Privacy Policy

1. Who we are

AxiLayer AI, Inc. ("AxiLayer AI," "we," "us," or "our") is a Delaware corporation headquartered at 300 Colonial Center Parkway, Roswell, Georgia 30076. We are a third-party AI audit and assurance firm providing AI system auditing, algorithm assurance, risk assessment, compliance readiness and governance advisory services. This Policy describes our privacy practices for the personal information we collect through this website (axilayerai.com), through client and prospect communications, and through our recruiting process.

2. Information we collect

We collect only the information each form or service needs. The table below lists what each form on this website asks for.

• Briefing and consultation requests. First and last name or contact name, organization, job title, business email address, phone number (optional), company address (briefing request), region, service of interest, industry, a description of your AI system or your message, and any document you choose to attach.
• Career applications. Full name, email address, phone number, LinkedIn profile, current employer, years of experience, country and markets covered where the role asks for them, resume or CV, cover letter, and any message you add. We may also collect information you provide during interviews or reference checks.
• Partnership, alliance and partner portal requests. Name, organization, job title, email address, phone number, the type of partnership or access tier requested, and a description of your interest.
• Newsletter, resource downloads and online tools. Email address for the newsletter; name, email address, company and job title to receive a gated resource; and, for the AI readiness assessment, your sector, role, answers and email address. The penalty estimator runs in your browser and does not send us what you enter.
• AxiLayer AI Assurance Intelligence. When you ask for a full report, compliance date alerts or your Insurance-Ready AI results: your work email and, if you choose to give them, your name, organization, country and the regions and industries you select. The instant answer, map, calendar and quick check run in your browser and send us nothing until you ask for results. With every website form we also record the IP address and browser type it was sent from, to prevent spam and abuse.
• Purchases, purchase orders and subscriptions. Company name, contact name, email address, phone number, region, industry, billing address, VAT or tax number where applicable, the package and add-ons selected, and, if you pay by purchase order, the purchase order number and document. Government buyers may also provide the entity name, CAGE code, tax-exempt identifier and tax-exemption certificate and the e-invoicing format required. Card payments are handled by Stripe, as described in Section 5.
• AxiLayer AI Global Academy and publications library account. Your name, email address, country and, optionally, your organization; your password (stored only in hashed form); your two-step sign-in secret (stored encrypted) and recovery codes (stored only in hashed form); your roles, enrollments and access dates; and a record of your sign-ins and active sessions.
• Academy learning records. Lesson progress, quiz and assessment answers and results, attendance at live sessions, instructor feedback, completion records and, if you ask, your interest in the Level 3 pathway. For people invited to Level 3, a short label for each supervised engagement and the impartiality declarations they sign. Client data from engagements never enters the Academy.
• Academy partner forms. For Authorized Training Partner inquiries, the organization, contact name, email address, regions and message. For referral partners, the organization, contact name, contact email, country and need described in each introduction.
• Technical information. Our hosting provider records standard server log information when you visit, such as IP address, browser and device type, the pages requested and the date and time. We do not use third-party analytics, advertising or tracking tools on this website. We count page visits ourselves, without cookies: when a page loads, your browser sends us only the page address, the website that referred you and any campaign tag in the link. We do not store your IP address with these counts or use them to identify you, and we do not count your visits when your browser sends a Do Not Track or Global Privacy Control signal.
• Information from third parties. We may receive limited information about you from professional networking platforms (such as LinkedIn), event organizers, or business partners who introduce you to us, consistent with their own privacy disclosures.

We do not collect payment card numbers through this website, and we ask for tax and government identifiers only where a purchase requires them.

3. How we use information

We use personal information to:

• Respond to inquiries and briefing requests, and to scope, deliver, and manage engagements;
• Process orders, subscriptions, invoices and payments;
• Evaluate job applications and manage recruiting, subject to any additional notices provided during that process;
• Operate and secure this website;
• Send communications you have requested, including newsletters or updates about our services, frameworks, and events, with an opt-out available in every such communication;
• Comply with legal, regulatory, tax, and accounting obligations; and
• Detect, investigate, and prevent fraud, misuse, or security incidents.

4. Legal bases for processing (EEA, UK, and similar jurisdictions)

Where the General Data Protection Regulation or equivalent UK law applies, we rely on one or more of the following legal bases: performance of a contract or steps requested prior to entering one (for example, scoping an engagement or processing an order); our legitimate interests in operating and marketing our business, provided those interests are not overridden by your rights; your consent, where required, for example for optional marketing communications; and compliance with a legal obligation.

5. Payments

Card payments, subscriptions and the subscription billing portal on this website are processed by Stripe, Inc., our payment processor. When you pay by card, you enter your card details directly on Stripe's secure checkout, and Stripe processes them under its own privacy policy (stripe.com/privacy). AxiLayer AI never receives or stores your full card number. We receive from Stripe the information needed to confirm and account for the payment, such as your name, email address, billing country, the amount, the date and the last four digits and brand of the card.

6. How we share information

We do not sell personal information and we do not share it for cross-context behavioral advertising. We share it only with:

• Service providers that act on our behalf under contractual confidentiality and data-protection obligations:
  • Microsoft (Azure website hosting and Microsoft 365 business email);
  • Stripe (payments, subscriptions and billing);
  • EmailJS (delivery of certain website form submissions to our business email);
  • Google (web fonts served from Google Fonts, and Google Translate, only when you choose a language in the Translate menu);
  • Unsplash and jsDelivr (delivery of some images and website scripts, which receive your IP address when your browser loads them).
• Professional advisors, such as our accountants, auditors, and legal counsel, as needed;
• People who check an Academy completion record: anyone who enters a completion record ID on the Academy verify page sees the name on the record, the level, the date issued, the delivering partner and whether the record is valid. The record ID is printed on your record and you choose whom to give it to;
• Authorized Training Partners: the partner that delivers your cohort sees the roster, schedule, attendance and completion counts for that cohort, never your payment details;
• Regulators, courts, or government authorities, where required by law, legal process, or to protect our rights, property, or safety, or that of others; and
• A successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy or a materially equivalent one.

Because our separation from the AI systems and vendors we assess is central to our work, we do not share client engagement data with the vendors or platforms whose systems we audit, except as the client itself directs.

7. Cookie notice

This website uses only the cookies and browser storage it needs to work and to remember the choices you make. We do not use analytics, advertising or tracking cookies.

• googtrans (cookie, preference): set only when you choose a language in the Translate menu, so pages stay in that language. It is removed when you switch back to English or clear your cookies.
• axi_cookie_notice (browser local storage, essential): remembers that you have seen this cookie notice.
• axi-theme and axl_onboarding_seen (browser local storage, preference): remember your display theme and whether you have seen the introduction.
• axiApacBannerClosed, axilUrgencyDismissed and axiDeadlineClosed (browser session storage, preference): remember that you closed an announcement for the rest of your visit.
• axa-s (browser local storage, essential): set only when you sign in to the Academy or the publications reader, to keep you signed in. It holds a random sign-in token, is removed when you sign out, and stops working when the session expires or is ended. A secure, HTTP-only sign-in cookie with the same purpose may also be set.
• axa-lang (browser local storage, preference): remembers the language you choose in the Academy.
• Stripe cookies (essential): when you open Stripe's checkout or billing portal, Stripe sets its own cookies to process the payment and prevent fraud, as described in Stripe's cookie policy.

Because these items are either strictly necessary or set only at your request, we do not ask for consent before using them. You can block or delete cookies and browser storage in your browser settings; the site will still work, but it will not remember your choices.

8. International data transfers

We are headquartered in the United States and may process personal information there and in other jurisdictions where we or our service providers operate. Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on recognized transfer mechanisms, such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, together with appropriate technical and organizational safeguards.

9. Data retention

We retain personal information for as long as needed to fulfill the purposes described in this Policy, including to provide services, maintain business records, meet legal, tax, and regulatory retention obligations, and resolve disputes. Retention periods vary by category and context; payment and invoice records are kept for the period tax law requires, and unsuccessful job applications are generally retained for a limited period to support our recruiting process unless you ask us to delete them sooner.

10. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. California residents have rights under the California Consumer Privacy Act (as amended), including the right to know what personal information we hold and to request its deletion; we do not sell or share personal information for cross-context behavioral advertising as those terms are defined under California law. To exercise any of these rights, contact us using the details in Section 14; we may need to verify your identity before acting on a request.

11. Data security

We maintain administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction, including encrypted connections (HTTPS with HSTS) for every page of this website. No system is completely secure, and we cannot guarantee the absolute security of information transmitted to us.

12. Children's privacy

This website and our services are directed to businesses and professionals and are not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can address it.

13. Third-party links

This website may link to third-party sites, including regulatory bodies, standards organizations, and partners. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies before providing them with information.

14. Contact us

To ask a question about this Policy or to exercise a privacy right, contact us at:

AxiLayer AI, Inc.
300 Colonial Center Parkway
Roswell, Georgia 30076
Phone: (943) 243-0151
Email: contactus@axilayerai.com

15. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or applicable law. The effective date at the top of this page indicates when it was last revised. Material changes will be reflected on this page.