How we handle your data

1. Introduction

Axy is the company behind K-Git, a concept-mapping tool for science. This privacy policy explains what data we collect through our marketing site at axy-app.com, how we use it, and the choices you have. It applies to anyone who visits the site, joins the waitlist, or otherwise interacts with the page.

We're a small team that takes privacy seriously: K-Git is built for researchers, and researchers expect us to be careful with their data. Our default posture is to collect as little as possible, store it on EU-based infrastructure, and explain everything in plain language.

2. What data we collect

Waitlist form

When you submit the waitlist form, you voluntarily share:

• Your full name
• Your institutional or professional email address
• Your primary field of research

If you arrived via a referral link, we also record the referral code so the person who shared the link can be credited. The referral code itself is an opaque slug — it does not identify the referrer to anyone other than us.

Analytics

We use PostHog to understand how people use the site. PostHog captures pageviews, clicks, page-leave events, the page that referred you to us, and high-level device/browser information (browser family, operating system, viewport size, approximate country derived from IP — we do not store the full IP address long-term).

Session replay (only with consent)

If you accept cookies, PostHog also records an anonymised replay of your session so we can spot UX problems. Form inputs are masked in every recording — names, email addresses, and any free-text field you fill in are never visible to us in replays. Without your consent, no replays are recorded at all.

Cookies

See section 4 below for the full cookie list. In short: we use one functional cookie to remember your consent choice, and a set of PostHog analytics cookies that are only set if you accept.

3. How we use the data

• Waitlist management. We use your name, email, and field of research to evaluate applications, communicate with you about the K-Git launch, and onboard you to the product when your cohort opens.
• Traffic and engagement. Aggregated analytics help us understand which pages and messages resonate so we can improve the site.
• User-experience improvements. Session replays (when you've consented) let us identify usability issues — confusing copy, broken layouts, friction in the signup flow — and fix them.

We do not sell your data. We do not share it with advertisers. We do not use it to target ads.

4. Cookies

Our site runs in cookieless mode by default. Basic analytics — pageviews, clicks, page-leave — work without setting any cookies and don't require your consent. Cookie-based features (cross-session identification, session replay) only turn on if you accept cookies on the banner.

To change your cookie preferences, clear the axy_cookie_consent cookie in your browser (or clear site data for axy-app.com) and refresh the page — the banner will reappear and you can make a new choice.

5. Third-party services

We rely on a small number of third-party providers. Each is contracted as a data processor and stores data on EU-based infrastructure where the option is available.

• PostHog Cloud (EU region) — analytics and session replay. PostHog data is hosted on EU servers.
• Waitlister — manages our waitlist. When you submit the form, your name, email, and field of research are sent to Waitlister via our own server, never directly from your browser.
• Vercel — hosts and serves the site. Vercel sees standard request logs (IP address, user agent, URL) as part of normal infrastructure operation.

6. Data storage and security

All personal data we collect is stored on EU-based servers provided by the third parties listed above. Data is encrypted in transit (HTTPS everywhere) and at rest by our providers' infrastructure. Access to production systems is restricted to a small number of team members and is logged.

No system is perfectly secure, and we won't pretend otherwise. We work to keep your data safe, and if we ever become aware of a breach that affects you, we will notify you in line with our GDPR obligations.

7. Your rights under GDPR

If you are in the EU, UK, or another jurisdiction that grants equivalent rights, you have the right to:

• Access the personal data we hold about you.
• Rectification — correct any inaccurate or incomplete data.
• Erasure — ask us to delete your data ("the right to be forgotten").
• Restriction — limit how we process your data.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on our legitimate interests.

To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.

8. Data retention

• Waitlist data — kept until product launch and initial onboarding, or until you ask us to delete it, whichever comes first.
• Analytics data — retained for up to 12 months, then aggregated or deleted.
• Session replay data — retained for 30 days (PostHog's default), then deleted.

9. Changes to this policy

If we make material changes to this policy — for example, adding a new third-party service, or changing how long we keep data — we will update the effective date at the top of this page and, where appropriate, notify you by email.

10. Contact

Questions about this policy or your data? Email [email protected].