Legal Document

Privacy Policy

Last updated: June 6, 2025

This Privacy Policy describes how GaxenLabs ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our website and services, including the lead capture form at our landing page (the "Service").

By submitting your personal data through our forms, you confirm that you have read, understood, and agree to this Privacy Policy.

1. Data Controller

GaxenLabs
Contact email: ilya@gaxenlabs.com

If you have any questions about data processing, please contact us at the email address above.

2. What Data We Collect

When you interact with our Service, we collect the following categories of personal data:

Data Type	Source	Purpose
Email address	Provided by you	Deliver requested materials; send marketing emails
Survey response (goal selection)	Provided by you	Personalize content and recommendations
UTM source	URL parameters (automatic)	Marketing attribution and analytics
Timezone	Browser API (automatic)	Optimize email delivery timing
Device / User-Agent	Browser (automatic)	Technical analytics; responsive design optimization
IP address	Server headers (automatic)	Fraud prevention; geographic analytics

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

Consent (Article 6(1)(a) GDPR; Article 9 of Federal Law No. 152-FZ): You explicitly consent to the processing of your data by checking the required consent checkboxes before submitting the form.
Legitimate Interest (Article 6(1)(f) GDPR): We may process certain technical data (IP address, device information) for fraud prevention and security purposes.

4. How We Use Your Data

We use your personal data for the following purposes:

To deliver the requested "AI Architecture Blueprint" to your email.
To send you educational insights, product updates, and marketing communications (only if you have given explicit consent).
To personalize the content based on your stated goals.
To analyze traffic sources, geographic distribution, and device usage for improving our Service.
To prevent fraud and ensure the security of our Service.

5. Data Storage and Third-Party Processors

Your data is stored and processed using the following third-party services:

5.1 Supabase (Database)

Your submitted data is stored in a PostgreSQL database hosted by Supabase, Inc. Supabase infrastructure is hosted on AWS in the US/EU region. Supabase complies with SOC 2 Type II standards.

5.2 Resend (Email Delivery)

We use Resend, Inc. to deliver transactional and marketing emails to your email address. Resend processes your email address solely for the purpose of delivering messages on our behalf.

5.3 Vercel (Hosting)

Our website and serverless functions are hosted on Vercel, Inc. Vercel may process your IP address and request metadata as part of standard web hosting.

6. Data Retention

We retain your personal data for as long as it is necessary for the purposes described in this policy, unless a longer retention period is required by law. Specifically:

Lead data (email, goal, analytics): retained for up to 24 months from the date of collection, or until you request deletion.
Technical logs (IP address, device data): retained for up to 12 months.

7. Your Rights

Under GDPR and FZ-152, you have the following rights regarding your personal data:

Right of access — request a copy of the data we hold about you.
Right to rectification — correct inaccurate or incomplete data.
Right to erasure ("right to be forgotten") — request deletion of your data.
Right to restrict processing — limit how we use your data.
Right to data portability — receive your data in a structured, machine-readable format.
Right to withdraw consent — withdraw your consent at any time without affecting the lawfulness of processing before withdrawal.
Right to object — object to processing based on legitimate interest.

To exercise any of these rights, contact us at ilya@gaxenlabs.com. We will respond within 30 days.

8. Unsubscribing from Emails

Every marketing email we send contains an "Unsubscribe" link in the footer. Clicking it will immediately remove you from our mailing list. You can also request removal by emailing us directly.

9. Cookies

Our landing page does not use cookies or any client-side tracking scripts (no Google Analytics, no Facebook Pixel, no tracking cookies). All analytics data is collected server-side at the moment of form submission.

10. Data Security

We implement appropriate technical and organizational measures to protect your data:

All data is transmitted over HTTPS (TLS 1.2+).
Database access is restricted via environment-scoped API keys.
Serverless functions run in isolated execution environments.
We do not store passwords or payment information.

11. International Data Transfers

Your data may be transferred to and processed in countries outside of your country of residence (including the United States). In such cases, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

12. Children's Privacy

Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected on this page with an updated "Last updated" date. We encourage you to review this page periodically.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

GaxenLabs
Email: ilya@gaxenlabs.com