Privacy Policy

1. Who we are / Services

Caxion provides an AI use case platform that helps individuals and organizations discover, build, govern, and measure AI agents. The “Services” include:

• The web application at caxion.ai and related domains
• Native apps for iPhone and iPad
• Related extensions where enabled (Share Extension, widgets, Live Activities, Shortcuts)
• Backend APIs, model routing, connectors, and collaboration features

Web, iPhone, and iPad are part of the same product surface family. Features may vary by device, plan, and region.

2. Information we collect

Account and profile information

When you create or manage an account, we may collect your name, email address, organization details, role, and authentication identifiers.

Usage and device information

We may collect information about how you use the Services, including feature interactions, approximate timestamps, app version, device type, operating system, diagnostic data needed to maintain reliability and security, and usage or credit metering events.

Content you provide

You may submit content necessary to operate the platform. Do not submit information you are not authorized to share. Depending on the features you use, this may include:

• Chat prompts, responses, and conversation history
• Memory, assistant preferences, and “My Data” ontology information
• Agent definitions, schedules, run logs, and thinking traces
• Platform apps, shared workspaces, and presence or activity signals
• Feedback submissions, including device and app metadata and whether feedback was started via shake gesture or an in-app control
• Connector-derived data returned into chats or agents (such as email snippets, calendar events, CRM records, Health summaries, or similar scoped results)
• Business context, use-case details, configurations, and evaluation inputs

Attachments and media

Chat photos and files may be stored locally on your device. When you send a message that includes attachments—or when an agent or run needs them—attachment bytes or extracted text may be transmitted to Caxion servers and to model providers to generate a response. Agent knowledge uploads (for example on Pro or Enterprise plans) are stored in cloud storage under your account.

Voice

Some features use voice. Discover live voice may stream audio to a cloud realtime provider (such as OpenAI) to power conversation. Some Platform speech features use on-device recognition where implemented. Do not assume that all voice processing stays on your device.

Connected services

If you connect third-party apps or device capabilities, we process the credentials, tokens, and scoped data required to provide that connection, subject to your permissions and the third party’s terms. Cloud connector tokens are stored securely on our servers. Apple device capabilities (such as Calendar, Contacts, or Photos) are accessed according to OS permissions you grant.

Payments and identifiers

Subscriptions and credit top-ups are processed through Apple (StoreKit) and RevenueCat. Apple handles payment card data. Caxion receives entitlement and subscription status and an app user identifier linked to your account—not full payment card numbers.

Permissions and device data

Depending on the features you enable, the native apps may request access to Notifications, Photos, Contacts, Calendar, Reminders, Health, Files/folder access, Microphone (voice), Motion (for shake-to-feedback), and App Attest or other device-integrity signals. Access is requested through OS prompts, and you can manage permissions in system Settings (and, where applicable, browser permission controls on the web).

Communications

We may process email addresses and related metadata to send transactional messages such as account verification, password reset, assessment result summaries, invites, and feedback acknowledgments. Optional marketing emails are sent only with affirmative consent and can be withdrawn via the unsubscribe link in those messages or by contacting us.

Website information

When you visit the marketing site at caxion.ai, our hosting providers may automatically receive standard log data such as IP address, browser type, and requested pages. The marketing website does not set analytics, advertising, or other optional cookies, does not load third-party tracking scripts, and does not expose private API keys or database credentials in client code. See our Cookie Policy for details. We do not show a cookie-consent banner because there are currently no non-essential cookies to consent to.

If you complete the interactive use-case assessment and choose to unlock results, we collect your email address, required consent acknowledgments (Terms and Privacy Policy), optional marketing preference, and your quiz answers. That information is stored on your Caxion user profile in our Firebase project (the same users collection used by the iOS apps) after email verification. We send a one-time verification code and a transactional results summary by email via our email provider (Resend). Marketing messages are sent only when you opt in; preferences live on the same user profile so unsubscribe applies consistently across products.

3. How we use information

We use information to:

• Provide, operate, and improve the Services (product improvement)
• Authenticate users and secure accounts
• Deliver requested features, agents, integrations, and voice modes
• Personalize experiences using memory and preferences you store
• Meter usage and credits, and manage entitlements
• Support governance, auditability, and product reliability
• Detect abuse, fraud, and security issues, and review feedback
• Send transactional communications and respond to requests
• Comply with legal obligations and enforce our terms

We do not sell personal information. Product improvement is separate from model training: we do not use customer content to train generalized public models unless you provide explicit, separate permission for a specific purpose. See Section 4 for how model providers process content to return outputs.

4. AI processing and model providers

To generate responses and run agents, we route prompts, context, and related content through our backend (for example Cloud Functions) to AI model providers such as OpenAI, Anthropic, Google, and xAI. The set of providers may change over time as we add or replace models.

Model providers process content to return outputs for your requests. We configure providers with settings intended to limit retention where available (for example, store-disabled options used with certain OpenAI or xAI integrations). Provider practices are governed by their own terms and data processing agreements and may change; we do not claim that vendors never train on or retain data beyond our configuration.

Caxion does not use customer content to train generalized public models without your explicit, separate permission for a defined purpose.

5. How we share information

Service providers and AI model providers

We share information with service providers that host, secure, deliver, or support the Services under contractual obligations, and with model providers required to process requests you initiate. Categories and examples include:

• Infrastructure: Firebase / Google Cloud (hosting, functions, storage, identity, App Check)
• AI model providers: OpenAI, Anthropic, Google, xAI (and others as configured)
• Email delivery: Resend
• Payments and entitlements: Apple and RevenueCat
• Push notifications: Apple Push Notification service (APNs) and, where used, Firebase Cloud Messaging (FCM)

A summary of subprocessor categories is published on our Trust & Security page. A more detailed current list is available on request at privacy@caxion.ai.

Other sharing

We may also share information with:

• Professional advisors, or authorities, when required by law or to protect rights and safety
• A successor entity in connection with a merger, acquisition, or asset transfer, subject to appropriate protections

Organization and sharing within the product is described in Section 9.

6. Memory, retention, and deletion

Memory

Preferences and facts you store (or that the Services save with your use of memory features) may be kept on your profile and reused to personalize later turns and agents.

Chat retention

Chat history is retained by default for approximately 90 days, unless an organization policy sets a different period.

Scheduled agents

Scheduled agents may run in the cloud on a schedule using stored memory, knowledge, and connector access you authorized—even when the app is closed.

Account deletion

You may delete your account through the in-app account deletion flow where available, or by contacting us. When an account is deleted, we delete or de-identify associated personal data that we no longer need, which typically includes the account profile, chats, agents, connections, and cloud knowledge stored under that user.

Some information may remain as reasonably necessary, such as feedback tickets, certain organization or tenant records, invite or audit artifacts, and legal or operational backups. Deleting your Caxion account does not cancel an active Apple subscription; you must manage or cancel subscriptions in your Apple Account / subscription settings. A RevenueCat subscriber record may be removed separately from Apple billing.

We otherwise retain information for as long as needed to provide the Services, meet legal and audit requirements, resolve disputes, and enforce agreements. Retention periods may vary by data type and account status.

7. Security

We use administrative, technical, and organizational measures designed to protect information. No method of transmission or storage is completely secure. Please protect your credentials and report suspected unauthorized access promptly.

8. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, or receive information about personal information we hold, or to object to or restrict certain processing. You may also withdraw consent where processing is consent-based. Contact privacy@caxion.ai to make a request. We do not currently offer a full self-serve data export portal.

You can manage app and browser permissions in system Settings. Disconnecting an integration stops future access through that connection but may not delete historical records required for audit or security, and does not unwind actions already taken in third-party systems.

Manage App Store subscriptions and billing in your Apple Account settings. Deleting the Caxion app or Caxion account does not by itself cancel Apple billing.

9. Organization and shared workspaces

If you use Caxion with an organization or shared workspace:

• Workspace administrators may access member, invite, audit, usage, and policy data associated with their workspace
• Shared Platform collaborators may see app content and activity according to their role
• Published or shared agent catalog entries may be visible to other signed-in users as designed in the product

10. Children’s privacy

The Services are intended for adults. Under our Terms, you must be at least 18 years of age (or the age of majority in your jurisdiction) to use the Services. The Services are not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from them. If you believe we have collected information from a child, contact us and we will take appropriate steps.

11. International transfers

Information may be processed in the United States or other countries where we or our providers operate. Where required, we use appropriate transfer mechanisms.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the effective date above and, when appropriate, provide additional notice. Continued use of the Services after an update means you accept the revised policy.

13. Contact

For privacy questions or requests, contact privacy@caxion.ai.

Related: Cookie Policy · Terms & Conditions · Trust & Security