can already be exercised through the contact addresses. Deletion on the Axentrio platform does not cancel already-booked future appointments in an external calendar. Backups and necessary statutory records follow their separate rules. 11. Questions, complaints and changes For questions, contact info@axentrio.com. You may also complain to the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, Belgium, through gegevensbeschermingsautoriteit.be. Other competent supervisory authorities and courts remain available under the applicable rules. This notice describes processing for the stated version. We update it for relevant changes and inform people where necessary. A new privacy notice does not automatically change contract terms. Related documents General terms: https://axentrio.lamrani-ente-8476.chatgpt.site/en/terms-and-conditions/ Subscription terms: https://axentrio.lamrani-ente-8476.chatgpt.site/en/subscription-terms/ Cookies and browser storage: https://axentrio.lamrani-ente-8476.chatgpt.site/en/cookies/ Data processing agreement: https://axentrio.lamrani-ente-8476.chatgpt.site/en/data-processing-agreement/ Sources and provider information OpenAI: data processing and Zero Data Retention: https://developers.openai.com/api/docs/guides/your-data OpenAI: data processing agreement: https://openai.com/policies/data-processing-addendum/ Stripe: data processing: https://stripe.com/legal/dpa Clerk: data processing: https://clerk.com/legal/dpa Resend: data processing: https://resend.com/legal/dpa EDPB: rights and deadlines: https://www.edpb.europa.eu/sme/find-practical-info/faq_en Belgian Data Protection Authority: https://www.gegevensbeschermingsautoriteit.be/