Privacy Policy

1. Who we are and what this policy covers

This policy describes personal information handled by AXIOMCLOUD PTE. LTD., a company registered in Singapore ("SandBase", "we", "us") through our website, Lab, model and data APIs, Agents, Skills, sandbox tools, billing and support. It describes our practices; it is not permission for uses of personal information that applicable law otherwise prohibits.

For account management, billing, security and our own product analytics, we determine the relevant processing purposes. Where we process your application’s end-user data solely on your instructions, a separate signed agreement may set out our processor or service-provider role. Your application and independent third-party providers may have their own privacy notices.

2. Information we receive

What we receive depends on the feature, your configuration and the information you choose to submit. It may include:

• Account information: email address, display name, profile image, sign-in provider identifier, internal user ID and workspace membership. Google or GitHub sign-in supplies the profile information authorized through that provider.
• Customer content: prompts, files, media, code, data, URLs, model inputs and outputs, Agent instructions, reports, workspace files and execution traces needed for a request or saved feature.
• Integration information: endpoints, permissions, credentials or authorization references you configure so that a requested model, API, Agent or sandbox action can run.
• Billing information: workspace balance, transactions, charges, refunds, payment status and payment-provider references. Hosted checkout is processed by providers such as Stripe or Airwallex; we do not receive or store your full card number or card security code through that checkout.
• Technical information: IP address, browser and device information, request IDs, timestamps, status and error information, model or endpoint selection, token or runtime usage and billing metadata. Depending on the feature or configuration, request or execution records may include customer content.
• Support and published information: communications you send us and content, attribution and metadata associated with resources you make public.

3. Why we process information

We process information to authenticate users, manage workspaces and permissions, execute and return requests, store resources you use, meter usage, collect payments, investigate failures, provide support, secure the Services, prevent misuse, enforce applicable policies and comply with legal obligations. We also analyze product use and service performance.

Where a privacy law requires a legal basis, the basis depends on the purpose: performing a contract or taking requested pre-contract steps; complying with legal obligations; legitimate interests in proportionate service operation, security and improvement where permitted; or consent where required. These grounds are not interchangeable, and this policy does not make consent unnecessary where law requires it.

4. Cookies, browser storage and product analytics

Authentication, active-workspace selection, security and interface settings use cookies or browser storage. Our website and Lab also use Google Analytics 4 and PostHog for page visits, navigation, feature interactions and account conversion events. Analytics can include a browser identifier, internal account ID after login, device and network information, approximate location and event timestamps. Our PostHog project is hosted in the United States.

The analytics integration is configured without automatic interaction capture, session recording, Google advertising storage or advertising personalization. Our custom analytics events do not intentionally send prompts, uploaded content, API secrets, passwords or OAuth tokens; query strings and URL fragments are removed from page and link URLs. This statement concerns analytics events, not the customer content necessarily processed by the Service to execute a request.

The current integration starts automatically unless a previously stored opt-out blocks it. Browser blocking tools may prevent some collection. A browser identifier or account ID is pseudonymous, not necessarily anonymous. Clearing cookies or changing device may change which preferences and identifiers are available. A privacy notice or ordinary continued use is not a substitute for separate consent where required.

5. Recipients and third-party processing

We disclose information necessary for a requested operation to the selected model, API, data or integration provider. If you configure your own endpoint, its operator receives the request data you direct to it. Providers may process data under their own terms and retention rules. Do not assume that all models, routes or external services have identical handling or zero-retention guarantees.

We use infrastructure and service providers for hosting, storage, network delivery, authentication, payment, security, analytics and support. Examples include Cloudflare for Lab delivery and storage, Google and GitHub for sign-in, Stripe and Airwallex for applicable checkout methods, and Google Analytics and PostHog for analytics. Resources loaded from external services, such as fonts or embedded content, may also disclose technical connection information to their operator.

Authorized workspace members may access shared resources, usage and billing information according to their permissions. We may disclose relevant records to professional advisers, in a corporate transaction subject to appropriate safeguards, to meet valid legal requirements or to protect against unlawful activity and security threats. We do not promise that upstream provider processing is covered by our controls or this policy.

6. Public Lab results and shared content

Published Lab results, reports, Agents, Skills and shared resources may reveal submitted content, generated outputs, attribution, provider or model names, cost and execution metadata depending on the feature. Some Lab features display a public default. Check the controls shown for your run before submitting confidential content or another person’s information.

Public content may be viewed, indexed, copied or downloaded by others. Removing a resource from our interface cannot remove copies, external caches or content retained by others. Workspace visibility, public visibility and sharing a direct link are different forms of access; use the controls available for the relevant feature.

7. Customer content and model development

Processing content to answer a request, debug a failure, protect the Service or retain an output is different from using it to train a model. This policy does not grant SandBase an unrestricted right to use private customer content for general-purpose model training or unrelated advertising.

Handling by an upstream model or data provider depends on that provider, the route and any applicable agreement. We cannot give a platform-wide promise that every provider retains nothing or never uses data for model improvement. Before submitting sensitive material, check the relevant provider terms and any explicit data-handling commitments for the selected service, or contact us for clarification.

8. Retention, deletion and backups

Retention depends on the record and its purpose. Account and workspace data may be retained while the account is active. Saved files, outputs, reports, task records and shared resources may remain until deleted or expired under the relevant feature. Billing, fraud-prevention and security records may be retained for legal obligations, disputes and proportionate security needs.

Deleting a visible resource or closing an account does not necessarily erase transaction records, security evidence, backups, public copies or upstream-provider records immediately. We restrict continued use where required and remove or anonymize information when it is no longer needed, subject to applicable law and technical recovery processes. We do not claim a universal retention duration, immediate deletion or an unsupported zero-retention mode.

9. International processing

SandBase and its providers may process information in countries other than where you live, including the United States for the configured PostHog project. Those countries may have different privacy laws. Applicable law may require a transfer mechanism and additional safeguards before particular data is sent abroad.

Where required, the applicable transfer arrangement must be identified in the relevant provider or customer agreement. This policy does not assert that SandBase has a certification, an adequacy status, a signed data-processing agreement or standard contractual clauses that have not been verified. Contact us before using the Services for data that requires a specified hosting region or contractual transfer protection.

10. Security and access

We apply safeguards appropriate to the operation of the Services, but no internet service or execution environment is completely secure. Credentials and integrations give access to the systems they authorize. Limit permissions, rotate exposed secrets, secure your account and review who can access your workspace.

We may verify identity or workspace authority before disclosing or changing account information. Do not include API secrets, passwords or full payment-card details in ordinary support or privacy requests. Report a suspected incident using account and request IDs and a description of the issue.

11. Privacy requests and choices

Depending on the laws that apply to you, you may have rights to access, obtain a copy of, correct or delete personal information, restrict or object to processing, withdraw consent, or complain to a competent privacy regulator. Rights and exceptions depend on the circumstances; exercising them does not authorize access to another person’s or workspace’s information.

Contact our privacy address with the request, the relevant account and the jurisdiction you are relying on. We may request proportionate verification or evidence of an authorized agent’s authority. We respond within applicable legal time limits. If a request is denied, you may ask us to review it and use any appeal rights provided by law. We do not discriminate merely because you exercise an applicable privacy right.

For content submitted through someone else’s application or workspace, contact that application provider or workspace administrator first where they control the processing. We assist with lawful customer instructions under applicable agreements. Revoking a token or closing your account does not by itself revoke access granted in an external service.

12. Children and sensitive information

Our Services are intended for adults, not children under 18. Do not knowingly create an account for a child or submit unlawful material involving children. If you believe a child’s personal information was submitted without appropriate authority, contact us so we can investigate.

Do not submit highly sensitive or regulated information, including medical records, government identifiers, payment-card data or biometric identification data, unless you have a lawful basis and have confirmed that the selected service and any agreed safeguards are suitable. An API capability alone does not mean it is approved for that category of information.

13. Policy changes and contact

We will update the date when this policy changes and provide additional notice for material changes where required. We will obtain any new consent required for a new processing purpose rather than treating the publication of this policy as that consent.

For privacy requests, contact [email protected]. For service, billing, abuse reports or other legal questions, contact [email protected]. Our operating company is registered in Singapore.