Privacy policy

1. Who we are and scope

Axiom Minds Private Limited, India, operates Axiom Proof at axiomproof.ai and the related Workbench at app.axiomproof.ai. We decide the purposes of handling website inquiries, gap-scan submissions, business contacts, and our own account and service administration information.

Where an organisation uses a client workspace to process information about its employees, customers, or other individuals, that organisation determines the purposes and provides the relevant notice. We process that information on its instructions under the applicable service agreement. Please direct requests about such records to that organisation; we can help route a request to it. This policy does not replace a customer’s privacy notice or contractual data protection terms.

2. Information we collect and why

• Contact inquiries: your name, email address, optional company name, message, and receipt and delivery records. We save the inquiry, review it, respond, and handle the conversation you initiate.
• Gap-scan assessment: your sector, employee band, whether your organisation processes children’s data or may be a Significant Data Fiduciary, questionnaire answers, and the resulting scores, findings, recommendations, report identifier, and assessment version. We use these to generate, save, and display your requested report.
• Optional follow-up and report delivery: the name, email address, phone number, and company you provide, together with your follow-up and marketing choices. We use these to send your report when delivery is available, arrange requested follow-up, and provide updates you opt into. Requesting an emailed report also gives us the recipient address you enter.
• Service and security records: session identifiers stored in hashed form, a protected report access token, request limits, and delivery status. These help keep reports accessible to their originating browser, prevent abuse, and investigate delivery or service problems.
• Workspace information: account and organisation details, access permissions, activity records, and records or documents submitted or connected by an authorised customer. We use these to administer the service and perform the work requested under that customer’s agreement.

The public gap-scan uses questionnaire answers; it does not require a document upload. Please do not include passwords, Aadhaar or other identity numbers, payment details, health records, or personal records about other people in website messages or answers. If you submit information for another person, you must have authority to do so.

3. Your choices and withdrawal

You can browse without sending an inquiry. The contact form needs a name, email, and message to receive and answer your request; company is optional. You can turn off follow-up in the gap-scan and obtain an on-screen report without providing contact details. Receiving the quarterly readiness index is a separate optional choice. The current form also uses that choice to include the readiness index in your report.

To withdraw permission for optional follow-up or marketing, email privacy@axiomminds.ai and tell us which communications to stop. Withdrawal does not affect earlier lawful processing. We may still send a response or report you specifically request, or a necessary service or security message. If you ask us to stop processing information needed for a service, we will explain which part of that service can no longer be provided.

4. Cookies and technical information

After a successful gap-scan, we set an essential first-party cookie named __session to let your browser access its saved reports. It expires seven days after it is set or renewed. It is inaccessible to page scripts and is sent securely on deployed HTTPS services. Older reports may use a cookie named gap_scan_access.

You can block or clear cookies in your browser. Doing so, or using a different browser, can prevent access to a saved report. Cookie expiry or deletion does not delete the report from our records. The public website does not currently include advertising pixels or third-party analytics scripts. Hosting and service providers may record technical request information, such as IP address, browser details, requested page, time, and errors, to deliver the site and maintain security. Separate Workbench sign-in cookies are governed by its account and service arrangements.

5. Who receives information

Authorised members of our team receive information needed to answer inquiries, provide requested follow-up, operate the service, and resolve problems. We use service providers for hosting, database storage, authentication, email, and technical support, with access appropriate to the service they provide.

When email delivery is enabled, Resend processes the recipient address and message content. Contact notifications include your inquiry and contact details. Report emails include your assessment and any supplied name, company, and phone number; copies go to our sales and founder contacts for follow-up. A report sent to an address you specify is also available to that recipient and their email provider, so check the address before sending it.

We do not sell personal information. We may disclose information where required by law, to respond to lawful requests, protect people or the service, or obtain confidential professional advice. If our business is reorganised or transferred, relevant records may transfer subject to applicable privacy obligations.

6. Storage and international transfers

Customer workspace hosting and location requirements are set out in the relevant service agreement. Website delivery, email providers, support, and recipients’ email systems may involve processing outside India. An India-hosted workspace does not mean every website request or email is processed only in India. Where applicable, transfers are subject to Indian law, required permissions, and contractual safeguards. Contact us about location requirements before submitting regulated or sensitive information.

7. How long we keep information

Inquiries and correspondence are kept for handling the request and related business records. Gap-scan answers and reports are stored so we can provide the assessment and requested follow-up. These records do not automatically expire when the seven-day browser cookie expires. You can ask us to erase your submission using the contact below.

We assess retention against the purpose, ongoing service relationship, legal requirements, and any need to resolve a dispute or security incident. Customer workspace retention follows the applicable agreement and customer instructions; evidence or audit records may have mandatory retention periods. Where deletion is appropriate, it may be subject to backup cycles or a lawful retention requirement. We will explain any reason we need to retain information when responding to a request.

8. Security and automated assessments

We use access restrictions, protected report access tokens, secure connections on deployed services, request validation, and abuse limits to protect the public workflows. No service can guarantee complete security. Keep your browser and emailed reports secure, and report suspected unauthorised access to our privacy contact. We handle security incidents and any required notifications under applicable law and customer agreements.

The public questionnaire generates scores and recommendations using a versioned control library. Its optional sector benchmarks are editorial estimates. These automated assessments are guidance for human review and do not determine your legal rights or certify compliance. AI-assisted customer workspace processing, where enabled, is subject to that workspace’s configuration and service terms. Please obtain the relevant processing details before providing personal data for that use.

9. Children’s information

Our website forms and business services are intended for people aged 18 or older. Please do not submit a child’s personal information through public forms. The gap-scan question about children’s data asks about your organisation’s practices; it does not request records about a child. If you believe a child has submitted personal information, contact us so we can review and take appropriate action. Customer processing involving children must follow applicable law and the customer’s authorised instructions.

10. Privacy requests and grievances

Contact Axiom Minds Private Limited for privacy questions, withdrawal, access to information about your submission, correction, or erasure at privacy@axiomminds.ai. For a complaint, use the subject “Privacy grievance” and describe the issue and outcome you seek. You can also use our contact page to raise a privacy concern.

Include the email address used for your submission and, if available, the report identifier. Do not send passwords or identity documents with your initial request. We may ask for limited information to verify that the request concerns your records. We will review the request, explain our response or any applicable limitation, and direct customer workspace requests to the responsible organisation where necessary.

We handle grievances within the period required by the law applicable to the complaint; where the 2011 sensitive personal information rules apply, that period is one month from receipt. If you are dissatisfied, reply to the same contact to seek further review. Statutory rights, including nomination and complaints to the Data Protection Board, apply when the relevant DPDP provisions are in force and applicable to your processing. This policy does not restrict any available legal remedy.

11. Indian law and policy updates

This policy is read with applicable Indian law, including the Information Technology Act, 2000 and the 2011 rules on sensitive personal information where applicable. The Digital Personal Data Protection Act, 2023 and Rules, 2025 have phased commencement. As of this policy’s date, their principal processing duties and individual rights have not all commenced. We apply legal obligations as they take effect.

You can read MeitY’s Act commencement notification and its Rules and corrigendum. We update this policy when our practices or legal requirements change and show the new date here. Where a change requires a fresh notice or consent, we will provide it through the relevant service before that processing.