Who is responsible
The data controller is A.MORVAN, a SASU whose registered office is at 12 avenue Le Nôtre, 78170 La Celle-Saint-Cloud, France. The legal notice gives its full registration details. Contact: support@axolo.design.
What we record
| Account | Your name, email address and sign-in data, to give you access to your workspaces. |
| Your content | Projects, screens, prototypes, comments and the design systems you import (components, tokens, rules), to provide the service. |
| Connections | The apps you authorize, such as Claude: the workspace or project you chose, read-only or read-write access, and the expiry date. Access tokens are stored only as a SHA-256 fingerprint. |
| Technical logs | IP address, time, and the action or tool called, for security, rate limiting and troubleshooting. |
Using Axolo from Claude
When you connect Axolo to Claude, you sign in to Axolo and choose what Claude may access. Claude then sends Axolo the parameters of the tools it calls, and Axolo returns the requested content, such as a list of components or a screenshot of a screen.
Axolo does not receive your conversations with Claude, and does not read Claude's memory, chat history or files. How Anthropic processes your conversations is governed by Anthropic's own privacy policy.
You can revoke Claude's access at any time, from Axolo (account settings, connections) or from Claude's connector settings.
Why, and on what legal basis
To provide the service you signed up for: performance of a contract, Article 6(1)(b) GDPR. To secure access and prevent abuse: legitimate interest, Article 6(1)(f). We do not sell your data, show advertising, or use your content to train AI models.
How long we keep it
| Account and content | As long as your account is active, then deleted within 30 days of closing it. |
| Claude access | An access token lasts 1 hour; the connection is renewed for up to 30 days without use, and never beyond the duration you chose (1, 30 or 90 days). |
| Technical logs | Up to 30 days. |
Who receives what, and where
Transfers outside the European Union are governed by the European Commission's standard contractual clauses or by the EU-U.S. Data Privacy Framework.
| Railway Corporation | Runs the Axolo server and its technical logs. United States. |
| Supabase, Inc. | Database, file storage and sign-in. United States. |
| Cloudflare, Inc. | Delivers the app and filters attacks. United States. |
| GitHub, Inc. | Only if you connect a repository: reads and writes the files you ask for. United States. |
Your rights
You have the right to access, rectify, erase, restrict, object to and port the data concerning you. Write to support@axolo.design; we reply within 1 month. You can refer the matter to the CNIL, the French data protection authority, on cnil.fr.
Security
Connections are encrypted in transit. Claude signs in through OAuth 2.1 with PKCE; Axolo never sees your Claude password, and Claude never sees your Axolo password. Access rights are checked again on every call.
Changes
The date at the top shows the latest version. Changes that affect your rights will be announced in the app.