Privacy Policy

1. Who we are

The data controller is PK-INT UG (haftungsbeschränkt), c/o Factory Works GmbH, Rheinsberger Straße 76/77, 10115 Berlin, Germany, represented by managing director Pavel Kovtun. Contact: support@axegem.com.

2. What Axegem does

Axegem helps merchants understand and improve how AI assistants (such as ChatGPT, Claude, Perplexity, and Gemini) present their stores and products. To do that, we audit publicly available store content, detect inaccurate AI claims, help merchants publish corrections and content, and attribute AI-referred orders.

3. Data we process

Marketing website and free audit. Server logs (IP address, user agent, timestamps), the store URL you submit for a free audit, optional audit inputs (industry, audience, positioning), and — if you request the report by email — your email address and name. Free-audit requests are rate-limited per IP address and per store domain to prevent abuse.

Account data. For web-app accounts: email address, name, company name, and password (stored hashed). For Shopify installs: your shop domain, the shop contact email Shopify provides, and the API access token needed to operate the app — there is no separate password.

Store data.Product catalog content (titles, descriptions, prices, identifiers, images metadata), pages and policies, and the ground-truth facts you provide. For order attribution we process order metadata (order identifiers, totals, timestamps, referrer and landing URLs, discount codes) to classify whether an order was AI-referred. We do not use your customers' names, emails, or addresses for attribution.

Website analytics.With your consent — given via the accept/decline cookie banner — we use Google Analytics 4 on axegem.com and app.axegem.com, including cross-domain measurement between the two, to understand how visitors move from the website into the product. No analytics scripts are loaded and no analytics cookies are set until you accept, and you can change your choice at any time via “Cookie settings” in the footer. Google's data-processing terms apply.

Product analytics (how the app itself is used). Separately from the website analytics above, we measure how merchants use the Axegem app — which screens are opened and which actions are taken — so that we improve the parts of the product people actually rely on. This is measured at the level of your store, not any individual person: it records your shop domain and plan, and never identifies a particular staff member. It contains no data about your customers, and none of the text you write in the app (product copy, questions you ask the AI, or your brand facts) is included. It is collected on our servers, not in your browser — the Shopify app sends these events to Axegem, which forwards them to our analytics provider (Mixpanel), so no analytics script and no cookie is loaded inside your Shopify admin. That is why this processing is not part of the cookie banner: it stores nothing on your device. The data is held in the EU. The legal basis is our legitimate interest in improving the service (Art. 6(1)(f) GDPR); you may object at any time by emailing support@axegem.com, and we will exclude your store from this analytics entirely.

4. AI providers

To run audits, we send queries and publicly available store content to AI engines — currently OpenAI (ChatGPT), Anthropic (Claude), Perplexity, and Google (Gemini) — and analyse their responses. These queries describe products and stores; they are not built from your customers' personal data. AI providers process this data under their respective API terms, which exclude using API data to train their models in the default configurations we use.

5. Shopify-specific commitments

The Axegem app for Shopify implements Shopify's mandatory privacy webhooks. When a merchant's customer requests their data or its deletion (customers/data_request, customers/redact), we respond accordingly — Axegem stores no customer-level personal data beyond the order metadata described above, which is deleted on redaction requests. When a store uninstalls the app and Shopify sends shop/redact, we delete the shop's data.

Merchants can also close their account in the app (Account → Data & privacy), which anonymises tenant data immediately, and can request a full data export.

6. Service providers and hosting

We use Microsoft Azure (EU-region hosting, and Azure Communication Services for transactional email), Shopify (platform integration and billing for Shopify merchants), Stripe (payment processing for non-Shopify customers), Google (website analytics), Mixpanel (product analytics for our own app, EU region), and the AI providers listed above. Providers that process personal data on our behalf do so under data-processing agreements.

7. Legal bases

We process personal data to perform our contract with you (Art. 6(1)(b) GDPR), to comply with legal obligations (Art. 6(1)(c)), and for legitimate interests such as securing and improving the service and preventing abuse (Art. 6(1)(f)). Where consent is required, we rely on consent (Art. 6(1)(a)), which you can withdraw at any time.

8. International transfers

Where service providers process personal data outside the EU/EEA (for example, US-based AI providers), transfers rely on adequacy decisions or EU Standard Contractual Clauses with supplementary measures where required. Our hosting and our product-analytics provider are configured for EU data residency; where such a provider has a US parent company, the same safeguards apply.

9. Retention

We keep account and store data for as long as your account is active. Uninstalling the Shopify app triggers deletion via shop/redact; closing your account anonymises your data immediately. Free-audit leads and technical logs are kept only as long as needed for the purposes described here or as required by law.

10. Your rights

Under the GDPR you have the right to access, rectify, and erase your personal data, to restrict or object to processing, and to data portability. You can exercise these rights by emailing support@axegem.com. You also have the right to lodge a complaint with a supervisory authority — for Berlin, the Berliner Beauftragte für Datenschutz und Informationsfreiheit (www.datenschutz-berlin.de).

11. Changes

We may update this policy when the service or legal requirements change. The version published on this page applies.