Privacy Policy

Last updated: 27 August 2026

AxioVendo Ltd ("AxioVendo", "we") provides a platform that helps B2B sales teams complete vendor assessment questionnaires. This policy explains what personal data we process, why, and your rights. It applies to our website, application, and services.

1. Who we are

AxioVendo Ltd is a company registered in England & Wales. We are the data controller for account and website data, and a data processor for the content our customers upload (see our Data Processing Agreement). Contact our Data Protection Officer at dpo@axiovendo.com. Our ICO registration is in progress; the registration number will be published here once issued.

2. What we process — by plan

Free and Pay-as-you-go plans

We process and store your uploaded documents (questionnaires, completed questionnaires, and evidence documents) on our infrastructure: Supabase, hosted on AWS in the EU (eu-west-1, Ireland). Documents are encrypted in transit (TLS 1.3) and at rest (AES-256). AI processing of your documents is performed through our AI provider under our agreement with them; document content is sent to the provider solely to extract questions, answers, and passages, and is not used to train models. Documents are retained for the lifetime of your account and deleted within 30 days of account closure.

Bring-your-own (BYO) plan

Your documents never leave your infrastructure. They remain in your own Google Drive or SharePoint; AI processing runs through your own API key, called directly from your browser. We store only: structured question-and-answer pairs, passage references (text snippets with character offsets), workflow metadata (assignments, approvals, timestamps), and storage file ID pointers. We have no access to your document content or your AI provider account beyond the encrypted key you store with us for your own use.

3. Account and usage data (all plans)

• Account data: name, work email, organisation, functional role, hashed authentication credentials.
• Workflow data: assignments, approvals, edits, with names and timestamps (this is the product's audit trail).
• Billing data: processed by Stripe; we store only your Stripe customer reference.
• Technical data: logs, IP addresses, and usage events needed to run and secure the service.

4. Lawful basis

• Contract — providing the service you signed up for (account, workflow, notifications, billing).
• Legitimate interests — service security, fraud prevention, product improvement using aggregated usage data.
• Legal obligation — tax and accounting records.
• Consent — any marketing communications (opt-in, withdrawable at any time).

5. Sub-processors

6. International transfers

Customer documents and database records stay in the EU. Where a sub-processor (email, payments) involves a transfer outside the UK/EEA, it is protected by the UK International Data Transfer Agreement or EU Standard Contractual Clauses plus the UK Addendum.

7. Retention

• Documents (free/PAYG): lifetime of the account, deleted within 30 days of closure.
• Q&A pairs, workflow and audit data: lifetime of the account, deleted within 30 days of closure.
• Billing records: 6 years (UK statutory requirement).
• Logs: 90 days.

8. Your rights

Under UK GDPR you have the right of access, rectification, erasure, restriction, portability, and objection, and the right not to be subject to solely automated decisions with legal effect. Contact dpo@axiovendo.com; we respond within one calendar month. You may also complain to the Information Commissioner's Office (ico.org.uk).

9. Records of processing

We maintain records of processing activities in accordance with UK GDPR Article 30, available to supervisory authorities on request.

10. Changes

Material changes will be notified by email at least 14 days before they take effect.