Privacy and Data Sovereignty Policy

1. Information We Collect

Aexon Tech collects only the minimum information necessary to conduct legitimate commercial engagements and provide our engineering services. Depending on how you interact with us, this may include:

• Inquiry & Contact Details: Name, business email address, company name, job title, and project requirements submitted via our inquiry forms or direct correspondence.
• Technical & Client Deliverables Data: Systems architectural specifications, codebase repositories, performance metrics, and configuration files provided under a formal Master Services Agreement (MSA) and Non-Disclosure Agreement (NDA).
• Essential Platform Telemetry: Anonymized server request logs, browser user agent metadata, and core error traces used exclusively for edge routing and network security protection.

2. Purpose & Use of Data

We utilize collected information strictly for the execution of agreed-upon commercial and technical objectives:

• To architect, develop, test, and deploy agreed software deliverables.
• To provide transparent billing, project management, and operational reporting.
• To prevent denial-of-service (DDoS) incidents, fraud, and unauthorized system access.
• To comply with statutory legal and regulatory obligations.

We never sell, rent, monetize, or broker personal information or enterprise client data to third parties under any circumstances.

3. AI Governance & Zero-Training Guarantees

As an engineering firm specializing in applied AI and machine learning, we enforce strict isolation policies regarding data privacy:

• Zero Model Training: Client proprietary data, private source code, and internal documents are never ingested into general training pipelines or used to fine-tune public foundation models.
• Private Inferencing: When deploying specialized LLMs, we utilize isolated private endpoints (Virtual Private Clouds / dedicated instances) ensuring that zero inference payloads are persisted or audited by external vendors.
• Deterministic Logging: Prompts, context embeddings, and retrieval vectors are scrubbed of Personally Identifiable Information (PII) before storage.

4. Cookies & Observability

Our public marketing site utilizes zero non-essential advertising cookies. We do not embed third-party tracking pixels, Facebook Pixel, Google AdSense, or behavioral tracking scripts.

We may utilize privacy-preserving, first-party edge telemetry to monitor server health and global page rendering latencies. This telemetry is aggregated, anonymized, and contains zero personal identifiers.

5. Infrastructure & Subprocessors

Our systems are hosted in ISO 27001, SOC2 Type II, and PCI-DSS certified data centers. We maintain formal Data Processing Addendums (DPAs) with all underlying cloud infrastructure providers (e.g., AWS, GCP, Cloudflare) that strictly mandate data encryption at rest and in transit.

6. Security Protocols & Encryption

We treat information security as a core architectural constraint:

• Encryption in Transit: All web and API traffic is enforced over TLS 1.3 with modern cipher suites and HSTS preloading.
• Encryption at Rest: All stored data and databases are protected using AES-256 encryption with hardware security module (HSM) managed keys.
• Zero-Trust Access Control: Engineering access to client staging environments requires hardware security keys (FIDO2/WebAuthn) and ephemeral just-in-time access approvals.

7. Data Retention & Deletion

We retain commercial project records only for the duration required to satisfy contractual delivery and statutory tax requirements. Upon formal project conclusion or client request, all temporary code checkouts, staging artifacts, and development environments are securely cryptographically purged.

8. Your Statutory Rights (GDPR & CCPA)

Under international privacy frameworks including the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA), you retain the following enforceable rights:

• The right to access and obtain a portable copy of personal information we hold.
• The right to rectify inaccurate or incomplete personal records.
• The right to request the erasure of your personal data (“right to be forgotten”).
• The right to restrict or object to the processing of your data.
• The right to withdraw previously granted consent at any time without penalty.

9. Data Protection Contact

For inquiries regarding our data handling procedures, data processing addendums, or to exercise your statutory rights, please contact our Data Protection Officer:

Aexon Tech Legal & Compliance
Email: [email protected]
General Inquiries: [email protected]