Privacy Policy

1. Operator and Scope of Application

AXVIA operates this website and the related services. This policy covers the processing of personal data across the introductory website, the customer console, and the network connectivity, billing, identity verification, AI Use and support features you enable. Enterprise customers and their members are expected to have the right to provide the relevant data and to manage accounts and configurations according to their respective permissions. The legal and privacy contact email is [email protected].

2. Marketing website, language preferences and visit analytics

On the first visit, the marketing website matches supported languages to your browser preferences, using English if there is no match. Your manual language choice is stored in the browser’s localStorage under axvia-language until you change it or clear this site’s storage; it is not sent to the customer console. Menus, animation choices, and interface and graphic examples run only in browser memory and do not read customer APIs or production account data. The production website is delivered through Cloudflare and currently uses its cookie-free Web Analytics and email-address link protection. Network delivery, analytics and security features may process access requests, network information and security information; the analytics does not use advertising-tracking cookies. See the Cookie Policy for storage and management details, and Cloudflare Web Analytics documentation for the analytics mechanism.

3. Account and login information

Account data includes login and contact information, team and member relationships, roles, and authentication methods and session records. Password, Passkey and TOTP authentication processes are used to verify logins and sensitive operations, and the current browser session contains the authentication method and its validity period. This data is used for account access, team permission management, service notifications and account security.

4. Business information, payments and invoices

Enterprise data review and invoicing applications involve fields such as team and company name, tax information, address, phone number, bank name and account number, and billing email. Orders, payment attempts, balance transactions, renewals and invoice records are used to process transactions, provision resources, and handle accounting and disputes. When an external payment method is used, the relevant payment service processes the information needed to complete the payment.

5. Identity verification of the individual

Personal identity verification involves your name, full document number, document photo, and facial and liveness verification results. Facial verification is currently provided by a third-party service; document photos are used for OCR checking, followed by liveness detection and facial comparison against authoritative reference data. AXVIA does not additionally store the document photos, facial photos or videos from this process; the verification results and related operation records are retained for account verification and exception handling. Accounts that submitted photos through a historical document verification process may still have encrypted document archives, which are handled in accordance with the original verification purpose and applicable retention requirements. Historical document verification and current facial verification are recorded separately.

6. Node and connection configuration

Deployment and connectivity features require processing node addresses, protocols, terminal identities and keys, network configurations, and SSH, Agent or proxy access credentials. This data is used to install and maintain nodes, generate device configurations, establish connections and enforce the selected rules. SSH login credentials for bring-your-own servers and passwords for bring-your-own proxies are stored encrypted; the addresses and credentials you provide are also used for connection checks on the corresponding resources.

7. Connection, security and access records

Gateway source admission and security records include public IP, admission status, connection stage, reason, TLS characteristics, time of occurrence and count, and are used for admission decisions, protection and troubleshooting. Final Connector access records include destination domain or IP, port, protocol, upstream and downstream traffic, connection count, time, and the related member, Relay or Cloud Pulse attribution, and are used for access analysis. Node heartbeats, service status, resource observations and traffic metering records are used for operations and accounting.

8. IP geolocation and carrier information

To supplement source security records with approximate country and carrier information, the service queries ip-api for network information about public IPs and caches the query results. This involves providing the public IP to be queried to that service. Region and carrier information is used to understand the origin of connections and to investigate anomalies.

9. AI authorizations and tasks

When AI Use is enabled, the service records the authorized resources, permission scopes, validity periods and quotas for API Keys and OAuth, as well as pre-authorization, API calls, diagnostic and repair tasks, health reviews and related operations. This information is used to limit the Agent's access and execution permissions, schedule tasks and trace operations. Agents you authorize to connect may receive resource information within their permission scope via REST, OpenAPI or MCP; their operators may also process this information in accordance with your arrangements with them.

10. Operation logs and support tickets

Records of account and member operations, resource creation, service entitlements and takeover history are used to review account and resource changes. Support tickets contain the issue description, conversations, attachments, author, time and handler information you provide, and are used to process requests and follow up on issues. Before uploading screenshots or diagnostic files, please remove passwords, private keys, complete identity documents and personal data unrelated to the issue.

11. Required and optional information

Sign-in requires the relevant authentication information; enterprise review and invoice applications require the mandatory fields in the corresponding forms, and the application cannot be processed if they are not provided. BYOG and BYOC takeovers require a server address and valid SSH sign-in information, and using a bring-your-own proxy with authentication requires the relevant credentials. Facial verification requires the necessary identity information, a camera and a compatible browser. Additional explanations, screenshots and diagnostic attachments may be provided at your discretion; the absence of information relevant to the issue may affect troubleshooting.

12. Purposes and recipients

We use the information for the above services and purposes directly related to them; when using it for new purposes, we will explain and obtain any required consent in accordance with applicable requirements. Authorized AXVIA personnel and team members access the relevant information according to work needs and role permissions. Suppliers for infrastructure, authentication, payment, IP information lookup and support services process the necessary information according to the functions they perform; Agents you authorize may also receive information within the authorized scope. Where disclosure is required by law, we will handle disclosure requests in accordance with applicable law.

13. Processing locations and cross-border transfers

Website delivery, the regions where nodes are located, and suppliers for authentication, payment and network information affect where information is processed. When nodes or suppliers in different regions are used, information may be transferred across borders. AXVIA will arrange such processing in accordance with applicable requirements and will implement purpose, access, retention and security requirements in its arrangements with information processors; we do not promise that all information will be processed in a single region only. The complete list of processors, processing locations and cross-border measures will be added after verification.

14. Accuracy, retention and service exit

Please keep your contact and enterprise information up to date, and request correction if you find errors. We determine retention periods according to service purposes, transactions and legal requirements, and avoid retaining personal data longer than necessary. Terminal revocation, non-renewal and node removal each change the connection or service status and do not simultaneously delete the related transaction, audit or support records. Retention arrangements for each type of record, backups and post-cancellation deletion are set out in the schedule pending confirmation.

15. Data protection and incident handling

AXVIA will take measures appropriate to the nature of the information and the risks of the service to restrict unauthorized access, processing, loss or disclosure, and will impose corresponding protection requirements on information processors. Account authentication, re-verification for sensitive operations, team roles and Agent authorization scopes are used to restrict access; saved SSH and bring-your-own proxy passwords are protected as described above. You should protect your authentication devices, configurations and keys, and promptly disable the relevant credentials or contact support if you discover a breach. Once a security incident involving personal data is confirmed, we will notify affected individuals in accordance with applicable law and agreed requirements, and provide the necessary information that may be disclosed and assistance in responding.

16. Access, Correction and Requests

You may request access to or correction of your personal data, or make other applicable data processing requests, by contacting [email protected]. Please specify the account concerned, the scope of the data and what you would like us to do; we may need to verify your identity and authorization to avoid disclosing data to others. We will handle requests in accordance with the applicable laws of Hong Kong and explain the reasons where applicable restrictions or exceptions exist. For network or billing issues, please submit them through Help and Support in the customer console.

17. Policy Updates and Contact

When the policy is updated, we will publish the version and effective information; for material changes involving the purposes of data use or processing arrangements, we will provide explanations and handle any required consent in accordance with applicable requirements. For privacy questions and requests to access or correct personal data, please contact [email protected].

Additional notes

Supplier and Cross-Border Implementation Arrangements

Apart from the functions and suppliers already described, the complete list of data processors, the actual processing locations, sub-processing arrangements and cross-border protection measures will be supplemented once verified.

Retention, backup and deletion schedule

The specific retention and deletion periods for account, identity verification, configuration, audit, access, transaction and ticket data, as well as backup cleanup and exit procedures, still need to be confirmed according to the actual deployment and applicable requirements.