AX Audit Privacy Policy

When you use AX Audit or WebMCP Audit, we collect:

• Scan data: the URL you scan, every AX/WebMCP check result, scores, grades, timestamps, response headers, page content and structure we fetch, and any agent-simulation transcripts we run against that URL.
• Lead/contact data: the email address you provide to receive a free report or unlock a full report, and any UTM/source metadata about how you arrived at AX Audit.
• Account data: if you sign in (AX Audit shares AINative's platform-wide account system), your name, email, plan, workspace and client data, API keys you create, and your usage history across AX Audit and other AINative products.
• Technical data: IP address, browser/device information, and standard web server logs.

We use, license, and monetize the data described above — including personal information — in whatever manner we determine serves AINative's business, including but not limited to:

• Training AI models: scan data, agent-simulation transcripts, and aggregated or individual usage data may be used to train, fine-tune, or evaluate AI models, whether built by AINative or a third party we license the data to.
• Selling and licensing: we may sell or license scan data, lead data, and account data — including personal information such as email addresses — to third parties, on terms we determine.
• Partnering: we may share or jointly commercialize this data with frontier AI labs, corporations, developers, and government entities, including for research, product development, benchmarking, or compliance purposes.
• Operating and improving AX Audit: running your scans, generating your reports, sending the emails you requested, maintaining the public leaderboard, and improving our scoring and products.

This is a real, binding statement of intent, not boilerplate — we are telling you upfront, before you use the product, that your data is a commercial asset to us.

We may share or license data described in this policy with, among others: frontier AI labs and AI research organizations; corporations and developers building on or integrating with agent-readiness, WebMCP, or related data; government agencies and public-sector bodies, including for research, policy, or regulatory purposes; and service providers who process data on our behalf. We do not maintain an exhaustive public list of every partner, and reserve the right to enter new data licensing, sale, or partnership arrangements at our discretion.

If you are in the EU/UK, our legal basis for processing includes your consent (given by using AX Audit after reading this policy), our legitimate interests in operating and monetizing the product, and contractual necessity where you have an account. You have rights under GDPR to access, correct, delete, or port your data, and to object to or restrict certain processing — see "Your choices" below.

If you are a California resident, you have the right under the CCPA/CPRA to know what personal information we sell or share, to opt out of that sale or sharing, and to request deletion. We treat the practices in Section 2 as a "sale" and "sharing" of personal information under California law. Use the opt-out mechanism in Section 5 to exercise this right; we will not discriminate against you for doing so, though opting out may mean we can no longer offer you the free tier of AX Audit, since that tier is funded in part by the data practices described here.

To opt out of having your personal information (not aggregate/scan data about public sites) sold, licensed, or used for AI training, email privacy@ainative.studio with the subject "AX Audit data opt-out" from the email address associated with your scans or account. We will process opt-outs within 15 business days and will not sell or license your personal information prospectively from that point, though data already licensed to a third party before your opt-out cannot be recalled from that third party.

To request deletionof your account and associated personal data, email the same address with subject "AX Audit data deletion." Deletion does not retract data already licensed or incorporated into a trained model before the request.

Opting out or requesting deletion does not affect scan data about a public website's technical structure where that data is not tied to your identity — see Section 6.

When you scan a domain you do not own or control, AX Audit collects data about that public website — its robots.txt, structured data, API documentation, and similar technical, non-personal signals. This is not personal information about you, and the opt-out in Section 5 applies to your own identity and account data, not to the scan results of public websites in our corpus (including the public leaderboard). If you believe a scan of your own domain contains personal information that should not be public, contact us using Section 10.

We use industry-standard safeguards to protect data in transit and at rest. We retain scan, account, and lead data for as long as needed for the purposes in Section 2, or until you exercise the rights in Section 5, whichever is later for data not yet licensed to a third party.

AX Audit is not directed at children under 16, and we do not knowingly collect their data.

We may update this policy at any time. Material changes will update the "Last updated" date above; continued use of AX Audit after a change constitutes acceptance.

Questions, opt-outs, or deletion requests: privacy@ainative.studio. See also the platform-wide ainative.studio Privacy Policy and Terms of Service, which govern AINative products generally except where this policy controls for AX Audit/WebMCP Audit data as stated above.