Privacy Policy

1. Introduction

DarkWave Studios LLC ("Company," "we," "us," or "our") operates Axiom, a deterministic AI agent platform. This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use the Axiom service ("Service").

By using the Service, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, and password when you create an account.
• Billing Information: Payment details processed securely through Stripe. We do not store credit card numbers on our servers.
• Phone Number: If you opt in to SMS or voice services.
• Queries: The text, voice, or SMS input you submit to the Axiom agent.
• Custom Content: Ontologies, templates, and configurations you upload (Business and Enterprise tiers).

2.2 Information We Collect Automatically

• Usage Data: Query counts, API call timestamps, feature usage, and response latency metrics.
• Audit Logs: Cryptographic hashes of pipeline events (SHA-256). These logs contain hashes, not plaintext content.
• Device Information: Browser type, operating system, IP address, and referring URL.
• Session Data: Session identifiers for maintaining state during interactions.

3. How We Use Your Information

• Service Delivery: Processing your queries through the Axiom deterministic pipeline and returning responses.
• Account Management: Managing your subscription, billing, and API access.
• Audit and Compliance: Maintaining cryptographic audit trails for service integrity and regulatory compliance.
• Communications: Sending service notifications, security alerts, and billing updates.
• SMS: If you opt in, sending agent responses and service notifications via SMS.
• Improvement: Analyzing aggregate, anonymized usage patterns to improve service reliability and performance.

4. Data Retention

5. Data Sharing and Disclosure

We do not sell your personal information. We may share information with:

• Stripe: For payment processing. Subject to Stripe's Privacy Policy.
• Twilio: For SMS and voice services. Subject to Twilio's Privacy Policy.
• ElevenLabs: For text-to-speech services (if enabled). Subject to ElevenLabs Privacy Policy.
• OpenAI: For speech-to-text transcription (if enabled). Subject to OpenAI's Privacy Policy.
• Law Enforcement: If required by law, subpoena, or court order.

6. Data Security

We implement the following security measures:

• Encryption in Transit: All data transmitted over HTTPS/TLS.
• API Key Hashing: API keys are stored as SHA-256 hashes. We cannot recover your API key if lost.
• Password Hashing: Passwords are salted and hashed. We never store plaintext passwords.
• Audit Integrity: The cryptographic audit chain detects any tampering with stored data.
• Tenant Isolation: Multi-tenant architecture ensures data isolation between customers.

7. Your Rights

You have the right to:

• Access: Request a copy of your personal data.
• Correction: Request correction of inaccurate personal data.
• Deletion: Request deletion of your account and associated data.
• Portability: Request your data in a machine-readable format.
• Opt-Out: Unsubscribe from SMS (reply STOP) or marketing communications at any time.
• Restrict Processing: Request we limit how we use your data.

To exercise these rights, contact privacy@darkwavestudios.io.

8. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

9. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know what personal information is collected, used, and shared.
• Right to delete personal information.
• Right to opt out of the sale of personal information. We do not sell personal information.
• Right to non-discrimination for exercising your privacy rights.

10. International Users (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland:

• Our legal basis for processing is consent (for SMS), contract performance (for service delivery), and legitimate interest (for security and improvement).
• Data may be transferred to the United States. We implement appropriate safeguards for cross-border transfers.
• You have the right to lodge a complaint with your local data protection authority.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users at least 30 days prior to taking effect. The "Last Updated" date at the top indicates when this policy was last revised.

12. Contact