This policy explains how AiroX handles personal information collected through the AiroX marketing website, application, demonstrations, support channels and related business communications. It applies to website visitors, prospective customers, customer administrators and authorised users.

A customer organisation controls the business and emissions data its users submit to AiroX. That organisation is responsible for deciding who may use its workspace and for ensuring that it has authority to provide the information it uploads. AiroX processes that information to provide the contracted service.

We collect information you provide, information created while you use AiroX, and limited technical information needed to operate the service.

• Contact and account details, including your name, work email address, company, job information, phone number when supplied, login details and support messages.
• Organisation and service data, including company structure, reporting boundaries, user roles, activity records, evidence, approvals and emissions-accounting information entered by you or your organisation.
• Usage and audit information, including sign-in events, actions taken in a workspace, device and browser information, approximate location derived from network information, and diagnostic logs.
• Commercial and transaction information, including the selected plan, billing contact, invoices and payment status. Payment providers may process payment credentials directly; AiroX does not need to store full card details.

We use information to provide and administer AiroX, create and secure accounts, calculate and report emissions, maintain role-based access and audit trails, process subscriptions, respond to enquiries, deliver support, diagnose faults, improve the service, prevent misuse and meet our legal obligations.

We may send operational messages about an account, security, billing or material service changes. We send promotional communications only where permitted, and you can opt out of those messages at any time. We do not sell personal information.

Where data-protection law requires a basis for processing, we rely on the steps needed to enter into or perform a contract, compliance with legal obligations, consent where requested, and legitimate interests such as operating a secure business service, supporting customers and improving AiroX. We consider the impact on individuals before relying on legitimate interests.

We share information only as needed with vetted providers that support hosting, databases, authentication, email, payments, monitoring, customer support and professional advice. Those providers may use information only to perform their services for us and must protect it appropriately.

We may also disclose information where required by law, to protect AiroX, our customers or others, in connection with a corporate transaction, or when you direct or authorise us to do so. Customer workspaces are tenant-isolated and are not made available to other customers.

Some service providers may process information in countries other than the country where it was collected. When information is transferred internationally, we use contractual, technical and organisational safeguards appropriate to the information and applicable law.

We retain information for as long as it is reasonably needed to provide AiroX, maintain business and security records, resolve disputes and meet contractual or legal obligations. The period depends on the type of record, why it was collected and the customer's instructions. When information is no longer needed, we delete it, anonymise it or securely isolate it until deletion is possible.

AiroX uses administrative, technical and organisational controls designed to protect information. These include tenant isolation, role-based access scoped to an organisation's tree, hashed credentials, rate-limited sign-ins, audit logging, controlled administrative access and secure infrastructure practices.

No online service can guarantee absolute security. Customers must protect their credentials, assign access carefully and notify us promptly through the Contact page if they suspect unauthorised access.

AiroX uses essential storage and similar technology where needed for sign-in, security, preferences and core service operation. The marketing website does not currently use advertising cookies. If we introduce optional analytics or advertising technology, we will provide any consent controls required by applicable law and update this policy.

Depending on applicable law, you may be able to request access to personal information about you, ask us to correct or delete it, object to or restrict certain processing, withdraw consent, or request a portable copy. You may also complain to the relevant data-protection authority.

Submit a request through the Contact page. We may need to verify your identity and, where your account is managed by an organisation, coordinate with that organisation. Some requests may be limited by legal, security or record-keeping requirements.

AiroX is a business service and is not directed to children. We do not knowingly seek personal information from children through the website or application.

We may update this policy when AiroX, our providers or applicable requirements change. The effective date at the top of this page shows when the current version took effect. For privacy questions or requests, use the Contact page and identify the organisation associated with your account where relevant.