AXAxosHub
Features Plans Integrations Workspace FAQ Login FAQ How to sign in My workspace Sign in to workspace
Legal · v. 1 August 2026

Privacy policy

This Privacy Policy explains how AxosHub GmbH ("AxosHub", "we", "us", "our") processes personal data in connection with the AxosHub cloud productivity workspace (the "Service"). It complements the Terms at /terms and the German-language Datenschutzerklärung at /datenschutz. In case of interpretative divergence between the English and the German version, the German version prevails for customers in Germany.

1. Data controller

The data controller for the personal data processed in connection with the Service is:
AxosHub GmbH, Chausseestraße 22, 10115 Berlin, Germany. HRB 294 617 B (Amtsgericht Berlin-Charlottenburg). USt-IdNr. DE 358 214 907. Managing Director: Miriam Klein. Data protection officer: Dr. Elena Weiss, reachable at dpo@axoshub.org.

2. Categories of personal data processed

We process the following categories of personal data:

  • Identification data: workspace email address, IP address at sign-in, browser user-agent, sign-in timestamps.
  • Content data: notes, tasks, calendar events and attachments you create inside your workspace.
  • Billing data: billing name, billing address, VAT identification, payment method reference (SEPA IBAN mask, card last four digits — full payment credentials are held only by our PCI-DSS-compliant payment processor).
  • Session data: the ax_ws session cookie value, device fingerprint (browser + operating-system labels), IP address per active session.
  • Support data: any personal data you voluntarily disclose when contacting our support team.

3. Purposes and legal bases

Personal data is processed for the following purposes on the corresponding GDPR legal bases:

  • Provisioning and operating the workspace, including magic-link sign-in and sync — Art. 6(1)(b) GDPR (performance of the subscription contract).
  • Billing, invoicing and tax reporting — Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(b) GDPR (contract).
  • Security monitoring, abuse detection and audit logging — Art. 6(1)(f) GDPR (legitimate interest in operating a secure service).
  • Responding to support requests — Art. 6(1)(b) GDPR (contract).
  • Sending service-related transactional emails (magic links, invoices, incident notifications) — Art. 6(1)(b) GDPR (contract).
  • Product-improvement analytics on aggregated, non-content data — Art. 6(1)(f) GDPR (legitimate interest), with an opt-out from /account.

We do not process personal data for advertising purposes on any legal basis.

4. Retention periods

Personal data is retained for the periods below and erased thereafter:

  • Content data — for as long as the workspace exists, plus a 30-day grace period after cancellation, plus the natural rotation cycle of encrypted snapshots (up to 90 additional days on Business plans).
  • Billing data — 10 years from the invoice date, in accordance with §147 AO (German tax retention).
  • Session data — for the lifetime of the session, plus 90 days in the audit log after revocation.
  • Sign-in logs — 365 days on Business plans (immutable audit log), 90 days on other plans.
  • Support correspondence — 3 years from the last message in the thread.

5. Recipients and sub-processors

Personal data is disclosed to the following categories of recipients: our own personnel bound by written confidentiality obligations; our sub-processors listed at /dpa; competent authorities where required by binding legal order. The current list of sub-processors, updated whenever it changes, is published at /dpa. All sub-processors are bound by written data-processing agreements that include the standard contractual clauses adopted by the European Commission where applicable.

6. International transfers

Personal data processed in connection with the Service does not leave the European Economic Area under normal circumstances. Certain sub-processors used for customer support tooling operate infrastructure in the United States; transfers to those sub-processors are governed by the standard contractual clauses adopted by the European Commission on 4 June 2021 (Decision 2021/914) and by supplementary organisational and technical measures documented in the DPA.

7. Data subject rights

You have the following rights under the GDPR: the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) and the right not to be subject to a decision based solely on automated processing (Art. 22). You may exercise these rights at any time by emailing dpo@axoshub.org. Erasure can also be requested self-service from /workspace-deletion. Data portability is served self-service via the workspace export function at /account. You have the right to lodge a complaint with the supervisory authority (Berliner Beauftragte für Datenschutz und Informationsfreiheit — BlnBDI) if you consider that our processing does not comply with the GDPR.

8. Automated decision-making

We do not carry out automated individual decision-making, including profiling, that produces legal effects concerning you or that similarly significantly affects you.

9. Security

We apply the technical and organisational measures described in the security whitepaper, including per-workspace encryption at rest, TLS 1.3 in transit, ISO-27001-aligned access control and a coordinated vulnerability-disclosure programme. We hold SOC 2 Type II certification (report available under NDA).

10. Cookies

The Service uses only strictly necessary first-party cookies as described in the Cookie Policy at /cookies. No analytics, tracking or advertising cookies are set.

11. Changes

We may update this Privacy Policy from time to time. The current version and the effective date are indicated at the top of the page. Material changes are announced by email to the workspace address at least 30 days before they take effect.

12. Contact

Questions about this Privacy Policy or about our processing of your personal data may be sent to dpo@axoshub.org. Postal address: AxosHub GmbH — Data Protection Officer, Chausseestraße 22, 10115 Berlin, Germany.

13. Processing in the context of magic-link sign-in

The passwordless magic-link sign-in flow processes a narrow, well-defined set of personal data on a narrow, well-defined legal basis. When a workspace email address is submitted on /login, we hash the address with argon2id and check the hash against the workspace database to determine whether a workspace exists for that address. If it exists, we generate a signed magic-link token, associate it with a fifteen-minute expiry and a single-use flag, and dispatch it via our email sub-processor to the address in question. If it does not exist, we generate no token and dispatch no email, but we return the same visual response as the affirmative case in order not to disclose the existence or non-existence of a workspace to an anonymous requester.

When the token is tapped, we verify the signature, check the expiry, mark the token consumed, issue the ax_ws session cookie and redirect to /workspace. The IP address of the tap request and the browser user-agent string are recorded in the sessions table for the purpose of populating /session-and-devices. The rate-limit counters are updated per email and per source IP. All of this processing is grounded on Article 6(1)(b) GDPR — performance of the contract to provide the workspace.

14. Processing in the context of billing

Billing personal data (billing name, billing address, VAT identification, masked payment-method reference) is processed for the purpose of raising invoices and collecting payment for the workspace subscription. The legal basis is Article 6(1)(b) GDPR for the contract itself and Article 6(1)(c) GDPR for the retention obligation under §147 AO. Full payment credentials (card PAN, SEPA mandate signature) are held only by our PCI-DSS-compliant payment processor Stripe Payments Europe Ltd; AxosHub systems hold only the tokenised reference returned by Stripe for reconciliation and refund purposes.

15. Processing in the context of support

When you contact our support team, we process the personal data you voluntarily disclose in the message and any subsequent correspondence for the purpose of understanding and resolving your request. Support correspondence is retained for three years from the last message in the thread and then destroyed. If a support conversation touches on sensitive matters (for instance, an allegation of unauthorised access to a workspace), the conversation may be escalated to our DPO and retained for the duration of the corresponding investigation, plus one additional year for audit purposes.

16. Interaction with connected integrations

When you connect a third-party integration (Google, Slack, Zapier, GitHub, Linear, Notion importer, Todoist importer, CalDAV) from /account, the third party may act as an independent data controller or as a joint controller with AxosHub depending on the nature of the data exchanged. Data received from the third party into your Axos workspace becomes subject to this Privacy Policy from the moment it lands in the workspace. Data pushed from the Axos workspace to the third party leaves the scope of this Privacy Policy and becomes subject to the third party's own privacy policy from the moment it crosses the integration boundary.

17. Historic changes to this policy

This is version 3.2 of the Privacy Policy, effective from 1 August 2026. Previous material versions were published on 15 April 2026 (v3.1, added the Warsaw sync region), 1 January 2026 (v3.0, comprehensive update to reflect the SOC 2 Type II certification), 1 September 2025 (v2.3), and 1 March 2025 (v2.2). All historic versions of this Privacy Policy remain available on request from dpo@axoshub.org. Substantive comparisons of successive versions (redlines) are available on written request; we typically produce them within five working days.