Privacy Policy

Last updated: April 12, 2026 · Version 2026-04-12

AKAXA Limited (“AKAXA,” “we,” “us,” or “our”) is the data controller for personal information processed through the AKAXA platform (“Services”). We are headquartered in Hong Kong SAR. This Privacy Policy complies with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable privacy laws globally.

Data Protection Officer: dpo@akaxa.io
Privacy Contact: privacy@akaxa.io

1. Information We Collect

2. Legal Basis for Processing (GDPR)

3. How We Use Your Information

AI Data Processing & Zero Data Retention

AI partners (including Anthropic) process data through enterprise-grade APIs with contractual Zero Data Retention (ZDR) obligations. Customer data is not stored or used for AI model training by sub-processors after the processing session ends. AKAXA does not use Customer data to train, fine-tune, or improve machine learning models without explicit written consent.

4. Third-Party Data Sharing

We share data with the following sub-processors to operate the Services:

We do not sell or share personal information for targeted advertising. All sub-processors have signed Data Processing Agreements requiring equivalent security measures. Changes to sub-processors are notified with 30 days' notice.

5. International Data Transfers

EU to Hong Kong SAR transfers: Transfers from the EU/EEA to AKAXA in Hong Kong SAR are protected by Standard Contractual Clauses (Module 2: Controller to Processor) as adopted by the European Commission, as required by GDPR Article 46.

Hong Kong SAR to US transfers: For secondary transfers to US-based sub-processors, we rely on Standard Contractual Clauses (SCCs Module 3: Processor to Processor) as adopted by the European Commission.

6. Automated Decision-Making (GDPR Art. 22)

AKAXA's AI-powered analysis provides decision support tools only. We do not engage in automated decision-making that produces legal effects or similarly significant effects on data subjects. All Analysis Reports are advisory in nature and require review by qualified human professionals. Each Customer's data is processed in a logically isolated environment.

7. Your Rights

EU/EEA Users (GDPR)

California Users (CCPA/CPRA)

Do Not Sell or Share My Personal Information

Korean Users (PIPA)

For users located in the Republic of Korea, AKAXA complies with the Personal Information Protection Act (PIPA):

불만 신고: 개인정보보호위원회(PIPC) · www.pipc.go.kr

8. Data Security

We implement industry-standard security measures including encryption at rest (AES-256) and in transit (TLS 1.2+), Fernet symmetric encryption for sensitive fields, role-based access controls (RBAC), multi-factor authentication for admin access, real-time monitoring, and audit logging. Breach notification is provided within 72 hours of confirmation.

9. Data Retention

After retention expires, electronic files are destroyed using methods that render recovery impossible (cryptographic erasure), in compliance with Korea PIPA Article 21.

10. Cookies

We use essential cookies for authentication and security. We do not use advertising or tracking cookies. You can decline non-essential cookies via our cookie banner.

11. Children

The Services are not directed at individuals under 18. We do not knowingly collect personal information from minors.

12. Changes to This Policy

Material changes that reduce privacy protections require 30 days' notice by email and in-app notification, with a right to terminate without penalty. Continued use constitutes acceptance of the updated policy.

13. Contact

AKAXA Limited · Hong Kong SAR
Privacy enquiries: privacy@akaxa.io
Data Protection Officer: dpo@akaxa.io
Response Time: 5 business days