Privacy Policy

GLLUZ LTD ("we", "us", "our") is a company registered in England and Wales. We operate Axidex, a signal intelligence platform for sales teams. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

1. Data We Collect

We collect the following categories of information:

• Account information— name, email address, company name, and role when you create an account.
• Usage data— pages visited, features used, search queries, and interaction patterns within the platform.
• Signal data— publicly available business information we aggregate from open sources (job postings, press releases, regulatory filings) to generate buying signals.
• Prospect data— names, job titles, email addresses, LinkedIn profiles, and phone numbers of third-party business contacts identified through the platform's contact-finding and lead search features.
• Technical data— IP address, browser type, device information, and operating system collected automatically.
• Payment data— billing details processed securely through Stripe. We do not store full card numbers.

2. How We Use Your Data

• To provide, maintain, and improve the Axidex platform and its features.
• To generate and deliver buying signals and AI-powered outreach suggestions.
• To process transactions and manage your subscription.
• To communicate with you about updates, security alerts, and support.
• To analyse platform usage and optimise performance (analytics cookies only with your consent).
• To detect and prevent fraud, abuse, or security incidents.

3. Data Sharing and Sub-Processors

We do not sell your personal data. We share data only with the following service providers ("sub-processors") who are contractually bound to protect it:

• Vercel— platform hosting and edge delivery.
• Supabase— database and authentication (EU region).
• Stripe— payment processing.
• Resend— transactional email delivery.
• OpenRouter / Groq— AI providers used to generate outreach emails and classify signals. We send minimal data (contact first name, job title, company name) for email personalisation. We do not share full contact records or sensitive personal data with AI providers, and we do not consent to our data being used to train third-party AI models.
• Legal compliance— when required by law, court order, or to protect our legal rights.

For business customers, a full list of sub-processors and transfer mechanisms is available in our Data Processing Agreement.

4. Data Security

We implement industry-standard security measures including encryption in transit (TLS 1.3), encryption at rest, row-level security policies on our database, short-lived session tokens, and regular security reviews. Access to personal data is restricted to authorised personnel on a need-to-know basis. While no system is perfectly secure, we take reasonable steps to protect your information and will notify you within 72 hours of becoming aware of a personal data breach affecting your account.

5. Your Rights (UK & EU GDPR)

Under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and equivalent EU legislation, you have the following rights:

• Access— request a copy of the personal data we hold about you.
• Rectification— request correction of inaccurate or incomplete data.
• Erasure— request deletion of your personal data, subject to legal retention obligations.
• Portability— receive your data in a structured, machine-readable format.
• Objection— object to processing based on legitimate interests or for direct marketing.
• Restriction— request that we limit processing of your data in certain circumstances.

To exercise any of these rights, contact us at privacy@axidex.ai. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

6. Cookies

We use the following types of cookies:

• Essential cookies— required for authentication and core platform functionality. These cannot be disabled.
• Analytics cookies— Vercel Analytics, which helps us understand how users interact with the platform. These are only set after you give consent via the cookie banner shown on your first visit. You can withdraw consent at any time by clearing your browser's local storage.

We do not use advertising cookies or third-party tracking pixels.

7. Data Retention

We retain your account data for as long as your account is active. Upon account deletion, personal data is deleted within 30 days, except where retention is required by law (e.g. financial records under UK tax legislation, which are retained for 7 years). Anonymised, aggregated usage statistics may be retained indefinitely.

8. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at: