Last updated: July 28, 2026.
This Privacy Policy explains how AXIX® di Simone Paciaroni (“AXIX”, “we”), Italy, processes personal data in connection with the HACCP.ai service (app.haccp.ai, api.haccp.ai) and this website (haccp.ai). HACCP.ai is a B2B service for food safety professionals; we do not offer it to consumers. Contact for anything in this policy: info@haccp.ai.
1. Who is responsible: our two roles
Controller. For your account, billing, usage, communications and website visits, the controller is AXIX® di Simone Paciaroni (Italy).
Processor. Data that you, as a consultant, upload about your own clients (“Client Data”) is processed on your behalf and under your instructions: for Client Data you are the controller and AXIX is your processor, under the Data Processing Agreement that forms part of your contract. Your own privacy notices to your clients apply.
2. Scope
We serve business customers, primarily in the United States, from infrastructure located primarily in the European Union. This Policy is drafted to meet the EU General Data Protection Regulation (GDPR), which applies because we are established in the EU. Section 9 addresses US state privacy laws.
3. What we collect (as controller)
- Account data: name, business email, firm name, role, password (hashed). Source: you.
- Website forms: waitlist and contact submissions (name, email, message) and HACCP Compliance Score submissions (name, email, role, country, and your final score). Source: you.
- Billing data (from the paid beta): plan, invoices; card data is held by Stripe, we never store full card numbers.
- Usage data: features used, document metadata, query logs, timestamps. Source: automatic.
- Technical data: IP address, browser and device info, error and security logs. Source: automatic.
- Communications: support requests, feedback, alpha program correspondence.
- Website analytics: pages visited and referrer via Google Analytics (aggregate statistics; see Cookies).
We do not intentionally collect special categories of personal data and we contractually prohibit uploading them.
4. Why we process it (legal bases)
- Providing and operating the Service and your account: contract (Art. 6(1)(b) GDPR).
- Responding to waitlist, contact and HACCP Score requests: steps at your request prior to a contract; legitimate interest.
- Billing, tax and accounting: contract and legal obligation.
- Security (abuse prevention, rate limiting, audit logs): legitimate interest in protecting the Service and its tenants.
- Service improvement on aggregated, de-identified usage: legitimate interest.
- Transactional email (signup, password reset, reminders you configure): contract.
- Product updates to business contacts: legitimate interest with opt-out in every message.
No AI training: we do not use your account data, prompts, or Client Data to train or fine-tune machine-learning models. No sale of personal data. No advertising use.
5. Automated decision-making
The Service generates draft documents and answers using AI, but no decision producing legal or similarly significant effects on a person is made automatically: every generated document requires review and signature by the professional user (an enforced draft → review → sign workflow).
6. Who receives data
- SiteGround: hosting of this website.
- Hostinger: backend hosting and vector store (EU).
- Supabase: database, authentication, file storage.
- Vercel: application frontend hosting.
- OpenAI: AI inference (generation, embeddings); API data is not used by OpenAI to train models.
- Stripe: payments (from the paid beta).
- Resend: transactional email.
- Google: website analytics.
Other recipients: professional advisers, authorities where legally required, and a successor entity in case of business transfer (with notice). For Client Data, the authoritative subprocessor list is in the DPA.
7. International transfers
Primary hosting is in the EU. Where a provider processes personal data in the United States or other third countries, we rely on the EU–US Data Privacy Framework where the provider is certified, and/or the EU Standard Contractual Clauses (2021/914) with supplementary measures as needed.
8. Retention
- Account data: life of the account, then up to 90 days after closure.
- Billing and tax records: 10 years (statutory retention).
- Usage and security logs: 12 months, then deleted or aggregated.
- Support communications: 24 months.
- Client Data (processor role): deleted on your instruction or at contract end; per-client deletion available in-product.
- Backups: rolling 30-day cycle; deleted data ages out within that window.
9. Your rights
Under the GDPR you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with a supervisory authority (for Italy: the Garante per la Protezione dei Dati Personali). US residents: depending on your state, consumer privacy laws (e.g. California CCPA/CPRA) may grant rights of access, deletion, correction and opt-out of sale or sharing: we do not sell or share personal data for cross-context behavioral advertising. Exercise any right at info@haccp.ai; we respond within one month, without discrimination.
If your data appears in another consultant’s Client Data, we will refer your request to that consultant (the controller) and assist them under the DPA.
10. Cookies
The application uses strictly necessary cookies (session and authentication). This website uses Google Analytics for aggregate traffic statistics. We do not use advertising cookies. A consent banner is active on this website: analytics and third-party embeds are blocked until you accept them, and refusing is as easy as accepting. You can change or withdraw your choice at any time from our Cookie Policy, which lists every cookie and service in use.
11. Security
Measures include per-tenant isolation with database-level Row Level Security, isolated vector collections per tenant, TLS in transit, encryption at rest, role-based access, server-side authorization gates, quota and rate limiting, security logging, an adversarial evaluation suite run as a release gate, and atomic per-client deletion. No system is perfectly secure; we notify affected parties of breaches as legally required.
12. Children
The Service is not directed to anyone under 18, and we do not knowingly process their data.
13. Changes
We will post updates on this page and, for material changes, notify account holders by email at least 30 days in advance. This policy will continue to be refined as our formal legal review completes.