Privacy Policy

Last updated 21 October 2026

AxioIntel is operated by Jatin Wadia, an individual based in Ghaziabad, Uttar Pradesh, India. This page explains what data AxioIntel collects, why, who it is shared with, and how to reach me about it. AxioIntel is a one-person project: there is no dedicated privacy team, but every request below is answered by me personally.

1. What is collected

Account data

When you sign in, Firebase Authentication gives AxioIntel your email address and, if you sign in with Google, your name and profile photo. Payment details are never collected or stored by AxioIntel directly — see section 3.

When you accept the signup terms, we record your account identifier, the agreement version and document link, the server-recorded acceptance time, and the sign-in provider. This records the agreement associated with your account; it does not record your password, authentication token, IP address, or browser fingerprint. This record follows the account-data handling described in section 4.

Review and listing data

For monitoring and audits, AxioIntel collects publicly accessible Google Maps review and business-listing information using its own automated collector and external collection providers where used (see section 2). This can include review text, ratings, dates, public reviewer names and identifiers, profile links, publicly visible review history, business responses, and source links. Dated records may remain after the source is edited or removed.

AxioIntel compares reviews, posting times, wording, and public reviewer histories to identify changes and patterns for human assessment. Reports may contain source information, excerpts, and inferred connections or patterns, and are provided to customers, including customers researching competing businesses. These inferences can be inaccurate and do not establish that a reviewer or business acted improperly.

Google sign-in authenticates your AxioIntel account; it does not connect your Google Business Profile or grant permission to manage it. Business Profile API connections and in-app publishing are planned features pending Google approval, not currently available features. Before enabling them, we will explain the additional data access and request the relevant permissions.

Usage data

The public site sends one anonymous page-view count per visit, with no cookie, IP address, referrer, or user agent attached — it is a volume counter, not a visitor record. The count says only whether the browser has loaded one of our public pages before, read from a flag in its own local storage, so we can tell first visits from repeat ones without knowing whose they are. The browser's user agent is read, not stored, to leave automated crawlers out of the count. Inside the signed-in dashboard, a few steps (such as opening the business picker, starting a pull, viewing plans, or opening or closing checkout) are recorded against your account and workspace with a time and a short label, kept for 400 days, and never with an IP address, browser details, referrer or page address. A small flag in your browser's local storage remembers whether you were signed in last time, purely so the site can offer "Open dashboard" instead of "Log in". Neither flag leaves your browser except as the one-word visit kind (first, repeat, or signed in) on the page-view count above.

Campaign links

Some links we send, such as the ones in our emails, carry campaign tags in the address (utm_source, utm_medium, utm_campaign and utm_content) naming the campaign and the message the link came from. When you open one, the site keeps those tags, and the time you arrived, in your browser's local storage for 30 days. Nothing is sent while you only browse. If you create an account within those 30 days, the tags are recorded once against that new account, so we can tell which campaign brought you; they are never overwritten, are kept with your account, and are removed when your account is deleted. Tags are not recorded for an account that already existed.

Google Analytics and Google Ads (cookies only with your consent)

The public site loads Google Tag Manager, which runs Google Analytics 4 and the Google Ads tag, in Google's consent mode. Until you accept, both are told that you have not agreed: they set and read no cookies, and send Google only cookieless signals that a page was viewed or a sign-up happened, with the page and, as any web request does, your browser and IP address. Google uses these to estimate visits and sign-ups in aggregate; they are not tied to a cookie or to you. If you accept analytics and ad cookies, Analytics sets two cookies (_ga and _ga_<ID>, kept up to two years) and sends Google the page you are on, the page that referred you, your browser, device type and approximate location derived from your IP address. We use it to see which pages are read and where visitors come from. The Google Ads tag sets one cookie (_gcl_au, kept 90 days) that remembers whether you arrived by clicking one of our Google ads, and when you create an account it tells Google Ads that a sign-up happened, so we can see which ads bring sign-ups. Google receives the page, your browser and your IP address with it; we send no email address, name or anything about the businesses you watch, and ad personalisation stays off even after you accept, so it is not used for remarketing. If you decline, or do not answer, no Google cookie is set, and changing your choice to decline takes effect at once. Your choice is kept in your browser's local storage. Neither runs in the signed-in dashboard.

Abuse prevention

Separately from analytics, public forms and page-view requests are subject to short-lived security counters. Platform-wide counters limit request volume. For email forms, the server derives a daily changing, keyed identifier from the submitted email address; these counters do not store the raw email address or an IP address, or create a cross-day visitor profile. Expired counters older than two days are removed by the scheduled cleanup. Hosting and identity providers may also process connection logs under their own retention policies.

Error and performance diagnostics

Where enabled, we use Sentry to diagnose errors and service performance. Diagnostic reports may include error messages, stack traces, technical browser or device information, page or request URLs, and timing information. These reports are separate from the analytics counts and dashboard events described above. We do not enable session replay. Diagnostic content, including an error message or URL, can contain personal information.

2. Who this is shared with

Each of these processes only what it needs to do its job — for example, OpenAI receives review text to read it, not your payment details, and Paddle receives your payment details to charge you, not your reviews. The providers used depend on the feature and collection route. Axio-CRED is AxioIntel's internal collection system, not a separate customer-facing service. Provider processing is subject to the applicable service agreements and privacy policies.

3. Payments

4. How long data is kept

Review and listing evidence is preserved as a dated record. Stopping a watch stops future collection for your workspace; it does not erase the records already kept. Public listing data may also be used by other workspaces watching the same business. There is currently no single automatic deletion deadline for all collected evidence. Deleting your account does not automatically delete public-source records shared across workspaces or copies of reports already delivered to customers. Requests concerning those records are reviewed separately, including any applicable obligation to delete or correct them. Account data is kept while your account exists. If you close your account, tell me at the address below and I will delete what is not needed for legal, tax, or dispute-resolution purposes (such as billing records Paddle or Indian tax law requires be kept).

5. Your rights

Account holders and people whose public reviews or business information appear in our records can request access, correction, deletion, or export by emailing support@axiointel.com. You do not need an AxioIntel account to make a request. Include the relevant source or report link and explain your request; we may need proportionate information to verify your identity or authority. I aim to respond within 30 days and will follow any applicable statutory deadline. Available legal rights, exceptions, and verification requirements depend on the laws that apply to the request. You can also use this address to dispute an inaccurate report or inference.

6. Security

AxioIntel uses industry-standard measures (encrypted connections, access controls on the underlying cloud infrastructure) to protect your data, but no system is perfectly secure and I cannot guarantee against every possible breach.

7. Children

AxioIntel is not directed at, and is not knowingly used by, anyone under 18.

8. Changes to this policy

I may update this policy from time to time; the "Last updated" date above reflects the most recent change.

9. Contact

Questions about this policy, or a request under section 5: support@axiointel.com.