Privacy Policy

Last updated: November 11, 2026

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You.

We use Your Personal Data to run the Service and to support Your calibration program. Where the law requires Your consent for something, We ask for it separately and You can say no. Using the Service is not by itself Your consent.

This notice describes how the Service works and how We handle personal data on the date shown above. It is a notice, not a contract. Where the law allows, the limits of liability in Our Terms and Conditions apply to it. We hold no privacy certification and We have not been audited against one. Nothing here is a claim that We have been.

From version 1.8.6 the mobile apps link this Privacy Policy and Our Terms and Conditions on the sign-in screen and in Account settings.

Where Your data is stored

Axiospec runs in Amazon Web Services in the us-east-1 region, Northern Virginia, United States. The database, the uploaded evidence files, the application secrets and the application itself are all in that one region. If You use Axiospec from outside the United States then Your personal data is transferred to the United States and processed there.

The content delivery network in front of the site is a global edge network. It terminates the connection at an edge location that may be outside the United States and forwards the request to us-east-1. API responses are not cached at the edge.

The third parties We use process data in their own locations. Our Subprocessors page lists every one of them and says what each receives and why.

When We are the controller, and when We are a processor

Axiospec holds two different kinds of personal data, and Our role is not the same for both.

• Your account and Our relationship with You. Your name, Your email address, Your sign-in records, Your billing details and Our marketing to You. We decide why and how that data is processed, so We are the controller for it.

• What Your workspace puts into the product. Instrument records, calibration events, custody entries, vendor contacts, uploaded certificates and photographs, and any name a member of Your team types into a free-text field. Your organization decides what goes in and why. We hold it and act on Your organization's instructions, so Your organization is the controller and We are a processor.

If You work for an Axiospec customer and You want a record about You changed or removed, ask Your workspace administrator first. We will help them. If We cannot act without them We will say so rather than leave You waiting.

Interpretation and Definitions

Interpretation

The words whose initial letters are capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for You to access our Service or parts of our Service.

• Affiliate means an entity that controls, is controlled by, or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.

• Application refers to Axiospec, the software program provided by the Company.

• Business, for the purpose of CCPA/CPRA, refers to the Company as the legal entity that collects Consumers' personal information and determines the purposes and means of the processing of Consumers' personal information, or on behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers' personal information, that does business in the State of California.

• CCPA and/or CPRA refers to the California Consumer Privacy Act (the "CCPA") as amended by the California Privacy Rights Act of 2020 (the "CPRA").

• Company (referred to as either "the Company", "We", "Us" or "Our" in this Privacy Policy) refers to CaliTech LLC d/b/a Axiospec, a Tennessee limited liability company, 116 Agnes Rd. Ste 200, Knoxville, TN 37919, United States.

• Consumer, for the purpose of the CCPA/CPRA, means a natural person who is a California resident. A resident, as defined in the law, includes (1) every individual who is in the USA for other than a temporary or transitory purpose, and (2) every individual who is domiciled in the USA who is outside the USA for a temporary or transitory purpose.

• Cookies are small files that are placed on Your computer, mobile device or any other device by a website, containing the details of Your browsing history on that website among its many uses.

• Controller means the party that decides why and how personal data is processed.

• Data Subject means the living individual a piece of personal data is about.

• Device means any device that can access the Service such as a computer, a cell phone or a digital tablet.

• Do Not Track (DNT) is a concept that has been promoted by US regulatory authorities, in particular the U.S. Federal Trade Commission (FTC), for the Internet industry to develop and implement a mechanism for allowing internet users to control the tracking of their online activities across websites.

• Personal Data (or "Personal Information") is any information that relates to an identified or identifiable individual.

  For the purposes of the CCPA/CPRA, Personal Data means any information that identifies, relates to, describes or is capable of being associated with, or could reasonably be linked, directly or indirectly, with You.

  We use "Personal Data" and "Personal Information" interchangeably unless a law uses a specific term.

• Service refers to the Application or the Website or both.

• GDPR refers to the EU General Data Protection Regulation (Regulation (EU) 2016/679) and, where We are writing about the United Kingdom, to the UK GDPR and the Data Protection Act 2018.

• Processor means a party that processes personal data on a controller's instructions.

• Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used.

• Supervisory Authority means a public authority set up by an EEA member state or by the United Kingdom to enforce data protection law, and for Switzerland the Federal Data Protection and Information Commissioner (FDPIC).

• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).

• Website refers to Axiospec, accessible from https://axiospec.com.

• You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

• Email address
• First name and last name
• Your workspace or company name. For a one-person workspace that name is usually a personal name.
• The address, city, state, postal code and country of each site where Your instruments are kept. For a home workshop that is a home address.
• Your role in the workspace, the sites You are granted access to, and Your display preferences
• Sign-in records, including the time of Your current and previous sign-in
• The country Your connection comes from when Your account is opened (by sign-up, invitation or single sign-on) or You give Us Your email address. Our content delivery network works it out from Your IP address, and We store only the two-letter country code. When You choose a paid plan We also read it to suggest Your billing country. We do not store it then.
• If You turn on two-factor authentication: a sealed authenticator secret, hashed recovery codes, the IP address that confirmed the factor, and a label for each device You mark as trusted. That label is the browser or app identification string the device sent.
• Billing contact details. You enter those directly into Stripe's payment form and We never hold Your card number.
• A push notification token for each mobile device You sign in on. From version 1.8.6 the apps register a token only after You sign in and while notifications are allowed in the phone's settings. If You turn notifications off there, the app removes the token, at the latest the next time You open it. Earlier versions can register a token even when notifications are not allowed.
• Campaign information captured when You first arrive from a link, if You have accepted analytics on the banner: the campaign tags on the URL, a Google click identifier if the link carries one, the address of the page that referred You, and the first page You landed on
• A partner referral code, if You arrive on a link from one of Our referral partners

The product also holds personal data about people who have no Axiospec account, because Your team types it in. See "People who are not Our users" below.

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device's unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data.

We may also collect information that Your browser sends whenever You visit Our Service or when You access the Service by or through a mobile device.

Information Collected while Using the Application

While using Our Application, in order to provide features of Our Application, We may collect, with Your prior permission:

• Pictures and other information from your Device's camera and photo library

We use this information to provide features of Our Service, to improve and customize Our Service. The information may be uploaded to the Company's servers and/or a Service Provider's server or it may be simply stored on Your device.

You can enable or disable access to this information at any time, through Your Device settings.

Tracking Technologies and Cookies

We use Cookies and similar technologies, such as browser storage and scripts, to store certain information and, if You allow analytics, to measure how Our Service is used. Without cookies or anything stored on Your device, Our website counts page views, clicks and downloads, recording only the action and the page address, under Our legitimate interest in improving the site. In more detail:

• Cookies or Browser Cookies. A cookie is a small file placed on Your Device. You can instruct Your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if You do not accept Cookies, You may not be able to use some parts of our Service.
• Web Beacons. Our emails contain no web beacons or tracking pixels, and We do not track whether You open them. On the website and in the web app, the Google Analytics tag described below counts visits only after You select Accept.

Cookies can be "Persistent" or "Session" Cookies. Persistent Cookies remain on Your personal computer or mobile device when You go offline, while Session Cookies are deleted as soon as You close Your web browser.

Where required by law, we use non-essential cookies (such as analytics cookies) only with Your consent. You can withdraw or change Your consent at any time by selecting "Cookie settings" in the footer of Our website or in the account menu of the application, or through Your browser/device settings. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

We use both Session and Persistent Cookies for the purposes set out below:

• Strictly necessary storage

  Type: browser local storage, held on Your device

  Administered by: Us

  Purpose: Your session token is issued by Our own API and held in Your browser's local storage. It is what keeps You signed in. The same storage holds Your workspace identifier, Your role and Your display preferences so the app can render correctly. Clearing this site's stored data in Your browser signs You out and removes all of it.

• Your cookie choice

  Type: browser local storage, held on Your device

  Administered by: Us

  Purpose: records whether You chose Accept or Decline on the banner, so You are not asked again on every page.

• Trusted device token

  Type: browser local storage, held on Your device

  Administered by: Us

  Purpose: if You turn on two-factor authentication and mark a device as trusted, this token is what lets that device skip the second factor. It is a persistent identifier for the device. You can revoke it from Settings, and You should on any shared computer.

• Partner referral code

  Type: browser local storage, held on Your device

  Administered by: Us

  Purpose: a link from one of Our referral partners carries the partner's code. The code gives You the partner's discount at sign-up and tells Us which partner to pay. If Your connection comes from the United States, one of its territories or Canada, We store the code when You arrive and keep it for 90 days. Everywhere else We store it only after You select Accept, and then keep it for 90 days. Until then the code travels only in the links on Our pages during Your visit, and the sign-up form fills it in from the link. The code is also part of the page address, so Google Analytics receives it once You select Accept, and Sentry receives it with an error report from that page.

• Analytics

  Type: cookies set by Google (_ga and _ga_MC4VJC06M8), plus campaign information in local storage

  Administered by: Google (Google Analytics 4) and Us

  Purpose: to understand how people find the site and which parts of the product get used. We also run a small Google Ads campaign on the Axiospec brand name. No ad tag, conversion pixel or remarketing tag loads on the site or in the app. Our Google Analytics property is linked to that Google Ads account. So once You allow analytics, Google Analytics may share conversion measurements with it, such as whether a visit from an ad led to a sign-up. Ads personalization is switched off on that link. Google sets its cookies only after You select Accept. They last 2 years after Your last visit, unless You withdraw, which deletes them.

• Google sign-in button

  Type: a script loaded from Google on the sign-in and sign-up pages

  Administered by: Google (Google Identity Services)

  Purpose: shows the Google sign-in button. The sign-in and sign-up pages first show Our own Google button, and the script loads only when You press it. Loading it shows Google Your IP address and browser details. Google may read or set its own cookies on its own domain. We receive nothing from it unless You choose to sign in with Google.

How to change Your choice: select "Cookie settings" in the footer of Our website or in the account menu of the application. The banner opens again with the same two choices, and a new answer replaces the old one.

Our Cookie Policy lists each cookie and each item of browser storage, who sets it, when, and how long it lasts.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain our Service, including to monitor the usage of our Service.

• To manage Your Account: to manage Your registration as a user of the Service. The Personal Data You provide can give You access to different functionalities of the Service that are available to You as a registered user.

• For the performance of a contract: the development, compliance and undertaking of the purchase contract for the products, items or services You have purchased or of any other contract with Us through the Service.

• To contact You: by email, and by push notification in the mobile apps, about updates or informative communications related to the functionalities, products or contracted services, including the security updates, when necessary or reasonable for their implementation.

• To send You product and marketing email: tips, trial updates and check-in emails, and the emails You asked for when You gave Us Your address, on the terms set out under "Email Marketing" below.

• To manage Your requests: To attend and manage Your requests to Us.

• For business transfers: We may use Your Personal Data to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Us about our Service users is among the assets transferred.

• For other purposes: We may use Your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our Service, products, services, marketing and your experience.

We may share Your Personal Data in the following situations:

• With Service Providers: We may share Your Personal Data with Service Providers to monitor and analyze the use of our Service, for payment processing, to contact You.
• For business transfers: We may share or transfer Your Personal Data in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.
• With other users: other people in Your workspace can see Your name, the records You create there and, depending on their role, Your email address.
• With Your consent: We may disclose Your Personal Data for any other purpose with Your consent.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations (for example, if We are required to retain Your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

Where possible, We apply shorter retention periods and/or reduce identifiability by deleting, aggregating, or anonymizing data. Unless otherwise stated, the retention periods below are maximum periods ("up to") and We may delete or anonymize data sooner when it is no longer needed for the relevant purpose. We apply different retention periods to different categories of Personal Data based on the purpose of processing and legal obligations:

• Your account

  • Kept for as long as the account is open. There is no age rule that deletes an account for being quiet, and an account that is never closed is kept indefinitely. That is deliberate, because a calibration register is a compliance record a customer may need years later.
  • When You ask Us to close the account, sign-in stops at once and billing is cancelled at once. The data is then kept for 730 days, about 24 months, so You can sign back in, export Your records, or change Your mind. After that window it is purged.
  • If You want it erased sooner than 730 days, say so and We will do it by hand. See "How to exercise Your rights".

• Calibration and instrument records, and the names attached to them

  • Kept for as long as the workspace exists, then purged with the workspace at the end of the 730-day window. We apply no age rule to them. They are Your organization's compliance evidence and an assessor may ask for history going back years.

• Support and feedback correspondence

  • Support runs by email, and the in-product feedback form is emailed to Us rather than stored in the product. Messages You send Us live in Our mailbox. That includes requests You make under this notice and reports of illegal content. We delete a thread 24 months after its last message. We do that by hand once a quarter, so a thread can stay up to three months longer. If You want a message You sent Us deleted sooner, ask and We will delete it. Our servers also email Us an alert when someone opens an account, with the name, the email address and the workspace name. They also send one when a workspace sends Us files to migrate, with the sender's email address, the file names and any note, one when a workspace is suspended under US export control and sanctions law, and one when the files a workspace has stored pass a size We watch, with the workspace name. These alerts follow the same rule. An alert about someone who gave Us their email address without opening an account names them by a code, not by the address.

• Application and server logs

  • These are kept in Amazon CloudWatch for 30 days and then deleted. Our servers now write a short code in place of an email address: the first 10 characters of a SHA-256 hash of the address. The hash uses no secret key, so anyone who already knows an address can work out its code. That makes the code a pseudonym, not an anonymous value. Lines written before that change can hold an email address, mostly one used at sign-up, in an invitation or for an account deletion email, and any address that an error message repeated. They are deleted on the same 30-day rule, so the last of them goes in early November 2026. A log line cannot be picked out and deleted on request before its 30 days run out. Our infrastructure audit trail is separate and expires after 365 days. Requests that reach Our servers from India are also copied to a separate log and kept for 180 days, as the Notice for India below describes.

• Cached replies to recent requests

  • Some saves from the mobile app and Our public API carry a key that lets a repeated request be recognised. Our server keeps the reply to such a save for 7 days so that a repeat is not applied twice. A reply can hold names and email addresses, for example of the people in a workspace. It is deleted at the first daily clean-up after its 7 days.

• Website analytics

  • Held by Google under the retention settings on Our Google Analytics property. Event data is kept for 2 months, the shortest period Google offers. User-level data is kept for 14 months, and that period starts again when a returning visitor is seen.

• Error reports

  • Sentry keeps each error report for 30 days and then deletes it.

• Android app analytics

  • Android app versions before 1.8.3 sent app usage events to Google's Firebase Analytics. From version 1.8.3 collection is off. In October 2026 We deleted the app's Google Analytics properties. Google erases a deleted property and its data within 35 days.

• Marketing contacts

  • If You give Us Your email address without opening an account, for example to get the checklist, We first send one email that asks You to confirm. If You do not confirm, We delete the address after 30 days. If You confirm, We send what You asked for during the six months after Your latest request or confirmation, and We delete the address 12 months after those six months end. Within a day of an unsubscribe We replace the address with a SHA-256 hash of it, which lets Us recognise the address and not write to it again without keeping the address itself. We keep that hash for as long as We send marketing email. Ask Us to delete it outright and We will remove it by hand. There is no self-service control for that today.

• Addresses Our email service will not write to

  • If an email to an address bounced or was marked as spam, Amazon SES keeps the address on Our suppression list so that We do not write to it again. It stays there for as long as We send email through Amazon SES.

• Sign-up source details

  • If You accepted analytics on the banner before You opened a workspace, the campaign information on Your device is saved with the workspace when You sign up: the campaign tags, a Google click identifier, the address of the referring page and the first page You landed on, for Your first and Your latest visit. 90 days after sign-up We keep only three campaign tags, utm_source, utm_medium and utm_campaign, and delete the rest. If You select Decline on the banner, or withdraw Your consent, while You are signed in, We delete the copy saved with Your workspace. We deleted every copy saved before 7 October 2026 from the database. The last backup that holds one is removed by late October 2026.

• Database backups and earlier file versions

  • The database is backed up every day. Each backup is kept for 14 days and is removed within two days after that.
  • A stored file that is overwritten or deleted is kept as an earlier version for up to 14 days and is removed within two days after that.

• Payments and tax

  • Card details are never stored on Our servers. They are entered directly into Our payment processor. We keep transaction records, invoices and purchase history for up to 10 years to meet tax and accounting obligations.
  • Where We owe a commission or a tax filing to a referral partner, the records that prove it are kept for the same reason, including the partner's legal name and contact address. Closing a workspace does not remove those, because they are Our own financial records rather than the workspace's.

• Records of requests

  • When You erase Your data yourself, or an administrator downloads the personal data a workspace holds, We keep a record of the request for six years from the request. It holds the type of request, what was done, the user and workspace identifiers, and a SHA-256 hash of the email address, not the address itself. It shows that We handled the request.

• Workspace purge records

  • When We purge a workspace, Our internal audit trail keeps one entry with the workspace's identifier, its name and how many records were deleted. It shows that the purge happened. It is kept for six years, then deleted.

Usage Data is retained in accordance with the retention periods described above, and may be retained longer only where necessary for security, fraud prevention, or legal compliance.

We may retain Personal Data beyond the periods stated above for different reasons:

• Legal obligation: We are required by law to retain specific data (e.g., financial records for tax authorities).
• Legal claims: Data is necessary to establish, exercise, or defend legal claims.
• Your explicit request: You ask Us to retain specific information.
• Technical limitations: Data exists in backup systems that are scheduled for routine deletion.

You may request information about how long We will retain Your Personal Data by contacting Us.

When retention periods expire, We securely delete or anonymize Personal Data according to the following procedures:

• Deletion: Personal Data is removed from Our systems and no longer actively processed.
• Backup retention: Residual copies may remain in encrypted backups for a limited period consistent with our backup retention schedule and are not restored except where necessary for security, disaster recovery, or legal compliance.
• Anonymization: In some cases, We convert Personal Data into anonymous statistical data that cannot be linked back to You. This anonymized data may be retained indefinitely for research and analytics.

Transfer of Your Personal Data

CaliTech LLC is a United States company and the Service runs in the United States, in AWS us-east-1. Using Axiospec from anywhere else means Your personal data is transferred to the United States and processed there. Several of Our subprocessors operate globally and may process data in other countries. Our Subprocessors page names each one.

Data held in the United States can be accessed by US courts, law enforcement and national security authorities under US law. For people in Quebec, this means Your personal information is communicated outside Quebec. Our Subprocessors page explains how We handle a request from a government authority.

Be clear about what that means today for a transfer out of the European Economic Area, the United Kingdom or Switzerland. See the section below for people in those places, which sets out what is in force and what is not.

Delete Your Personal Data

You can delete Your account from inside the product. Sign in, then open Settings and the Profile tab, or use the Delete Account link in the footer. The page is at /account/delete, and from version 1.8.6 the mobile apps link to it from Account settings. You confirm with Your password, or with a code We email You if Your account has no password. If two-factor authentication is on, You also give a two-factor code. If You own the workspace You also type the workspace name, because that request closes the workspace for everybody in it.

What happens next: sign-in stops immediately, billing is cancelled immediately, and the data is held for 730 days so You can come back and export it. After that it is purged. Signing back in during the window cancels the deletion.

What the purge reaches: it removes the workspace records from the database, and it removes the files stored for the workspace. Those are the documents attached to an instrument, every attachment and photograph on a calibration record, the files You uploaded for an import, issued certificate PDFs, audit archives, instrument photographs, the workspace logo and any files You sent Us for a white-glove migration.

You can also correct most of Your own details from Settings. Ask Us and We will do it for You.

Some things survive a deletion on purpose. Billing and tax records, records of money We owe a referral partner, and the names frozen into completed calibration records are all kept, and the section below for the European Economic Area and the United Kingdom explains the calibration one in full. Backups roll off on their own schedule and are not restored except for recovery or a legal requirement.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of Users of the Service or the public
• Protect against legal liability

Security of Your Personal Data

We protect Your Personal Data with these measures:

• Every connection uses HTTPS with TLS 1.2 or later, and the database accepts only encrypted connections.
• The database, file storage and stored secrets are encrypted at rest.
• The database cannot be reached from the internet. Storage buckets block public access, and a web application firewall sits in front of the site.
• Passwords are stored only as salted hashes. Two-factor authentication is available, and repeated failed sign-ins slow down.
• The server checks the role and the workspace of the person behind every request, and keeps each workspace's records apart from every other workspace.
• Completed calibration records cannot be edited or deleted through the application or the API, and each one is chained to the one before it with a SHA-256 hash. The database role the application runs as, which We hold, can switch that protection off. A change made that way can be detected against a head record hash exported earlier, but it is not impossible.
• Changes in a workspace are written to its activity log. Activity in Our cloud account is logged and kept for 365 days.
• The database is backed up every day, and backups are kept for 14 days.
• Alarms tell Us about errors and failed background jobs.

Only one person, the owner of CaliTech LLC, has access to production data. We hold no security certification, and no outside firm has tested the Service for weaknesses. Our Data Processing Agreement lists the measures in more detail, including what is not in place. No way of sending or storing data over the internet is completely secure, so We cannot guarantee that Your data will never be accessed without permission.

Detailed Information on the Processing of Your Personal Data

The Service Providers We use may have access to Your Personal Data. They process it on Our behalf, under data processing terms with Us. Some also use it for their own purposes, under their own terms. For example, Stripe uses payment details under its own privacy policy, and so does Link for sales in Mexico and for sales in India to buyers without a GSTIN. Google uses the device details ML Kit sends from Android app versions before 1.8.6 for its own diagnostics. Apple does too, with the device token and alert text of iPhone push notifications.

Analytics

We may use third-party Service Providers to monitor and analyze the use of our Service.

• Google Analytics

  Google Analytics is a web analytics service offered by Google. It runs only after You allow analytics on the banner. It receives page paths, interaction events, an identifier Google assigns to Your browser, and Your IP address. Our Google Analytics property is linked to Our Google Ads account, so it may share conversion measurements with that account. Ads personalization is switched off on that link.

  To stop it, select Decline on the banner, or change Your choice later under "Cookie settings".

  For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy

• Firebase

  Firebase is a Google service. We use Firebase Cloud Messaging to deliver push notifications to Your device. Our own servers send those messages, so Your device push token and the text of the notification are processed by Google. That text names an instrument and says it is due, overdue or quarantined. It does not name the person who quarantined it. On an iPhone, Google passes the message to Apple Push Notification service, which every iPhone app has to use for push notifications, so Apple also receives the device token and the text. From version 1.8.3 Firebase Analytics collection in Our Android app is switched off. Those versions send no analytics events. Versions before 1.8.3 send app usage events until they are updated. Since 7 October 2026 the minimum app version is 1.8.6, so an older version asks to be updated before it can be used. We do not use Firebase to sign You in or to hold Your account credentials.

  We also encourage You to review Google's policy for safeguarding Your data: https://support.google.com/analytics/answer/6004245

  For more information on what type of information Firebase collects, please visit the How Google uses data when you use our partners' sites or apps webpage: https://policies.google.com/technologies/partner-sites

How We see which parts of the app are used

When You are signed in, We record on which days You used Axiospec and which parts of it You opened, such as instruments, calibrations, labels or billing. We do not record what You typed, which records You opened or Your IP address, and We use no cookies for this. We use it only to improve the product, under Our legitimate interest. We never sell it or share it with anyone. It is kept for 13 months, then deleted. You can object by emailing support@axiospec.com.

Email Marketing

We send account holders tips, trial updates and check-in emails, and We send people who gave Us their email address without opening an account the emails they asked for. Outside the United States and Canada, and wherever We cannot tell where You are, an account holder gets tips, trial updates and check-in emails only after ticking the box at sign-up or turning them on in their email preferences. In the United States and Canada they come unless You tick the box at sign-up to say no. You can stop any of these emails at any time with the link in each one, in Your email preferences, or by contacting Us.

We may use Email Marketing Service Providers to manage and send emails to You.

• Amazon Web Services (AWS)

  Their Privacy Policy can be viewed at https://aws.amazon.com/privacy/

Error and performance monitoring

• Sentry

  We use Sentry, run by Functional Software, Inc., to catch errors on the website, in the web app, on Our servers and in the mobile apps. Sentry keeps each report for 30 days. Your IP address reaches Sentry with a report that Your browser or phone sends, and We have set Sentry not to store IP addresses. Reports Sentry received on or before 7 October 2026 can still hold an IP address, a browser string and, in a report from Our servers, a name or an email address from the request. Sentry deletes the last of them in early November 2026. What each part sends:

  • The website and the web app send a report only when an error happens. It holds the error, the stack trace, the page address, Your browser and system, and the steps that led up to it, such as pages opened, clicks, network requests and console messages. If You are signed in it holds Your internal user identifier, and no name or email field. An email address can still reach Sentry if it is part of an error message or a page address.
  • Our servers send the error, the stack trace, the path of the request and the log lines just before it. If You are signed in, they also send Your internal user identifier and Your workspace identifier. They send no request bodies, no local variables, no performance traces and not Your IP address. Before a report leaves, email addresses are replaced with a code, and fields that hold a name or an email address are removed.
  • From version 1.8.6 the mobile apps send crash and error reports only, with no session tracking and no performance traces. Before a report leaves, they replace each email address and any value filed under a name or email field. A name written elsewhere in a message is not recognised. You can stop the reports by turning off Send crash reports in the app's Settings. It stays on until You turn it off. On an iPhone, Sentry's library still reads the phone's identifierForVendor while Send crash reports is on, and the app removes the code Sentry makes from it before a report leaves. The iPhone app no longer records the addresses of its network requests.
  • Versions before 1.8.6 send crash and error reports with the device model, the system version, a random identifier for the installation and, on an iPhone, a code that Sentry makes from the phone's identifierForVendor, and they do not remove email addresses first. On an iPhone they also record the addresses of the app's network requests, which can include links to files Your organization uploaded. They also tell Sentry each time the app starts, and the Android app sends performance traces for about one in five measured operations. They have no switch to stop this.

  For people in Switzerland: the mobile apps keep a report and the installation identifier on the phone until the report is sent, and on an iPhone Sentry's library reads the phone's identifierForVendor. From version 1.8.6 You can refuse this with the Send crash reports switch.

  Their Privacy Policy can be viewed at https://sentry.io/privacy/

Voice dictation in the mobile apps

The mobile apps let You dictate calibration readings instead of typing them. When You press the microphone button, the app hands the audio to Your phone's own speech recognition service. On Android that is the service set on the phone, which on most phones is Google's. On iPhone it is Apple's. That service may send the audio to its provider to turn it into text, under the terms between You and that provider. It is not Our service and We never receive the audio, only the text that comes back. Nothing is recorded unless You press the microphone button. From version 1.8.6 the app tells You this the first time You press it.

Scanning labels in the mobile apps

The mobile apps read the QR code or barcode on an instrument label with the phone's camera, and the image stays on the phone. On iPhone the phone's own camera software reads the code. Android app versions before 1.8.6 read it with Google's ML Kit. ML Kit works on the phone, but it also sends Google details about the device and the app and an identifier for that installation, for Google's own diagnostics and usage statistics. Those versions do this without asking You. From version 1.8.6 the Android app reads codes on the phone with the open-source ZXing decoder, and scanning sends nothing to Google.

Payments

We may provide paid products and/or services within the Service. In that case, we may use third-party services for payment processing (e.g. payment processors).

We will not store or collect Your payment card details. That information is provided directly to Our third-party payment processors whose use of Your personal information is governed by their Privacy Policy. These payment processors adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, Mastercard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of payment information.

• Stripe

  Their Privacy Policy can be viewed at https://stripe.com/us/privacy

Notice for the European Economic Area, the United Kingdom and Switzerland

This section applies if You are in the European Economic Area, which includes Iceland, Liechtenstein and Norway, or in the United Kingdom or Switzerland. It sits alongside the rest of this notice. Where the two disagree, this section governs for people in those places.

Who is responsible

See "When We are the controller, and when We are a processor" near the top of this notice. In short, We are the controller for Your account and Our relationship with You, and a processor for what Your workspace records in the product.

CaliTech LLC is not required to appoint a data protection officer under the GDPR and has not appointed one. Privacy questions sent to support@axiospec.com reach the owner of the company directly. For Brazil, see the section on the LGPD below.

Our representative in the European Economic Area, in the United Kingdom and in Switzerland, under Article 27 of the GDPR, Article 27 of the UK GDPR and Article 14 of the Swiss Federal Act on Data Protection, is DataRep. You and the supervisory authorities can contact DataRep in addition to Us or instead of Us, on any matter about Our processing of Your Personal Data, including to exercise Your rights. Email datarequest@datarep.com and put "Axiospec" in the subject line, or use the web form at www.datarep.com/data-request. For the European Economic Area You can also write to DataRep at 77 Camden Street Lower, Dublin, D02 XE80, Ireland. For the United Kingdom the address is 107-111 Fleet Street, London, EC4A 2AB, United Kingdom, and for Switzerland it is Leutschenbachstrasse 95, 8050 Zürich, Switzerland. If You write by post, mark the letter for the attention of DataRep, not Axiospec, or it may not reach DataRep. Refer clearly to Axiospec in the letter.

CaliTech LLC is registered with the UK Information Commissioner's Office. Its registration reference is ZC266846.

What We process, why, and on what legal basis

This table covers the data We process as controller. The last row covers the data Your organization controls.

What We process	Why	Legal basis
Name, email address, password hash, role, site grants, sign-in records	To open and run Your account and keep it working	Performance of a contract, Article 6(1)(b)
Two-factor secret and recovery codes, the IP address that confirmed the factor, trusted device labels, sign-in failure counters	To stop someone else getting into Your account	Legitimate interests in securing the Service, Article 6(1)(f)
Billing contact details and transaction records	To take payment and to meet tax and accounting rules	Performance of a contract, Article 6(1)(b), and legal obligation, Article 6(1)(c)
Service email: team invitations, calibration reminders, email verification, account notices, including the notices that a trial is about to end or has ended	To deliver the Service You asked for	Performance of a contract, Article 6(1)(b)
Product email to account holders: tips, trial updates and check-in emails. That is tips for getting set up, trial updates and a check-in if Your account goes quiet. If You said no, the notices that a trial is about to end or has ended still reach You, without an offer.	To help You get value from the Service and to tell You about it	Consent, Article 6(1)(a). You give it by ticking the box at sign-up or by turning these emails on in Your email preferences. You can withdraw it at any time there or with the link in each email. In the United States and Canada the box at sign-up is one You tick to say no, and there We rely on legitimate interests in helping account holders use the Service, Article 6(1)(f).
Marketing email where You gave Us Your address without opening an account	To tell You about Axiospec	Consent, Article 6(1)(a). One click unsubscribes.
The country Your connection comes from	To refuse new accounts and email sign-ups from countries We do not serve, to apply the email rule Your country's law calls for (the box at sign-up, or the same rule when You join by invitation or single sign-on), and to suggest Your billing country when You choose a paid plan, without storing it then	Legitimate interests in offering the Service only where We can meet local law, in asking for consent where that law requires it, and in a quicker checkout, Article 6(1)(f)
Website analytics	To see how people find the site and which parts get used	Consent, Article 6(1)(a), given on the banner. Nothing is requested from Google and nothing is stored until You accept.
The action and the page address of each page view, click and download on Our website	To count page views, clicks and downloads without cookies	Legitimate interests in improving the site, Article 6(1)(f). Nothing is stored on Your device.
The campaign information stored on Your device when You arrive from a link, including a Google click identifier and the address You came from	To see which links and campaigns bring people to the site	Consent, Article 6(1)(a). The capture runs only after You accept on the banner. No answer is treated as a refusal.
The Google sign-in script on the sign-in and sign-up pages	To show the Google sign-in button	Legitimate interests in offering sign-in with Google, Article 6(1)(f). It loads only when You press the Google button.
Product analytics in the Android app (Firebase Analytics)	To see which parts of the Android app get used	We have no basis that holds without consent. From version 1.8.3 collection is switched off and the app sends nothing. Versions before 1.8.3 send these events without asking for consent until they are updated. Since 7 October 2026 the minimum app version is 1.8.6, so an older version asks to be updated before it can be used. In October 2026 We deleted the app's Google Analytics properties.
Device and app details and an installation identifier that Google's ML Kit sends from Android app versions before 1.8.6	Google's own diagnostics and usage statistics for ML Kit, which reads labels	We have no basis that holds without consent, and those versions do not ask for it. That is why version 1.8.6 removes ML Kit. Since 7 October 2026 those versions ask to be updated before they can be used.
Application error and crash reports	To find and fix faults	Legitimate interests in a working, secure product, Article 6(1)(f), for the reports themselves. App versions before 1.8.6 also send session tracking, Android performance traces and, on an iPhone, a code made from the phone's identifierForVendor. Those are not needed to report a fault, and those versions do not ask for consent, so We have no basis that holds for them. Version 1.8.6 stops sending them. Since 7 October 2026 those versions ask to be updated before they can be used.
Server and access logs, including IP addresses	To keep the Service running and to investigate abuse	Legitimate interests in security and availability, Article 6(1)(f). The note below the table covers older log lines.
Mobile push notification tokens and the text of each alert	To send the app's alerts, which are on unless You switch them off	Performance of a contract, Article 6(1)(b), from 7 October 2026. To stop the alerts, switch off Push notifications in the app's Notification settings. Before version 1.8.6, turning notifications off in the phone's settings only hides them. From version 1.8.6 that also stops the sending, at the latest from the next time You open the app, and signing out stops it too.
Dictation in the mobile apps	To fill in a reading from what You say when You press the microphone	We receive only the text, which becomes part of Your organization's records (last row). The audio goes from Your phone to the phone's own speech service, not to Us.
Messages You send Us by email or through the feedback form, and Our replies	To answer You and to fix what You report	Performance of a contract, Article 6(1)(b), when You are a customer and the message is about Your account or the Service. Otherwise legitimate interests in answering the people who write to Us, Article 6(1)(f).
A referral partner's name, contact details, tax forms and payout details	To run the referral partner program and pay commission	Performance of a contract, Article 6(1)(b). For a partner in the European Economic Area, the United Kingdom or Switzerland, the US tax forms rest on legitimate interests in meeting US tax rules, Article 6(1)(f).
Which workspace a referral partner referred, and the payments that workspace makes	To pay the partner the commission it earned	Legitimate interests in paying Our partners correctly, Article 6(1)(f). A partner's statement shows a reference code for each workspace it referred, the status of the referral, the commission it earned and how many paid months have counted, with totals and counts. It names no workspace and no person.
The billing country and address You give at checkout, a partner's tax country, and the suspension of a workspace	To meet US export control and sanctions law	Legitimate interests in meeting the US law that binds CaliTech LLC, Article 6(1)(f). See "Checks under US export control and sanctions law" below.
Records of the requests You make under this notice, and Our answers	To show that We answered, and when	Legal obligation, Article 6(1)(c), with Articles 5(2) and 12 of the GDPR
Reports of illegal content, and Our decisions on them	To handle each report and tell the people involved	Legal obligation under Article 16 of the EU Digital Services Act, Article 6(1)(c)
Instrument records, calibration events, custody entries, vendor contacts, uploaded files, and any name typed into a free-text field	Whatever Your organization records it for	Your organization sets the basis. We process it on their instructions.

Where We rely on legitimate interests We have written down the interest, why the processing is necessary for it, and whether it overrides You. Those assessments sit in Our internal record of processing activities and We will share the relevant part on request.

One of them found a problem with Our server and application logs. Email addresses were written into log lines in readable form, mostly ones used at sign-up, in invitations and for account deletion emails, but also any address that an error message repeated. The logs were kept for 365 days, and a single log line cannot be picked out and deleted on request. That went further than the interest needs. Our servers now write a short code in place of an email address, and We now keep logs for 30 days. The exception is the copy of each request from India and its log lines, which We keep for 180 days, as the Notice for India below describes. The lines written before that change are used only for security and to find faults, and only the owner of the company can read them. The last of them is deleted in early November 2026. With those limits, the assessment supports keeping them until then.

No analytics request reaches Google before You answer the banner. The analytics tag is not requested, and no campaign information is written to Your device, until You select "Accept". There is no regional starting position: analytics storage is off everywhere, whatever Your location, until You turn it on. No answer is treated as a refusal. The one item of non-essential storage We keep before You answer is a partner referral code, and only when Your connection comes from the United States, one of its territories or Canada. If You later withdraw, We tell Google Your choice has changed and delete the analytics cookies already on Your device, though We cannot recall information sent before You withdrew. The sign-in and sign-up pages (/login and /signup) do not load Google's sign-in script when they open. It loads only when You press the Google button. The section "Tracking Technologies and Cookies" above sets it out in full.

What You must give Us, and what happens if You do not

To open an account We need Your name, Your email address and a password, or an account with a sign-in provider such as Google instead of the password. If You sign up for a company, We also need the company name. To buy a paid plan We also need Your billing country (in Canada, also Your province or territory) and payment details, which You give to Stripe, and in some countries a business tax number. No law obliges You to give Us these details. We need them to enter into the contract with You. If You do not give them, We cannot open the account or sell You the plan. Everything else on the sign-up form, such as a partner code or how You heard about Us, is optional, and leaving it out changes nothing.

Checks under US export control and sanctions law

CaliTech LLC is a US company, and US export control and sanctions law binds it. So We check where Our customers and partners are:

• When a paid plan is bought, We compare the billing country You chose with the address You type into Stripe's form. We check the address again when it changes later, for example in the billing portal. If the address is in a country or region where We do not sell, or a business tax number is missing where one is required, We flag the workspace for a person to review. A flag changes nothing in the workspace.
• If the billing address is in Cuba, Iran, North Korea or Syria, the workspace is suspended automatically and We are told by email. Nothing is cancelled or refunded automatically, and a person reviews every suspension.
• A referral partner cannot be enrolled with its tax country in Cuba, Iran, North Korea, Syria, Russia, Belarus or Egypt.

Our legal basis is legitimate interests in meeting the US law that binds Us, Article 6(1)(f). If Your workspace is suspended and You think that is a mistake, write to support@axiospec.com. A person will look at it and tell You the outcome. We do not currently send names to any government screening service, and We will update this policy before We do.

International transfers

Your personal data is transferred to the United States and held in AWS us-east-1. This is the position today:

• For the data a workspace puts into Axiospec, We act as a processor under Our Data Processing Agreement. It is part of Our Terms and Conditions and needs no separate signature. It incorporates the EU Standard Contractual Clauses (Module Two, controller to processor), with Module Three (processor to processor) for a customer that is itself a processor, the UK International Data Transfer Addendum and the changes the Swiss data protection authority requires.
• For that data We act only on the customer's instructions, so the GDPR applies to the customer as controller. That is the case these clauses were written for. For the data We control Ourselves, such as Your account, the GDPR applies to Us directly and these clauses are not used. The next section explains how that data is transferred.
• CaliTech LLC is not certified under the EU-US Data Privacy Framework or its UK extension.
• CaliTech LLC offers no EU or UK data region.

We would rather tell You that plainly than let You assume more from a page of reassuring language.

Transfers of the data We control

When You give Us data directly, for example by signing up, using the Service or writing to Us, You send it to Us in the United States Yourself. That is not a transfer under the GDPR, the UK GDPR or the Swiss data protection law. A transfer happens when We pass data We control to another company. These are the companies, where they process the data, and the basis for each transfer from the European Economic Area, the United Kingdom and Switzerland:

Recipient	Where	Basis
Amazon Web Services, Inc., for hosting and email	United States, with content delivery edge locations worldwide	The Data Privacy Framework
Stripe, LLC, for payments	United States, and the countries of the service providers Stripe lists	The Data Privacy Framework
Functional Software, Inc. (Sentry), for error reports	United States	The Data Privacy Framework
Google LLC, for analytics, Google sign-in, push notifications, Our mailbox and Android app components	Google data centers and Google Cloud locations, which Google lists at datacenters.google/locations and cloud.google.com/about/locations	The Data Privacy Framework
GitHub, Inc., for source code and deployment, with no customer data	United States	The Data Privacy Framework
Apple Inc., for push notifications on an iPhone	Not published by Apple	Article 49(1)(b) of the GDPR and of the UK GDPR, and Article 17(1)(b) of the Swiss Federal Act on Data Protection: the transfer is needed to deliver to Your iPhone the app's alerts, which are on unless You switch them off. Apple is not in the Data Privacy Framework and We have no data protection terms with it. Switching off Push notifications in the app stops it.
Mercury Technologies, Inc., for partner payouts	United States	No transfer: We use Mercury only to pay partners in the United States
The banks that carry an international wire, for partner payouts outside the United States	The partner's country and the banks on the route	Article 49(1)(b) of the GDPR and of the UK GDPR, and Article 17(1)(b) of the Swiss Federal Act on Data Protection: the transfer is needed to pay the partner under its contract with Us

"The Data Privacy Framework" means the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), its UK Extension (The Data Protection (Adequacy) (United States of America) Regulations 2023, SI 2023/1028) and the Swiss-US Data Privacy Framework (Annex 1 to the Swiss Data Protection Ordinance). On 5 October 2026 We looked up each company in that column on the Data Privacy Framework List. Each was active under all three. Amazon Web Services, Inc. is covered by the entry for Amazon.com, Inc.

Your rights

If the GDPR applies to You then You have the right to:

• Be told what We hold about You and why. That is what this notice is for.
• Get a copy of Your personal data.
• Have it corrected if it is wrong or incomplete.
• Have it erased, subject to the limits set out below.
• Restrict how We use it while a dispute about it is being worked out.
• Take it with You in a machine-readable form, where We process it by consent or under a contract and by automated means.
• Object to processing We base on legitimate interests, and to direct marketing at any time. See "Your right to object" above.
• Withdraw consent where consent is what We relied on. That does not make the earlier processing unlawful.
• Complain to a supervisory authority.

You will never be charged for exercising a right and You will never be treated worse for it.

How to exercise Your rights

• Deleting Your account. Sign in and go to /account/delete, reachable from Settings and from the footer. The section "Delete Your Personal Data" above sets out exactly what happens and when.

• Getting a copy of Your workspace's records. Managers, administrators and auditors can generate a complete audit archive from inside the product at any time. It is a ZIP of open-format files: a CSV manifest, a PDF report, Your original uploaded evidence, and written instructions for verifying the record chain without Us.

• Getting a copy of the personal data Your workspace holds. An administrator of the workspace can sign in, go to /account/data, reachable from Settings, and confirm with their password, or with a code We email them if their account has no password. If two-factor authentication is on, they also give a two-factor code. The download is a ZIP of JSON and CSV files covering the personal data the workspace holds. It covers everyone in the workspace, so a member who is not an administrator cannot download it. If that is You, ask an administrator of Your workspace, or email support@axiospec.com and We will handle Your request. Our Data Export Formats page lists every export.

• Erasure sooner than the 730-day window. Sign in and go to /account/data, confirm with Your password, or with a code We email You if Your account has no password, and erase it yourself. The page lists what goes and what stays before You confirm. If You are the last remaining administrator of a workspace the page says so, because erasing You would leave it with nobody who can run it. Email support@axiospec.com in that case. If You are an administrator of Your workspace, an erasure also deletes the sign-up source details recorded when the workspace was created: the ad click identifier, the referring page, the landing page and the campaign tags.

• Anything else. Email support@axiospec.com. Tell Us what You want and give Us enough detail to find Your records.

We will verify who You are before We act, because handing someone else's data to the wrong person is the worse failure. We answer within one month of verifying You. If a request is complicated We may take up to two further months, and if We do We will tell You why inside the first month.

People in France: Your data after Your death

If You live in France, including its overseas regions and territories, You can give Us directives on what happens to Your personal data after Your death. They can say whether We keep it, erase it or pass it on, and You can name a person to carry them out. You can also tell Us whether to pass Your data to a third party You choose. Send Your directives to support@axiospec.com. You can change or withdraw them at any time. Without directives, We keep and delete Your data as this notice describes, and Your heirs can exercise some of Your rights as French law allows. This follows Article 85 of the French Data Protection Act (Law No. 78-17 of 6 January 1978).

What We keep even after an erasure request

Some things survive, and each has a reason.

• Names frozen into completed calibration records. When a calibration is committed, the name of the person who performed it and the name of anyone who reviewed it are written into an append-only ledger and folded into a SHA-256 chain, where each record's hash covers the one before it. That chain is what makes the record tamper-evident, and tamper-evidence is the whole point of the register. Removing a name from a committed record breaks the chain for every record after it.

  We treat this as processing that is necessary for the establishment, exercise or defence of legal claims and for compliance with a legal obligation resting on the workspace, which is the limit on erasure in Article 17(3). That position has not been tested by a regulator, and We say so rather than present it as settled. If You ask, We will tell You exactly which records carry Your name and We will stop using them for anything beyond keeping the record intact.

• Your name and email inside a workspace that carries on without You. If an administrator removes You from a team, Your account is switched off and Your details stay in the workspace's own records. A custody entry records the name of whoever held an instrument. A message log records the address a reminder was sent to. An administrative record of Your invitation or of a change to Your email address holds the address as it was. An audit archive records the email of whoever asked for it, and a gage study records the email of whoever created it. When You erase Your data yourself, or Your own account deletion completes, Your sign-in, password, API keys, linked sign-in providers, calendar feed link and device tokens are deleted. In the records above, each value that is exactly Your name or one of Your email addresses is then replaced or removed. That includes an earlier address of Yours that the workspace's activity log records, for example from Your invitation or a change of address, unless another account uses it today. A name You used before a change is not recorded, so it stays where it was written. Free text that mentions You stays as written.

  Ask Us and We will tell You which records carry Your details, and remove the ones that can be removed without breaking a committed calibration record. Today that is done by hand.

• Billing, tax and partner payment records. Kept because the law requires it. Up to 10 years. Stripe, Our payment processor, also keeps the customer record made for Your workspace's checkout. For a billing country in the European Union or the United Kingdom, or Quebec as the billing province, Our server makes that record when checkout opens, with the email address of the person who opened it. Otherwise Stripe makes it when a checkout is completed. It holds that email address and any billing name and address entered there, even if nothing was ever paid. Deleting the workspace cancels any subscription. When the workspace is purged, We delete that record from Stripe if the workspace never paid. If it paid, the record stays with Stripe with the billing records, for up to 10 years.

• Backups. Residual copies sit in encrypted database backups until the backup is removed, 14 days after it was made plus up to two days. A stored file that is overwritten or deleted stays as an earlier version for up to 14 days, plus up to two days. Neither is restored except for disaster recovery or a legal requirement.

• Server logs. Our application logs in Amazon CloudWatch are kept for 30 days, and a single line cannot be deleted on request. Lines written before 6 October 2026, 01:00 UTC can hold Your email address, and the last of them is deleted in early November 2026. Newer lines carry a code made from the address instead. A copy of each request from India is kept longer, as the next item says.

• Requests from India. For each request that reaches Our servers from India, We keep a second copy of the request and its log lines for 180 days, also in Amazon CloudWatch. A single copy cannot be deleted on request before its 180 days run out. The Notice for India below says what it holds.

• The record of a sign-up from India. If You opened Your account from India, We keep the separate record made at sign-up for 5 years after Your workspace is deleted for good, even if You ask Us to erase Your account. We keep it to meet direction (v) of India's CERT-In Directions. The Notice for India below lists what it holds.

• Cached replies. A reply Our server keeps so that a repeated request is not applied twice can hold Your name and email address. It is deleted at the first daily clean-up after 7 days.

• Error reports. Sentry deletes each report after 30 days. A report sent from a browser or a phone can hold an email address that was part of an error message or a page address, and one received on or before 7 October 2026 can also hold an IP address.

• The record that You unsubscribed. If You unsubscribed from Our marketing email, We keep a SHA-256 hash of the address, not the address, so that We do not write to it again.

• Our email service's suppression list. If an email to Your address bounced or was marked as spam, Amazon SES keeps the address on that list, as set out under "Retention of Your Personal Data".

• Email already delivered. An email We sent cannot be recalled from the mailbox it reached.

• Your phone or tablet. A phone or tablet that was signed in keeps a local copy of Your workspace's data until You sign out of the app or remove it.

• Alerts in Our mailbox. The alert Our servers emailed Us when You opened Your account, or when Your workspace sent Us files to migrate, stays in Our mailbox for 24 months after the last message in its thread, plus up to three months for the quarterly clean-up. Messages You sent Us, including feedback from the product, follow the same rule. Ask Us and We will delete them sooner.

• The record of Your request. If You erase Your data yourself, We keep the record of that request for six years, as set out under "Retention of Your Personal Data". It holds Your user identifier and a hash of Your email address, not the address.

• Our record of a workspace purge. The entry described under "Retention of Your Personal Data" keeps the workspace's name for six years. If the workspace was named after You, it holds Your name.

Automated decisions

One automated decision can affect You significantly: the suspension described under "Checks under US export control and sanctions law" above. A workspace whose billing address is in Cuba, Iran, North Korea or Syria is suspended without a person deciding first. You can ask for a person to review it, give Your point of view and contest it, at support@axiospec.com. Axiospec makes no other automated decision that produces a legal effect on You or affects You in a similarly significant way, and does no profiling of that kind. A calibration due date is arithmetic on the interval Your workspace set. It is a calculation about an instrument, not a judgement about a person.

People who are not Our users

A workspace can record personal data about people who have no Axiospec account. In practice that means:

• a named contact at an outside calibration laboratory, with their work email address and phone number
• extra email addresses a workspace adds so that calibration reminders reach someone beyond the account holders
• a person named in a free-text field, such as an instrument's assignee, its department, or a note on a custody entry
• a person who happens to be visible in an uploaded photograph of a bench or an instrument

That data is entered by the workspace, not by Us. The workspace decided to collect it and is the controller for it. We are the processor.

If You think an Axiospec workspace holds data about You and You want it corrected or removed, write to support@axiospec.com with enough detail to find the record. We will identify the workspace, pass Your request to it, and tell You what happened. We will not hand Your request to a workspace that has nothing about You in it.

Complaining

You can complain to the data protection authority for the place You live or work, or where You think the problem happened. In the United Kingdom that is the Information Commissioner's Office. We would rather You came to Us first, at support@axiospec.com, so We can fix it. Coming to Us first is not a condition of complaining.

Complaints in the United Kingdom

Under UK law You can complain to Us about how We use Your personal data. Send Your complaint to support@axiospec.com. We acknowledge it within 30 days of receiving it. We then look into it and tell You the outcome without undue delay.

If You are not satisfied with Our answer, You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

Notice for Canada and Quebec

This section applies if You are in Canada. It sits alongside the rest of this notice.

The person in charge of personal information

CaliTech LLC is responsible for protecting the personal information We hold. It is a one-person company, and its Owner and Managing Member handles that information for it. In Quebec, this is the person in charge of the protection of personal information. You can reach that person at support@axiospec.com, or by post at the address under "Contact Us".

How We govern personal information

The same person decides what We collect, who can see it, how long We keep it and when it is destroyed. How long each kind of data is kept, and how it is deleted, is set out under "Retention of Your Personal Data" and "Delete Your Personal Data" above. Our subprocessors receive only what Our Subprocessors page lists.

To make a complaint, write to support@axiospec.com. We acknowledge a complaint within 30 days, look into it, and give You a written answer. We answer a request to access or correct Your personal information within 30 days of receiving it.

Complaining to an authority in Canada

In Quebec You can complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca). Elsewhere in Canada You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Notice for Brazil (LGPD)

This section applies if You are in Brazil. It sits alongside the rest of this notice and applies the Lei Geral de Proteção de Dados Pessoais (Law 13.709/2018).

Legal bases

The table in the section for the European Economic Area lists what We process and why. Under the LGPD those purposes rest on these bases:

• Performance of a contract (Art. 7, V): Your account, billing, service email, push notifications, support for customers and the referral partner program.
• Compliance with a legal obligation (Art. 7, II): tax and accounting records, and records of the requests You make under this notice.
• Legitimate interests (Art. 7, IX): account security, error reports, server logs, the country Your connection comes from, the Google sign-in script, analytics in Android app versions before 1.8.3, support email from people who are not customers, linking a referred workspace to its partner, and the checks under US export control and sanctions law.
• Consent (Art. 7, I): website analytics, campaign information, product email to account holders and marketing email to people without an account.

Your rights under the LGPD

Under Art. 18 You can ask Us to confirm that We process Your data and to give You access to it. You can ask Us to correct it, and to anonymize, block or delete data that is unnecessary or excessive. You can ask for it in a portable form, and ask Us to delete data We process with Your consent. You can ask who We share it with, and what happens if You refuse consent. You can withdraw consent at any time and object to processing.

Use the self-service pages described above, or email support@axiospec.com. We give a full answer to a request for access within 15 days. You can also petition the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

Transfer to the United States

Your data is collected directly into the United States and processed there, in AWS us-east-1.

Data protection officer (encarregado)

CaliTech LLC relies on the small processing agent exemption in ANPD Resolution CD/ANPD No. 2 of 27 January 2022. Article 11 of that resolution exempts a small processing agent from appointing an encarregado if it offers a communication channel with data subjects. Our channel is support@axiospec.com, answered by the Owner and Managing Member.

Access records

Our application and server logs are kept for 30 days and then deleted.

Notice for Chile, Costa Rica, Peru, Mexico and Colombia

This section applies if You are in one of these countries. It sits alongside the rest of this notice. The controller for Your account data is CaliTech LLC d/b/a Axiospec, 116 Agnes Rd. Ste 200, Knoxville, TN 37919, United States, support@axiospec.com.

Chile

From 1 December 2026, Law 21.719 applies to how We process data about people in Chile. The controller is CaliTech LLC d/b/a Axiospec, at the address above. Its legal representative is Timothy Malone, Owner and Managing Member. CaliTech LLC has no domicile in Chile, so for anything about Your data, including a message from the Agencia de Protección de Datos Personales, write to support@axiospec.com. The version of this notice is the date at the top of this Privacy Policy. We process the data listed under "Types of Data Collected", for the purposes and on the legal bases in the table above: contract, legal obligation, legitimate interests and consent. It goes to the providers on Our Subprocessors page, and to authorities where the law requires it. Your data is transferred to the United States and stored in AWS us-east-1. How long We keep each kind of data is set out under "Retention of Your Personal Data". You have the right to access, correct and delete Your data, to object to its processing, to ask Us to block it, and to receive it in a portable form. Email support@axiospec.com to use these rights. We protect Your data with encryption in transit and at rest, a database that accepts no connection from the public internet, and daily backups. You can complain to the Agencia de Protección de Datos Personales. You also have the right not to be subject to a decision based only on automated processing that significantly affects You. The one such decision We make is described under "Automated decisions", and You can ask for a person to review it.

Costa Rica

Law No. 8968 on the Protection of the Person in the Processing of Personal Data applies to how We process personal data about people in Costa Rica, as far as it reaches Us. Your data goes into Our database of account holders, held by CaliTech LLC d/b/a Axiospec at the address above. We use it for the purposes under "Use of Your Personal Data". The providers on Our Subprocessors page receive what that page says, for the purposes it gives. Your data is transferred to the United States and stored in AWS us-east-1. Your name and email address are needed to open an account. If You do not give them, We cannot open one. Other details are up to You. You have the right to access Your data and to have it corrected or deleted. Email support@axiospec.com. You can complain to the Agencia de Protección de Datos de los Habitantes (PRODHAB).

Peru

CaliTech LLC is its own representative for Peru under Article VII of Supreme Decree 016-2024-JUS. The representative's contact email is support@axiospec.com. Write to that address to exercise Your rights of access, rectification, cancellation and objection. Your data is transferred to the United States and stored in AWS us-east-1. You can complain to the Autoridad Nacional de Protección de Datos Personales.

Mexico

This is Our privacy notice (aviso de privacidad) for Mexico under the Federal Law on the Protection of Personal Data Held by Private Parties.

• Who We are: CaliTech LLC d/b/a Axiospec, at the address above.
• What We process: the data listed under "Types of Data Collected". We do not process sensitive personal data.
• Why: to run Your account, provide the Service, take payment and keep it secure. These purposes need no separate consent. Product email, marketing email and website analytics are secondary purposes, and You can refuse them.
• How to limit use: turn off product email in Your email preferences, use the unsubscribe link in any marketing email, and select Decline under "Cookie settings".
• Your ARCO rights: to access, rectify, cancel or oppose, email support@axiospec.com. We answer within 20 days.
• Changes: We post changes on this page and update the date at the top. Before a material change takes effect, We tell You by email or with a notice on the Service.

The companies on Our Subprocessors page act on Our behalf. We do not transfer Your data to any other third party unless the law allows it without Your consent. You can complain to the Secretaría Anticorrupción y Buen Gobierno.

If You buy a paid plan with a billing address in Mexico, the sale is made through Link, a service of Stripe that acts as the merchant of record. Link collects Your name, email address, billing address and payment details on its checkout page, and Your phone number if You save Your details with Link. It uses them to take the payment, send the receipts and invoices and handle the tax. It handles them under its own privacy policy. We give Link Your email address, the plan You chose, an identifier for Your workspace, the billing country You chose and, if a referral partner sent You, that partner's reference. This transfer is needed for the purchase You ask for, so it does not need Your separate consent.

Colombia

Under Law 1581 of 2012 You can know, update and correct Your data. You can ask for proof of Your authorization, ask how Your data is used, withdraw Your authorization or ask Us to delete Your data, and access it free of charge. When You open a new workspace from Colombia, the sign-up form asks for Your authorization. We keep the version of the form You accepted and the time, as proof of it. The purposes are those under "Use of Your Personal Data" and in the table above. Send requests to support@axiospec.com. We answer a query within 10 business days and a claim within 15 business days. You can complain to the Superintendencia de Industria y Comercio. The controller is CaliTech LLC d/b/a Axiospec, at the address above, support@axiospec.com, phone +1 615 796 6373. Our database of personal data stays in force for as long as We provide the Service, and each record in it is kept for the period set out under "Retention of Your Personal Data". This part of the notice applies from 26 September 2026.

Notice for Thailand and the Philippines

This section applies if You are in one of these countries. It sits alongside the rest of this notice. The controller for Your account data is CaliTech LLC d/b/a Axiospec, 116 Agnes Rd. Ste 200, Knoxville, TN 37919, United States, support@axiospec.com.

Thailand

The Personal Data Protection Act B.E. 2562 (2019) applies to how We process data about people in Thailand. The purposes and legal bases are those in the table in the section for the European Economic Area. How long We keep each kind of data is set out earlier in this notice. You have the right to access Your data and get a copy, to have it sent to another controller, to object to its processing, to ask Us to delete, destroy or anonymize it, to restrict its use, to have it corrected, and to withdraw Your consent at any time. Email support@axiospec.com to use these rights. You can also post Your request to Us, or deliver it in person, at CaliTech LLC d/b/a Axiospec, 116 Agnes Rd. Ste 200, Knoxville, TN 37919, United States. Someone You authorize can make the request for You. Your data is transferred to the United States and stored in AWS us-east-1, because that is where the Service runs. The transfer is needed to perform Our contract with You. You can complain to the Personal Data Protection Committee.

A request to access Your data or get a copy of it, or to learn how We obtained data that You did not consent to, follows the Personal Data Protection Committee's notification of 2026 (B.E. 2569) on access and copy requests. The rest of this paragraph applies to all three kinds of request. The request must be signed by You or by the person You authorize, even if it is sent by email. We accept an electronic signature. If You post or email the request, include a copy of an official identity document that You have signed as a true copy. If You deliver it in person, show Us the original instead. If someone You authorize makes the request, it also needs a power of attorney that states what it authorizes. The power of attorney must be signed by You and by them and stamped as Thai law requires. Add a copy of Your identity document that You have signed as a true copy. Their own identity document follows the same rule as Yours. We check the request and who made it within 15 days of receiving it. If a detail or document is missing or wrong, or We cannot confirm that the request was made by You or by the person You authorize, We tell the person who made it, in writing or by email. That person then has at least 10 days to complete or correct the request or its documents. If that is not done in time, We treat the request as withdrawn and tell them so. You can still make it again. We act on a complete request without delay and within 30 days of receiving it. If it covers a large amount of data, or for another necessary reason, We can take up to 30 more days, and We tell You why. If We refuse it, We tell You the reason. We keep a record of each request, its documents and what We did for at least 2 years.

The Philippines

The Data Privacy Act of 2012 (Republic Act No. 10173) applies to how We process data about people in the Philippines. You have the right to be informed, to access Your data, to object to its processing, to have it corrected, to have it erased or blocked, to receive it in a portable form, and to be compensated for damage caused by inaccurate, incomplete, outdated, false or unlawfully obtained data, or by its unauthorized use. Email support@axiospec.com to use these rights. Your data is transferred to the United States and stored in AWS us-east-1. We remain responsible for it there. You can complain to the National Privacy Commission.

Notice for India

This section applies if You are in India. It sits alongside the rest of this notice. The controller for Your account data is CaliTech LLC d/b/a Axiospec, 116 Agnes Rd. Ste 200, Knoxville, TN 37919, United States, support@axiospec.com.

Grievance Officer

Our Grievance Officer is Timothy Malone, Owner and Managing Member of CaliTech LLC. Write to support@axiospec.com, or by post to the address above. We acknowledge a grievance within 24 hours and resolve it within 15 days of receiving it.

What We keep for the CERT-In Directions

India's CERT-In Directions of 28 April 2022 apply to Us as a provider of services to users in India. When You open an account from India, We ask for Your organization's address and a contact phone number. We keep them in a separate record with Your name and email address, whether You signed up as an individual or a company, and Your organization's name. The record also holds the IP address and time of the sign-up, how You signed up (with a password, Google or Microsoft), the version of the sign-up terms You accepted, and Our internal codes for Your account and workspace. We keep this record for 5 years after Your workspace is deleted for good, even if You ask Us to erase Your account. When that deletion happens, We add its date to the record. We do this to meet direction (v) of the Directions.

For each request that reaches Our servers from India, We keep a record for 180 days. It holds the time, the path requested, the result, the IP address, the browser or app identifier, and the log lines Our servers wrote while answering, with email addresses replaced by a code. These records are stored in the United States, in AWS us-east-1. We give them to CERT-In only when it asks or when We report an incident to it. Our other logs are kept for 30 days, as described above.

If a cyber incident affects You, We report it to CERT-In within 6 hours of noticing it.

Buying without a GSTIN

If You buy a paid plan with a billing address in India and have no GSTIN, the sale is made through Link, a service of Stripe that acts as the merchant of record. Link collects Your name, email address, billing address and payment details on its checkout page, and Your phone number if You save Your details with Link. It uses them to take the payment, send the receipts and invoices and handle the GST. It handles them under its own privacy policy. We give Link Your email address, the plan You chose, an identifier for Your workspace, the billing country You chose and, if a referral partner sent You, that partner's reference. We may also tell Link which language to show its checkout page in. This transfer is needed for the purchase You ask for.

Your rights and the transfer

You can ask Us to show You, correct or update the information We hold about You, and You can withdraw a consent You gave. Email support@axiospec.com. Your data is collected directly into the United States and processed there, in AWS us-east-1. We store Your password only as a one-way hash.

Notice for Sri Lanka

This section applies if You are in Sri Lanka. It sits alongside the rest of this notice. The controller for Your account data is CaliTech LLC d/b/a Axiospec, 116 Agnes Rd. Ste 200, Knoxville, TN 37919, United States, support@axiospec.com.

The Personal Data Protection Act No. 9 of 2022, as amended by Act No. 22 of 2025, applies to how We process data about people in Sri Lanka. We follow it now, before all of its parts are in force. The purposes and legal bases are those in the table in the section for the European Economic Area. You have the right to access Your data, to withdraw Your consent, to ask Us to stop processing that rests on Our legitimate interests, to have Your data corrected or completed, and to have it erased in the cases the Act sets out. Write to support@axiospec.com to use these rights. We answer in writing without undue delay and within one month of receiving Your request. If We need more time, We can take up to two more months. We then tell You so, with the reason, before the first month ends. If We refuse, We tell You why, and that You can appeal the refusal to the Data Protection Authority of Sri Lanka.

Your data is transferred to the United States and stored in AWS us-east-1, because that is where the Service runs. The transfer is needed to perform Our contract with You.

Notice for Asia-Pacific

This section applies if You are in Japan, South Korea, Taiwan, Hong Kong, New Zealand, Tokelau, Australia, Norfolk Island, the Cocos (Keeling) Islands or Christmas Island. It sits alongside the rest of this notice. The controller for Your account data is CaliTech LLC d/b/a Axiospec, 116 Agnes Rd. Ste 200, Knoxville, TN 37919, United States, support@axiospec.com.

Japan

Japan's Act on the Protection of Personal Information applies to how We handle personal information about people in Japan. The business operator is CaliTech LLC d/b/a Axiospec, at the address above. Its representative is Timothy Malone, Owner and Managing Member. We use Your personal information for the purposes under "Use of Your Personal Data" and in the table in the section for the European Economic Area.

You can ask Us to tell You the purposes for which We use Your personal data, to disclose it to You with the records of any provision of it to a third party, to correct, add to or delete it, and to stop using it or providing it to a third party. Email support@axiospec.com. We charge no fee. We may ask You to confirm who You are. Send any complaint about how We handle Your personal information to the same address. You can also contact the Personal Information Protection Commission (ppc.go.jp).

How We keep Your personal data secure: We keep a written record of how We process personal data and a written breach notification procedure. Within CaliTech LLC, only the owner handles personal data, and the owner is bound to keep it confidential. Data is encrypted in transit and at rest. The database is not reachable from the internet, and every storage bucket blocks public access. Annex B of Our Data Processing Agreement lists the measures in full.

Your personal information is transferred to the United States and processed there, in AWS us-east-1, by Us and by the providers on Our Subprocessors page. Google may also process it in the other countries where it has data centers, and Stripe in the countries of the service providers it lists. Amazon Web Services carries it through content delivery locations around the world. The Subprocessors page names these countries and lists. Google and Stripe choose the country, so We cannot tell You in advance which one holds a given item. On an iPhone, Apple Inc. also receives the push notification token and the text of each alert. When You open a new workspace from Japan, the sign-up form asks You to agree to this transfer. The United States has no single federal law on personal information like Japan's Act. Some federal laws cover particular sectors, several states have their own privacy laws, and the Federal Trade Commission can act against unfair or deceptive practices. US authorities can obtain data held in the United States under US law. Each provider on Our Subprocessors page is bound by written data protection terms. Apple is not, and We have no such terms with it. To stop alerts reaching Apple, switch off Push notifications in the app's Notification settings.

South Korea

Korea's Personal Information Protection Act applies to how We process personal information about people in South Korea. Our Chief Privacy Officer is Timothy Malone, Owner and Managing Member of CaliTech LLC. Write to support@axiospec.com, or by post to the address above.

You can ask to access Your personal information, to have it corrected or deleted, and to have its processing suspended. You can withdraw a consent You gave. Email support@axiospec.com. We answer within 10 days of receiving Your request. If You think Your rights were infringed, You can also apply to the Personal Information Dispute Mediation Committee (kopico.go.kr) or report to the Personal Information Infringement Report Center of the Korea Internet and Security Agency (privacy.kisa.or.kr, phone 118). We send no marketing email to an account opened, or an email address given to Us, from a connection in South Korea. If You are in South Korea and receive one, write to support@axiospec.com and We stop it at once.

Your personal information is transferred outside Korea as the table below sets out. The transfer is needed to perform Our contract with You, because the Service runs only in the United States. Website analytics are the exception. They reach Google only if You select Accept on the banner, and that transfer rests on that consent.

Recipient and contact	Country	What is transferred	When and how	Purpose	How long the recipient keeps it
Amazon Web Services, Inc. Privacy contact: the "Contacts, Notices, and Revisions" part of aws.amazon.com/privacy	United States, with content delivery edge locations worldwide	Everything in Your account and workspace, and the email We send You	Continuously while You use the Service, over encrypted connections	Hosting the Service and sending email	As long as Your account exists, then for the periods under "Retention of Your Personal Data"
Stripe, LLC. Privacy contact: dpo@stripe.com	United States, and the countries of the service providers Stripe lists at stripe.com/legal/service-providers	Your billing email address, a workspace identifier, and the cardholder name, billing address and card details You type into Stripe's form	When You buy or change a paid plan, through Stripe's own form	Taking payment and issuing invoices	As long as the law requires payment records to be kept
Functional Software, Inc. (Sentry). Privacy contact: compliance@sentry.io	United States	Error reports with the error, the page address or request path, Your browser and system, Your internal user and workspace identifiers, and any email address inside an error message. Your IP address reaches Sentry with a report from Your browser or phone, and Sentry is set not to store it.	When an error happens, over encrypted connections	Finding and fixing faults	30 days
Google LLC. Privacy contact: support.google.com/policies	United States and the other countries where Google has data centers	What You send Us by email, the alerts Our servers send to Our own mailbox, push notification tokens and alert texts, the Google sign-in step if You use it, and website analytics only if You accept them	When You email Us, when an alert or a push notification is sent, and when You use the website, over encrypted connections	Email, push notifications, sign-in and website analytics	Until the purpose is met or Our contract with Google ends
Apple Inc. Privacy contact: apple.com/legal/privacy/contact	Not published by Apple. Apple Inc. is based in the United States.	The push notification token of Your iPhone and the text of each alert	When an alert is sent to Your iPhone	Delivering push notifications	Until the purpose is met, as Apple's own terms say

You can refuse the transfer of website analytics to Google by selecting Decline on the banner. You can refuse the transfer to Apple by switching off Push notifications in the app's Notification settings. You can refuse the rest only by not opening an account, or by deleting it. We then cannot provide the Service to You.

Taiwan

Taiwan's Personal Data Protection Act applies to how We collect and use personal data about people in Taiwan. We are CaliTech LLC d/b/a Axiospec, at the address above. We collect the data listed under "Types of Data Collected", for the purposes under "Use of Your Personal Data". We use it for as long as Your account exists and then for the periods under "Retention of Your Personal Data". We use it in the United States, where the Service runs. The providers on Our Subprocessors page receive what that page says, for the purposes it gives, in the countries it names. On an iPhone, Apple also receives the push notification token and the text of each alert. You can ask Us to let You review Your data or give You a copy, to add to or correct it, to stop collecting, processing or using it, and to delete it. Email support@axiospec.com. Your name and email address are needed to open an account. If You do not give them, We cannot open one.

Hong Kong

The Personal Data (Privacy) Ordinance applies to how We collect and use personal data about people in Hong Kong. We use Your data for the purposes under "Use of Your Personal Data". You must give Us Your name and email address to open an account. If You do not, We cannot open one. Other details are up to You. We may transfer Your data to these classes of persons: the organization whose workspace You use and the other people in it (see "With other users"), the service providers on Our Subprocessors page, Apple for push notifications on an iPhone, a buyer or successor of Our business (see "Business Transactions"), and courts, law enforcement and other authorities where the law requires it. You have the right to ask for access to Your data and to ask Us to correct it. Send Your request to the Owner and Managing Member at support@axiospec.com. You can complain to the Privacy Commissioner for Personal Data (pcpd.org.hk). We send no marketing email to an account opened, or an email address given to Us, from a connection in Hong Kong. If You are in Hong Kong and receive one, write to support@axiospec.com and We stop it at once.

New Zealand and Tokelau

New Zealand's Privacy Act 2020 applies to how We collect and hold personal information about people in New Zealand, and We follow it for people in Tokelau too. We, CaliTech LLC d/b/a Axiospec, at the address above, collect and hold Your information. We collect it for the purposes under "Use of Your Personal Data", and the providers on Our Subprocessors page receive what that page says. No law requires You to give it to Us, but without Your name and email address We cannot open an account. You have the right to ask for access to Your information and to ask Us to correct it. Email support@axiospec.com. If You are not satisfied with Our answer, You can complain to the Office of the Privacy Commissioner.

Australia

This Privacy Policy applies to people in Australia, Norfolk Island, the Cocos (Keeling) Islands and Christmas Island as it is written. You can ask Us for access to Your personal information, or ask Us to correct it, at support@axiospec.com.

Notice for the Middle East

This section applies if You are in the United Arab Emirates or Qatar. It sits alongside the rest of this notice. The controller for Your account data is CaliTech LLC d/b/a Axiospec, 116 Agnes Rd. Ste 200, Knoxville, TN 37919, United States, support@axiospec.com.

United Arab Emirates

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies to how We process personal data about people in the United Arab Emirates. The purposes and legal bases are those in the table in the section for the European Economic Area. You have the right to receive information about Your data and a copy of it, to have it corrected or erased, to restrict or stop its processing, to object to it, and to have it sent to another controller. Email support@axiospec.com. Your data is transferred to the United States and stored in AWS us-east-1, because that is where the Service runs. You can complain to the UAE Data Office.

Qatar

Law No. 13 of 2016 on Personal Data Privacy Protection applies to how We process personal data about people in Qatar. We process Your data for the purposes under "Use of Your Personal Data". You have the right to withdraw a consent You gave, to object to processing, to ask Us to erase or correct Your data, to be told about its processing, and to get a copy of it. Email support@axiospec.com. Your data is transferred to the United States and stored in AWS us-east-1, because that is where the Service runs. We send no marketing email to an account opened, or an email address given to Us, from a connection in Qatar. If You are in Qatar and receive one, write to support@axiospec.com and We stop it at once. You can complain to the National Data Privacy Office.

CCPA/CPRA Privacy Notice (California Privacy Rights)

This privacy notice section for California residents supplements the information contained in Our Privacy Policy and it applies solely to all visitors, users, and others who reside in the State of California.

Categories of Personal Information Collected

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or Device. The following is a list of categories of personal information which We may collect or may have been collected from California residents within the last twelve (12) months.

Please note that the categories and examples provided in the list below are those defined in the CCPA/CPRA. This does not mean that all examples of that category of personal information were in fact collected by Us, but reflects our good faith belief to the best of Our knowledge that some of that information from the applicable category may be and may have been collected. For example, certain categories of Personal Information would only be collected if You provided such personal information directly to Us.

• Category A: Identifiers.

  Examples: A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, driver's license number, passport number, or other similar identifiers.

  Collected: Yes.

• Category B: Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).

  Examples: A name, signature, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.

  Some personal information included in this category may overlap with other categories.

  Collected: Yes.

• Category C: Protected classification characteristics under California or federal law.

  Examples: Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).

  Collected: No.

• Category D: Commercial information.

  Examples: Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

  Collected: Yes.

• Category E: Biometric information.

  Examples: Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.

  Collected: No.

• Category F: Internet or other similar network activity.

  Examples: Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.

  Collected: Yes.

• Category G: Geolocation data.

  Examples: Approximate physical location, physical location or movements.

  Collected: Yes. Only the country Your connection comes from, worked out from Your IP address when Your account is opened or You give Us Your email address. When You choose a paid plan We also read it to suggest Your billing country, without storing it.

• Category H: Sensory data.

  Examples: Audio, electronic, visual, thermal, olfactory, or similar information.

  Collected: No.

• Category I: Professional or employment-related information.

  Examples: Current or past job history or performance evaluations.

  Collected: No.

• Category J: Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).

  Examples: education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.

  Collected: No.

• Category K: Inferences drawn from other personal information.

  Examples: Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

  Collected: No.

• Category L: Sensitive personal information.

  Examples: Government-issued identifying numbers, financial account details, genetic data, precise geolocation, race or ethnicity, religious or philosophical beliefs, union membership, mail, email, text messages, biometric data, health data, and sexual orientation or sex life.

  Collected: No.

Under CCPA/CPRA, Personal Information does not include:

• Publicly available information from government records
• Deidentified or aggregated consumer information
• Information excluded from the CCPA/CPRA's scope, such as:
  • Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data
  • Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994

Sources of Personal Information

We obtain the categories of personal information listed above from the following categories of sources:

• Directly from You. For example, from the forms You complete on our Service, preferences You express or provide through our Service, or from Your purchases on our Service.
• Indirectly from You. For example, from observing Your activity on our Service.
• Automatically from You. For example, through cookies We or our Service Providers set on Your Device as You navigate through our Service.
• From Service Providers. For example, third-party vendors to monitor and analyze the use of our Service, third-party vendors for payment processing, or other third-party vendors that We use to provide the Service to You.

Use of Personal Information

We may use or disclose personal information We collect for "business purposes" or "commercial purposes" (as defined under the CCPA/CPRA), which may include the following examples:

• To operate our Service and provide You with Our Service.
• To provide You with support and to respond to Your inquiries, including to investigate and address Your concerns and monitor and improve our Service.
• To fulfill or meet the reason You provided the information. For example, if You share Your contact information to ask a question about our Service, We will use that personal information to respond to Your inquiry. If You provide Your personal information to purchase a product or service, We will use that information to process Your payment and facilitate delivery.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described to You when collecting Your personal information or as otherwise set forth in the CCPA/CPRA.
• For internal administrative and auditing purposes.
• To detect security incidents and protect against malicious, deceptive, fraudulent or illegal activity, including, when necessary, to prosecute those responsible for such activities.
• Other purposes consistent with the context in which the information was collected, or as otherwise disclosed to You at the time of collection.

Please note that the examples provided above are illustrative and not intended to be exhaustive. For more details on how we use this information, please refer to the "Use of Your Personal Information" section.

If We decide to collect additional categories of personal information or use the personal information We collected for materially different, unrelated, or incompatible purposes, We will update this Privacy Policy.

Disclosure of Personal Information

We may use or disclose and may have used or disclosed in the last twelve (12) months the following categories of personal information for business or commercial purposes:

• Category A: Identifiers
• Category B: Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))
• Category D: Commercial information
• Category F: Internet or other similar network activity
• Category G: Geolocation data

Please note that the categories listed above are those defined in the CCPA/CPRA. This does not mean that all examples of that category of personal information were in fact disclosed, but reflects our good faith belief to the best of our knowledge that some of that information from the applicable category may be and may have been disclosed.

When We disclose Personal Information to a service provider, We have a contract with it that describes the purpose and requires it to keep the information confidential and use it only to perform that contract. Some recipients are not bound that way. For push notifications on an iPhone, the device token and the alert text go to Apple, and We have no data protection terms with it. Switching off Push notifications in the app stops this. Google uses the device details ML Kit sends from Android app versions before 1.8.6 for its own diagnostics. Stripe, Our payment processor, uses payment details under its own privacy policy. So does Link, for sales in Mexico and for sales in India to buyers without a GSTIN.

Sharing of Personal Information

We may share, and have shared in the last twelve (12) months, Your personal information identified in the above categories with the following categories of third parties:

• Service Providers
• Payment processors
• Apple, to deliver push notifications to an iPhone
• Third-party vendors to whom You or Your agents authorize Us to disclose Your personal information in connection with products or services We provide to You

Sale of Personal Information

As defined in the CCPA/CPRA, "sell" and "sale" mean selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Consumer's personal information by the Business to a third party for valuable consideration. This means that We may have received some kind of benefit in return for sharing personal information, but not necessarily a monetary benefit.

We do not "sell" or "share" information as most people would commonly understand these terms, meaning We do not, and will not, disclose Your Personal Information in direct exchange for money or some other form of payment.

We do not run advertising on the Service and We do not use it for cross-context behavioral advertising. We run a small Google Ads campaign on the Axiospec brand name, and those ads appear on Google, not on the Service. No ad tag, conversion pixel or remarketing tag loads on the site or in the app. What runs on the Service is Google Analytics, which receives page paths and interaction events and sets its own cookies once You allow it. Our Google Analytics property is linked to Our Google Ads account, so Google Analytics may then share conversion measurements with it. We take the view that this does not amount to a sale, and We describe it so that You can judge it for Yourself rather than take Our word.

An earlier version of this notice declared a "sale" and "sharing" for cross-context behavioral advertising. That was written when advertising tags were in use. It is no longer true and it has been removed.

Retention of Personal Information

We retain California residents' Personal Information for as long as reasonably necessary to achieve the purposes described in this Privacy Policy (including the purposes disclosed in this CCPA/CPRA notice), taking into account: (i) how long we need the information to provide and maintain the Service and Your Account; (ii) whether You have requested deletion (subject to applicable exceptions); (iii) Our legal, tax, accounting, and regulatory obligations; (iv) security, fraud prevention, and abuse monitoring needs; and (v) the time periods needed to resolve disputes and enforce Our agreements.

Specific retention periods for major data categories are described in the "Retention of Your Personal Information" section of Our Privacy Policy, and We may retain certain information longer where required or permitted by law (for example, to comply with recordkeeping obligations or to establish, exercise, or defend legal claims).

Sale of Personal Information of Minors Under 16 Years of Age

We do not knowingly collect personal information from minors under the age of 16 through our Service, although certain third party websites that we link to may do so. These third-party websites have their own terms of use and privacy policies and We encourage parents and legal guardians to monitor their children's Internet usage and instruct their children to never provide information on other websites without their permission.

We do not sell the Personal Information of Consumers We actually know are less than 16 years of age, unless We receive affirmative authorization (the "right to opt-in") from the parent or guardian of a Consumer less than 16 years of age. Consumers who opt-in to the sale of personal information may opt-out of future sales at any time. To exercise the right to opt-out, You (or Your authorized representative) may submit a request to Us by contacting Us.

If You have reason to believe that a child under the age of 16 has provided Us with personal information, please contact Us with sufficient detail to enable Us to delete that information.

Your Rights under the CCPA/CPRA

The CCPA/CPRA provides California residents with specific rights regarding their personal information. If You are a resident of California, You have the following rights:

• The right to notice. You have the right to be notified which categories of Personal Information are being collected and the purposes for which the Personal Information is being used.
• The right to know/access. Under CCPA/CPRA, You have the right to request that We disclose information to You about Our collection, use, sale, disclosure for business purposes and share of personal information. Once We receive and confirm Your request, We will disclose to You:
  • The categories of personal information We collected about You
  • The categories of sources for the personal information We collected about You
  • Our business or commercial purposes for collecting or selling that personal information
  • The categories of third parties with whom We share that personal information
  • The specific pieces of personal information We collected about You
  • If we sold Your personal information or disclosed Your personal information for a business purpose, We will disclose to You:
    • The categories of personal information categories sold
    • The categories of personal information categories disclosed
• The right to say no to the sale or sharing of Personal Information (opt-out). You have the right to direct Us to not sell Your personal information. To submit an opt-out request, please see the "Do Not Sell or Share My Personal Information" section or contact Us.
• The right to correct Personal Information. You have the right to correct or rectify any inaccurate personal information about You that We collected. Once We receive and confirm Your request, We will use commercially reasonable efforts to correct (and direct our Service Providers to correct) Your personal information, unless an exception applies.
• The right to limit use and disclosure of sensitive Personal Information. You have the right to request to limit the use or disclosure of certain sensitive personal information We collected about You, unless an exception applies. To submit, please see the "Limit the Use or Disclosure of My Sensitive Personal Information" section or contact Us.
• The right to delete Personal Information. You have the right to request the deletion of Your Personal Information under certain circumstances, subject to certain exceptions. Once We receive and confirm Your request, We will delete (and direct Our Service Providers to delete) Your personal information from our records, unless an exception applies. We may deny Your deletion request if retaining the information is necessary for Us or Our Service Providers to:
  • Complete the transaction for which We collected the personal information, provide a good or service that You requested, take actions reasonably anticipated within the context of our ongoing business relationship with You, or otherwise perform our contract with You.
  • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
  • Debug products to identify and repair errors that impair existing intended functionality.
  • Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
  • Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
  • Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if You previously provided informed consent.
  • Enable solely internal uses that are reasonably aligned with consumer expectations based on Your relationship with Us.
  • Comply with a legal obligation.
  • Make other internal and lawful uses of that information that are compatible with the context in which You provided it.
• The right not to be discriminated against. You have the right not to be discriminated against for exercising any of Your consumer's rights, including by:
  • Denying goods or services to You
  • Charging different prices or rates for goods or services, including the use of discounts or other benefits or imposing penalties
  • Providing a different level or quality of goods or services to You
  • Suggesting that You will receive a different price or rate for goods or services or a different level or quality of goods or services

Exercising Your CCPA/CPRA Data Protection Rights

Please see the "Do Not Sell or Share My Personal Information" section and "Limit the Use or Disclosure of My Sensitive Personal Information" section for more information on how to opt out and limit the use of sensitive information collected.

Additionally, in order to exercise any of Your rights under the CCPA/CPRA, and if You are a California resident, You can contact Us:

• By email: support@axiospec.com

Only You, or a person registered with the California Secretary of State that You authorize to act on Your behalf, may make a verifiable request related to Your personal information.

Your request to Us must:

• Provide sufficient information that allows Us to reasonably verify You are the person about whom We collected Personal Information or an authorized representative
• Describe Your request with sufficient detail that allows Us to properly understand, evaluate, and respond to it

We cannot respond to Your request or provide You with the required information if We cannot:

• Verify Your identity or authority to make the request
• And confirm that the personal information relates to You

We will disclose and deliver the required information free of charge within 45 days of receiving Your verifiable request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary and with prior notice.

Any disclosures We provide will only cover the 12-month period preceding the verifiable request's receipt.

For data portability requests, We will select a format to provide Your personal information that is readily usable and should allow You to transmit the information from one entity to another entity without hindrance.

Do Not Sell or Share My Personal Information

As defined in the CCPA/CPRA, "sell" and "sale" mean selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Consumer's personal information by the Business to a third party for valuable consideration. This means that We may have received some kind of benefit in return for sharing personal information, but not necessarily a monetary benefit.

You have the right to opt-out of the "sale" of Your personal information. Once We receive and confirm a verifiable consumer request from You, We will stop "selling" Your Personal Information. To exercise Your right to opt-out, please contact Us or follow the below instructions.

Website

Select Decline on the cookie banner. That turns Google Analytics storage off and stops the campaign information being written to Your device. Your choice is stored on the device You made it on, so You need to make it in each browser You use. To change a choice You have already made, select "Cookie settings" in the footer of Our website or in the account menu of the application.

The industry opt-out platforms run by the NAI, the EDAA and the DAA apply to interest-based advertising. We do not run any, so there is nothing of Ours for them to opt You out of.

Mobile Devices

The mobile apps carry no advertising identifier and serve no ads. To stop push notifications, switch off Push notifications in the app's Notification settings. From version 1.8.6 turning notifications off in Your phone's settings stops them too, at the latest from the next time You open the app. In earlier versions it only hides them. From version 1.8.3 the Android app sends no analytics events. Earlier versions send Firebase Analytics events to Google until they are updated.

Limit the Use or Disclosure of My Sensitive Personal Information

If You are a California resident, You have the right to limit the use and disclosure of Your sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests such services or goods.

We collect, use and disclose sensitive personal information in ways that are necessary to provide the Service. For more information on how We use Your personal information, please see the "Use of Your Personal Information" section or contact us.

To submit a request to limit the use or disclosure of sensitive personal information, please contact Us using the methods listed in the "Contact Us" section of Our Privacy Policy.

"Do Not Track" Policy as Required by California Online Privacy Protection Act (CalOPPA)

Our Service does not respond to Do Not Track signals.

However, some third-party websites do keep track of Your browsing activities. If You are visiting such websites, You can set Your preferences in Your web browser to inform websites that You do not want to be tracked. You can enable or disable DNT by visiting the preferences or settings page of Your web browser.

Your California Privacy Rights (California's Shine the Light law)

Under California Civil Code Section 1798 (California's Shine the Light law), California residents with an established business relationship with Us can request information once a year about sharing their Personal Data with third parties for the third parties' direct marketing purposes.

If you'd like to request more information under the California Shine the Light law, and if You are a California resident, You can contact Us using the contact information provided below.

California Privacy Rights for Minor Users (California Business and Professions Code Section 22581)

California Business and Professions Code Section 22581 allows California residents under the age of 18 who are registered users of online sites, services or applications to request and obtain removal of content or information they have publicly posted.

To request removal of such data, and if You are a California resident, You can contact Us using the contact information provided below, and include the email address associated with Your Account.

Be aware that Your request does not guarantee complete or comprehensive removal of content or information posted online and that the law may not permit or require removal in certain circumstances.

Children's Privacy

Our Service is for people aged 18 and over, as Our Terms and Conditions require. We do not knowingly collect personally identifiable information from anyone under the age of 18. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 18, We take steps to remove that information from Our servers.

If We need to rely on consent as a legal basis for processing Your information and Your country requires consent from a parent, We may require Your parent's consent before We collect and use that information.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Translation Interpretation

This Privacy Policy may have been translated if We have made it available to You on our Service. You agree that the original English text shall prevail in the case of a dispute.

There is one exception. For people in Quebec, the French version of this Privacy Policy governs. It is published in Canadian French at axiospec.com/fr-CA/privacy.

Changes to this Privacy Policy

We may update this Privacy Policy. Each time, We change the "Last updated" date at the top.

Before a material change takes effect, We tell You by email or by a notice in the Service at least 14 days in advance.

Other changes take effect when they are posted on this page.

Privacy complaints

If You are unhappy with how We handle Your personal data, tell Us at support@axiospec.com. We acknowledge every privacy complaint within 30 days of receiving it. We then look into it and tell You the outcome without undue delay. Where a regional section above names an authority, You can also complain to it.

Contact Us

The person accountable for privacy at CaliTech LLC is its Owner and Managing Member. You can reach that person at the addresses below.

If you have any questions about this Privacy Policy, or You want to exercise a right under it, You can contact us:

• By email: support@axiospec.com. That address reaches the owner of the company. We aim to reply within two business days.
• By post: CaliTech LLC d/b/a Axiospec, 116 Agnes Rd. Ste 200, Knoxville, TN 37919, United States.