Aixa Privacy & Cookie Policy

1. What data we collect

• Account information: name, email address.
• Login via Microsoft Entra ID (Azure AD B2B): when you sign in, Microsoft provides us with limited identity claims (first name, last name, display name, email, and a technical identifier such as an object ID). During setup, we also ask for your country.
• Account metadata: account ID, account creation date, last sign-in time.
• Authentication and security logs: Microsoft Entra ID automatically collects sign-in data, including IP addresses, device details, and risk assessments. These logs are stored securely by Microsoft on our behalf. Aixa does not duplicate full sign-in/IP logs in its own systems but may access them via Azure for security and compliance purposes.
• Usage data: basic technical diagnostics (e.g. error messages, request IDs) necessary to operate and troubleshoot the service.
• Analytics (only with consent): Google Analytics cookies (e.g. pages visited, time spent, aggregated usage). GA anonymises IP addresses, and analytics are disabled until you opt in.
• Support data: any information you provide when contacting us.

2. Why we process data (legal bases)

• Contractual necessity: to provide you with an account, authenticate logins, and deliver our services.
• Legitimate interests: to secure our systems, prevent misuse, and troubleshoot technical issues.
• Consent: for analytics tracking and for optional marketing communications.

3. Data sharing

• Hosting: Microsoft Azure (servers in Switzerland/EU).
• Authentication: Microsoft Entra ID (Azure AD B2B) logs and processes sign-in events.
• Analytics: Google Analytics (only with consent).
• We do not sell or rent personal data to third parties.

4. International transfers

• Data is primarily processed in Switzerland and the EU.
• Transfers outside these regions occur only if providers (e.g. Google, Microsoft) are subject to EU/Swiss adequacy decisions or bound by Standard Contractual Clauses.
• Some personal data may be processed outside Switzerland and the EU/EEA (e.g. in India, by our contracted development partner), under Standard Contractual Clauses and equivalent safeguards to ensure your rights are protected.

5. Data retention

• Account data: while account is active + up to 24 months after inactivity.
• Analytics data: max. 12 months (as configured in GA).
• Email data: until you unsubscribe.
• Authentication/security logs (Azure): retained by Microsoft according to their standard policies; Aixa does not extend or duplicate these logs.

6. Your rights

Under GDPR and the Swiss FADP you have the right to:

• Access, rectify, or erase your data.
• Restrict or object to processing.
• Withdraw consent at any time (for analytics or marketing).
• Request data portability.
• File a complaint with the FDPIC (Switzerland) or your local EU Data Protection Authority.

To exercise these rights, contact privacy@iamaixa.com.

7. Cookies & tracking

• Strictly necessary cookies: session cookies required for secure login — always active.
• Analytics cookies: Google Analytics — only set with your explicit consent via the cookie banner.
• Payment & fraud-prevention cookies: Stripe — loaded only when you open the billing or pricing interface, never on general browsing pages. Stripe.js may set __stripe_mid, __stripe_sid and m, and may process your IP address, device and browser identifiers, referring URLs and activity signals in order to secure payments and prevent fraud.

8. Contact

For any privacy-related questions or requests, email privacy@iamaixa.com.