Privacy Policy

1 Introduction & Scope

Axeonsoft ("Axeonsoft", "we", "us", or "our") respects your fundamental right to privacy. This Privacy Policy applies to the personal information we collect, process, and protect through our website at https://axeonsoft.com, our client management dashboard, website building tools, appointment booking infrastructure, and connected third-party social media integrations (collectively, the "Platform" or "Services").

Please read this document thoroughly. By accessing our Platform, creating an account, or authorizing an integration, you acknowledge the collection and processing of information as described herein. For clarity regarding our role:

• Data Controller: Axeonsoft acts as a Data Controller with respect to account credentials, billing details, and personal data of our registered business clients and website visitors.
• Data Processor: When you build and host websites using Axeonsoft and collect personal details from your own end-customers (such as appointment bookings or customer contact forms), you act as the Data Controller, and Axeonsoft acts strictly as a Data Processor carrying out your instructions.

2 Categories of Personal Data We Collect

We collect information necessary to deliver, operate, secure, and improve the Platform. Depending on how you interact with our Services, we collect:

• Identification & Contact Details: Full name, email address, telephone number, business name, physical address, and contact preferences.
• Account Authentication Data: Login emails, encrypted passwords, session identifiers, administrative role assignments, and security audit logs.
• Content & Publishing Media: Web pages, component configurations, uploaded graphics, media files, video posts, captions, hashtags, and catalog descriptions.
• Booking & Service Data: Staff names, service definitions, availability slots, customer appointment requests, booking notes, and notification logs.
• Social Media Integration Data: External account identifiers, public usernames, display names, profile avatars, encrypted OAuth access and refresh tokens, publish IDs, and webhook status payloads.
• Technical & Usage Data: IP addresses, browser user agent, device operating system, referring URLs, request timestamps, and system performance metrics.

3 Information Users Provide Directly

We collect information that you explicitly choose to provide when you:

• Register an administrative or user account on Axeonsoft.
• Create, customize, and edit website pages, components, and settings in the page builder.
• Configure business details, address, telephone numbers, and social links in site settings.
• Create booking availability calendars, service offerings, and staff profiles.
• Draft, schedule, and configure video or image posts for external publishing.
• Submit inquiries, request customer support, or communicate with our development team.

4 Account, Authentication & Technical Data

When you browse or interact with the Platform, our servers automatically collect certain technical telemetry and log information:

• Log Files: Server logs record IP addresses, HTTP request methods, requested URLs, referring web pages, response status codes, and browser user-agent headers.
• Session State: Encrypted session cookies identify authenticated users across page visits to maintain security and prevent cross-site request forgery (CSRF).
• Security Monitoring: Technical telemetry is used exclusively to diagnose system errors, safeguard against automated attacks, enforce rate limits, and ensure network integrity.

5 Website, Booking & Product Catalog Data

When you use our online booking and catalog features, the Platform processes customer appointment requests submitted through your website:

• Customer Booking Inquiries: Data captured may include customer name, phone number, email address, selected service, staff member, preferred date and time, and special notes.
• Client Autonomy: This data is stored within your database partition for the sole purpose of allowing you to view, confirm, reschedule, or manage appointments. Axeonsoft does not sell, lease, or use your end-customers' booking data for commercial advertising or unsolicited marketing.
• Privacy Notice Requirement: If your hosted website collects customer information, you are responsible for providing your end-customers with an accurate privacy policy explaining your data collection practices.

6 Social Media Account Connections & OAuth Authorization

Axeonsoft offers optional integrations with external social media platforms, including TikTok (TikTok Inc. / Bytedance) and Instagram (Meta Platforms, Inc.).

When you connect an account, we request only the specific permissions (scopes) necessary to provide the features you intend to use:

• TikTok Integration Scopes:
  • user.info.basic — Used strictly to read your public TikTok display name, avatar, and unique Open ID so you can verify which TikTok account is connected in your Axeonsoft dashboard.
  • video.publish — Used strictly to upload and publish videos, titles, and captions to your TikTok account at your explicit instruction and schedule.
• Instagram Integration Scopes:
  • instagram_business_basic — Used to retrieve your public professional profile information and confirm connected account identity.
  • instagram_business_content_publish — Used to publish authorized photo or video posts directly to your Instagram profile.

We do NOT request access to private direct messages, personal browsing history, followers' private information, or any administrative scopes outside the published publishing requirements.

7 Storage & Protection of OAuth Tokens

We enforce strict cryptographic and architectural standards to secure third-party credentials:

• Strong Encryption at Rest: All OAuth access tokens and refresh tokens received from TikTok or Meta are encrypted using industry-standard authenticated encryption (AES-256 via Rails ActiveSupport::MessageEncryptor) before being committed to our database storage.
• Zero Client-Side Exposure: Tokens are stored exclusively in secure server-side databases. Tokens are never exposed in client-side HTML, JavaScript files, DOM attributes, public endpoints, browser developer consoles, or unencrypted application logs.
• Principle of Least Privilege: Decrypted tokens are instantiated only in ephemeral, isolated server-side background job processes (e.g., SocialPublishingJob) during the exact moments required to execute user-scheduled API publishing requests.
• Automatic Expiration & Refresh: Token validity timestamps are tracked. When refresh tokens expire or access is revoked, stored credentials become invalid and are purged.

8 Information Received from Third-Party Platforms & Webhooks

During the lifecycle of connected social media operations, we receive metadata from external platforms:

• Publishing Confirmations: External platforms return unique publish IDs, status codes (e.g. PUBLISH_COMPLETE or FAILED), error descriptions, and publication timestamps.
• Webhook Verification: Our platform receives real-time webhook events (such as TikTok's post.publish.complete notification). Every incoming webhook is cryptographically authenticated using digital signature verification (e.g., validating the TikTok-Signature header with our secret key) before any payload is parsed or processed.
• No Unauthorized Data Harvesting: Webhook events are processed solely to update the internal publishing status of the specific post in your dashboard. We do not harvest, profile, or retain collateral third-party user data.

9 AI-Assisted Content Processing (Where Applicable)

Where optional generative AI drafting tools are utilized on the Platform:

• Prompts, titles, and text snippets provided by the user are transmitted to secure inference APIs solely to return the requested draft suggestions.
• Axeonsoft does not sell, license, or publish your confidential business data or drafts.
• We do not use proprietary customer data to train public foundation models without your express opt-in consent.

10 Cookies, Sessions & Tracking Technologies

Axeonsoft utilizes essential technical cookies and browser storage technologies strictly necessary to operate the Platform:

• Essential Session Cookies: Required for user authentication, maintaining secure login sessions, and CSRF token verification.
• Functional Preferences: Small local storage records or cookies remember user interface preferences, such as selected language locale (id or en) and administrative display options.
• Aggregated Analytics: We may use standard web telemetry tools (such as Google Tag Manager / GTM) to evaluate aggregated, non-personally identifiable site usage and performance metrics.
• No Third-Party Ad Tracking: We do not sell your personal data or use third-party behavioral advertising tracking cookies across external websites.

11 Purposes & Legal Bases for Processing

We process personal information under the following lawful bases:

• Contractual Performance: To fulfill our agreement with you, deliver requested website hosting, enable online booking, and execute user-scheduled social media publishing.
• Legitimate Business Interests: To secure our infrastructure, monitor platform stability, detect fraud or abuse, enforce our Terms of Service, and diagnose technical errors.
• User Consent: When you voluntarily authorize third-party OAuth integrations (TikTok or Instagram) or opt into optional communications.
• Legal Compliance: To satisfy taxation, corporate accounting, regulatory, or judicial requirements under applicable law.

12 Data Storage, Security & Retention Principles

Security Measures: We implement multi-layered administrative, technical, and physical safeguards:

• All web traffic is strictly encrypted in transit using Transport Layer Security (TLS 1.2 / TLS 1.3 over HTTPS).
• Database credentials, API secret keys, and OAuth access tokens are encrypted using cryptographic key management.
• Access to production databases and server environments is restricted to authorized operations personnel via authenticated, audited channels.

Data Retention Principles:

• We retain account data for as long as your account remains active and in good standing.
• When you disconnect a social media account, stored OAuth tokens are deleted from our database immediately.
• When an account is terminated, associated website content and credentials are queued for permanent deletion, subject only to statutory tax, corporate, or fraud prevention record retention requirements mandated by law.

13 Service Providers & Third-Party Data Sharing

Axeonsoft does NOT sell, rent, or trade your personal data. We share information only with trusted third parties under strict confidentiality and security terms:

• Cloud Infrastructure & Hosting: Our primary web applications and database systems are hosted on enterprise cloud infrastructure (e.g., Fly.io and secure managed PostgreSQL servers).
• Social Media Platforms: When you instruct us to schedule or publish a post, media files, captions, and publication parameters are transmitted directly to TikTok or Meta via their official APIs.
• Legal & Regulatory Disclosures: We may disclose personal data if compelled by a lawful subpoena, court order, or official governmental investigation, or where necessary to prevent imminent physical or financial harm.

14 Your Privacy Rights & How to Exercise Them

Depending on your location and applicable privacy laws, you possess legal rights regarding your personal data:

• Right of Access: The right to request confirmation of whether we process your data and obtain a copy of personal information held about you.
• Right to Rectification: The right to update, correct, or complete inaccurate or incomplete personal information in your account.
• Right to Erasure ("Right to Be Forgotten"): The right to request the permanent deletion of your personal data and account records, subject to legitimate statutory exceptions.
• Right to Restrict or Object: The right to object to or request limits on certain types of processing, including direct marketing.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format.

To exercise any of these rights, please contact our Data Protection team at privacy@axeonsoft.com or info@axeonsoft.com. We will respond to verified requests within thirty (30) days without undue delay.

15 Account Deletion & Data Deletion Requests

You have the right to request the permanent deletion of your Axeonsoft account and all associated personal data at any time:

• How to Request Deletion: Send an email with the subject line "Data Deletion Request" from your registered account email to privacy@axeonsoft.com.
• Deletion Process: Upon verifying your identity, our team will initiate account deletion. All stored profile details, hosted website configurations, and encrypted integration tokens will be permanently scrubbed from our active databases.
• Automated Data Deletion Callbacks: In compliance with developer platform guidelines, Axeonsoft supports automated data deletion callback endpoints and webhooks for external integrations, confirming that user integration data has been fully removed.

16 Revoking Third-Party Social Media Access (TikTok & Instagram)

You retain total control over your connected social media accounts. You can revoke Axeonsoft's access at any time through either of the following methods:

• For TikTok: Open the TikTok application → Go to Profile → Tap Menu (☰) → Select Settings and Privacy → Tap Security & Permissions → Tap Manage App Permissions → Locate and select Axeonsoft → Tap Remove Access.
• For Instagram / Meta: Log in to Facebook or Instagram → Go to Settings & Privacy → Select Apps and Websites → Locate Axeonsoft under active connections → Click Remove.

Once permissions are revoked through either method, Axeonsoft can no longer access your account or publish content on your behalf.

17 International Data Transfers

Axeonsoft is headquartered in Indonesia and utilizes enterprise cloud infrastructure hosted in certified global data center facilities. If you access our Services from outside Indonesia, your data may be transferred, stored, and processed in jurisdictions where our servers and service providers operate. We take all appropriate contractual, technical, and organizational measures to ensure that your personal information receives an adequate level of data protection wherever it is processed.

18 Children's Privacy

Axeonsoft is a business-to-business and professional software platform designed exclusively for commercial, corporate, and adult use. Our Services are not directed to, and we do not knowingly solicit or collect personal information from, children under the age of 18 (or under 13 in jurisdictions recognizing lower thresholds). If we discover that personal data of a minor has been collected without verifiable parental consent, we will promptly delete that information.

19 Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect technological advancements, new platform capabilities, or legal requirements. When updates occur, we will revise the "Last Updated" date at the top of this document and publish the revised policy at https://axeonsoft.com/privacy. For substantial changes impacting your rights, we will provide prominent notice via email or within the administrative dashboard prior to the changes taking effect. Continued use of the Platform after the effective date constitutes your acknowledgment of the updated policy.

20 Contact Information & Privacy Officer

If you have any questions, concerns, complaints, or requests regarding this Privacy Policy or our data protection practices, please contact our dedicated team: