Privacy policy

1. Who we are and scope

Axiom Minds Private Limited, India, operates Axiom Proof at axiomproof.ai and the related Workbench at app.axiomproof.ai. We decide the purposes of handling website inquiries, gap-scan submissions, business contacts, and our own account and service administration information.

Where an organisation uses a client workspace to process information about its employees, customers, or other individuals, that organisation determines the purposes and provides the relevant notice. We process that information on its instructions under the applicable service agreement. Please direct requests about such records to that organisation; we can help route a request to it. This policy does not replace a customer’s privacy notice or contractual data protection terms.

Registered office: S. No. 164, Wakad, Pune City, Pune 411057, Maharashtra, India. Corporate Identity Number (CIN): U62011PN2026PTC258089.

2. Information we collect and why

• Contact inquiries: your name, email address, optional company name, message, and receipt and delivery records. We save the inquiry, review it, respond, and handle the conversation you initiate.
• Gap-scan assessment: your sector, employee band, whether your organisation processes children’s data or may be a Significant Data Fiduciary, questionnaire answers, and the resulting scores, findings, recommendations, report identifier, and assessment version. We use these to generate, save, and display your requested report.
• Optional follow-up and report delivery: the name, email address, phone number, and company you provide, together with your follow-up and marketing choices. We use these to send your report when delivery is available, arrange requested follow-up, and provide updates you opt into. Requesting an emailed report also gives us the recipient address you enter.
• Service and security records: session identifiers stored in hashed form, a protected report access token, request limits, and delivery status. These help keep reports accessible to their originating browser, prevent abuse, and investigate delivery or service problems.
• Workspace information: account and organisation details, role memberships, authentication and recovery records, connected-source metadata, reviewed classifications, findings, approvals, execution and rollback receipts, evidence, audit history and reports. Customer-authorised records and documents may contain personal information. We process these to deliver discovery, assessment, approved remediation, verification, reporting and ongoing support under the customer’s instructions. Billing and engagement correspondence support administration and required financial records.

The public gap-scan uses questionnaire answers; it does not require a document upload. Please do not include passwords, Aadhaar or other identity numbers, payment details, health records, or personal records about other people in website messages or answers. If you submit information for another person, you must have authority to do so.

Lawful processing, notices and consent

We identify the applicable lawful basis and purpose before processing. Where consent is required, we provide a clear notice identifying the personal data and specified purpose, request an affirmative choice, and provide a route to withdraw it. Optional marketing consent is separate from obtaining a requested service. We do not treat acceptance of general terms as blanket consent for unrelated processing.

Where Indian law permits processing without consent for a specified legitimate use, legal obligation or other applicable ground, we rely on that ground only within its conditions. A business interest alone is not a general substitute for consent under the DPDP Act. For customer-controlled records, the customer must establish the appropriate basis and instructions; we support it under the processing agreement.

We explain material changes of purpose and obtain fresh consent where required before the changed processing. You may request clarification or an accessible notice through our privacy contact.

3. Your choices and withdrawal

You can browse without sending an inquiry. The contact form needs a name, email, and message to receive and answer your request; company is optional. You can turn off follow-up in the gap-scan and obtain an on-screen report without providing contact details. Receiving the quarterly readiness index is a separate optional choice. The current form also uses that choice to include the readiness index in your report.

To withdraw permission for optional follow-up or marketing, email privacy@axiomminds.ai and tell us which communications to stop. Withdrawal does not affect earlier lawful processing. We may still send a response or report you specifically request, or a necessary service or security message. If you ask us to stop processing information needed for a service, we will explain which part of that service can no longer be provided.

4. Cookies and technical information

After a successful gap-scan, we set an essential first-party cookie named __session to let your browser access its saved reports. It expires seven days after it is set or renewed. It is inaccessible to page scripts and is sent securely on deployed HTTPS services. Older reports may use a cookie named gap_scan_access.

You can block or clear cookies in your browser. Doing so, or using a different browser, can prevent access to a saved report. Cookie expiry or deletion does not delete the report from our records. The public website does not include advertising pixels. Hosting and service providers may record technical request information, such as IP address, browser details, requested page, time, and errors, to deliver the site and maintain security. Workbench cookies maintain sign-in, session security and organisation selection. Blocking them may prevent workspace access. We do not use essential authentication cookies as permission for advertising.

Only if you choose “Accept analytics” in the banner on your first visit, the public website uses Google Analytics 4 to measure visits and how pages are used. It then sets first-party cookies named _ga and _ga_* (kept for up to two years) and sends Google your IP address, device and browser details, the pages you view and how you interact with them. Until you accept, no request is made to Google. If you choose “Decline”, nothing is sent. You can change your choice at any time with “Cookie settings” in the site footer; withdrawing stops further measurement and removes those cookies from this site. The Workbench does not use analytics cookies.

5. Who receives information

Authorised members of our team receive information needed to answer inquiries, provide requested follow-up, operate the service, and resolve problems. We use service providers for hosting, database storage, authentication, email, and technical support, with access appropriate to the service they provide.

If you accept analytics, Google processes the website usage information described in section 4 to provide Google Analytics to us. We use it only for aggregate measurement of the public website, not for advertising.

When email delivery is enabled, Resend processes the recipient address and message content. Contact notifications include your inquiry and contact details. Report emails include your assessment and any supplied name, company, and phone number; copies go to our sales and founder contacts for follow-up. A report sent to an address you specify is also available to that recipient and their email provider, so check the address before sending it.

We do not sell personal information. We may disclose information where required by law, to respond to lawful requests, protect people or the service, or obtain confidential professional advice. If our business is reorganised or transferred, relevant records may transfer subject to applicable privacy obligations.

6. Storage and international transfers

Our customer-data residency commitment is India for the customer workspace data plane. The service agreement identifies the deployment, approved processing locations and applicable restrictions. This policy describes that requirement; it is not independent proof of a particular deployment’s hosting or data handling. Deployment evidence and contractual commitments must be assessed for the service concerned. Website delivery, email providers, support, and recipients’ email systems may involve processing outside India; Google Analytics, when you accept it, is processed by Google outside India. An India-hosted workspace does not mean every website request or email is processed only in India. Where applicable, transfers are subject to Indian law, government restrictions, stricter sectoral requirements and appropriate contractual safeguards; we do not assume the DPDP Act permits every transfer. Customer personal records must not be sent to an external AI provider as raw values. Contact us about location requirements before submitting regulated or sensitive information.

7. How long we keep information

Inquiries and correspondence are kept for handling the request and related business records. Gap-scan answers and reports are stored so we can provide the assessment and requested follow-up. These records do not automatically expire when the seven-day browser cookie expires. You can ask us to erase your submission using the contact below.

We assess retention against the purpose, ongoing service relationship, legal requirements, and any need to resolve a dispute or security incident. Customer workspace retention follows the applicable agreement and customer instructions; evidence or audit records may have agreed or legally required retention periods. Sealed evidence may be subject to an immutable retention lock and audit history is append-only, so these records cannot simply be rewritten or deleted before the relevant restriction ends. We minimise personal information in those records and explain applicable retention restrictions; a legal hold is not permission to retain unrelated data indefinitely. Where deletion is appropriate, it may be subject to backup cycles or a lawful retention requirement. We will explain any reason we need to retain information when responding to a request.

8. Security and automated assessments

We use access restrictions, protected report access tokens, secure connections on deployed services, request validation, and abuse limits to protect the public workflows. No service can guarantee complete security. Keep your browser and emailed reports secure, and report suspected unauthorised access to our privacy contact. We investigate suspected incidents, contain them, preserve necessary evidence and cooperate with the responsible customer. We notify affected customers, individuals and competent authorities as required by the law and agreements applicable to the incident, including CERT-In requirements where applicable. A statutory reporting deadline is not postponed by an internal investigation.

The public questionnaire generates scores and recommendations using a versioned control library. Its optional sector benchmarks are editorial estimates. These automated assessments are guidance for human review and do not determine your legal rights or certify compliance. AI-assisted customer workspace processing, where enabled, is subject to that workspace’s configuration and service terms. Please obtain the relevant processing details before providing personal data for that use.

9. Children’s information

Our website forms and business services are intended for people aged 18 or older. Please do not submit a child’s personal information through public forms. The gap-scan question about children’s data asks about your organisation’s practices; it does not request records about a child. If you believe a child has submitted personal information, contact us so we can review and take appropriate action. Customer processing involving children must follow applicable law and the customer’s authorised instructions.

AI assistance, connected systems and reports

Workspace agents use authorised source information to discover and classify data, assess controls, prepare plans, verify outcomes and assemble reports. Findings and scores may be incomplete or incorrect. We show provenance and evidence limits and provide human review; scores do not decide an individual’s legal rights. Material system changes require the applicable human approval, current rehearsal and rollback checks.

Customer data is processed only within the agreed scope. Raw customer personal values must be redacted before external model egress. These terms do not authorise general-purpose third-party model training on identifiable customer records. Ask for the deployment’s processing agreement, provider details and permitted model configuration when assessing a specific service.

Reports and Pramaan closure dossiers may contain information from the customer’s records, reviewers and approval history. Access and release depend on authorised roles and required sign-offs. Recipients must handle exported reports securely; a downloaded copy is outside workspace access controls. Public verification must not be treated as permission to disclose personal or confidential report contents.

10. Privacy requests and grievances

Contact Axiom Minds Private Limited for privacy questions, withdrawal, access to information about your submission, correction, or erasure at privacy@axiomminds.ai. For a complaint, use the subject “Privacy grievance” and describe the issue and outcome you seek. You can also use our contact page to raise a privacy concern.

Grievance Officer contact: admin@axiomminds.ai, at S. No. 164, Wakad, Pune City, Pune 411057, Maharashtra, India. This is the contact published on our company privacy page. You may send a grievance directly to this address or use the privacy contact above; we route it to the responsible person.

Include the email address used for your submission and, if available, the report identifier. Do not send passwords or identity documents with your initial request. We may ask for limited information to verify that the request concerns your records. We will review the request, explain our response or any applicable limitation, and direct customer workspace requests to the responsible organisation where necessary.

We handle grievances within the period required by the law applicable to the complaint; where the 2011 sensitive personal information rules apply, that period is one month from receipt. If you are dissatisfied, reply to the same contact to seek further review. You may ask for a summary of personal data and processing, available information about sharing, correction, completion, updating or erasure, withdrawal of consent, grievance redressal and nomination of another person to exercise rights in the circumstances provided by law. Statutory rights, including nomination and complaints to the Data Protection Board, apply when the relevant DPDP provisions are in force and applicable to your processing. Where the DPDP complaint route applies, first use the Data Fiduciary’s grievance process before escalating as required by law. We will explain a refusal, retained records or an applicable exception. This policy does not restrict any available legal remedy or require excessive identity information to exercise a right.

11. Indian law and policy updates

This policy is read with applicable Indian law, including the Information Technology Act, 2000 and the 2011 rules on sensitive personal information where applicable. The Digital Personal Data Protection Act, 2023 and Rules, 2025 have phased commencement. As of this policy’s date, their principal processing duties and individual rights have not all commenced. We apply legal obligations as they take effect.

You can read MeitY’s Act commencement notification and its Rules and corrigendum. We update this policy when our practices or legal requirements change and show the new date here. Where a change requires a fresh notice or consent, we will provide it through the relevant service before that processing.