Privacy Policy

PRIVACY POLICY AxiosCore Last updated: 31 October 2026 Effective from: 31 October 2026 ================================================================ 1. WHO WE ARE ================================================================ AxiosCore ("AxiosCore", "we", "us", "our") operates the AxiosCore platform, an online business management and appointment booking platform for beauty, wellness and personal care businesses, available at https://axioscore.im and any subdomains or custom domains used by our customers (the "Platform"). Legal entity: Doncho Ivanov t/a DEVer Studio Registered address: 17A Elm Drive, Onchan, Isle of Man, IM3 4EH Company number: N/A VAT / tax number: N/A Contact email: support@dever.im Privacy contact: support@dever.im We are the data controller for the personal data described in Part A below, and a data processor for the personal data described in Part B below. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have. We comply with the Isle of Man Data Protection Act 2018, which applies GDPR-equivalent standards. Where we process personal data of individuals in the United Kingdom or the European Economic Area, we also apply the requirements of the UK GDPR and the EU GDPR to the extent they apply to us. ================================================================ 2. OUR TWO ROLES — PLEASE READ THIS FIRST ================================================================ The Platform is a multi-tenant system. Every salon, barbershop, spa or similar business ("Studio") has its own separate account and its own separate data environment on the Platform. This creates two different roles for us: PART A — WE ARE THE CONTROLLER For data relating to the Studio account itself (the person who signs up for and manages a Studio account, and the staff members who are given access to it), we decide how and why the data is processed. In this respect we are the data controller. PART B — WE ARE A PROCESSOR FOR THE STUDIO For data about the Studio's own end customers ("End Customers") — the people who book appointments at that Studio — the Studio is the data controller and we act only as its data processor. This includes: - booking records (name, email address, telephone number, appointment details, service, staff member, price, notes); - appointment confirmation, cancellation and reminder emails we send on the Studio's behalf; - any notes, images or other content the Studio uploads about its End Customers. If you are an End Customer of a Studio, please direct any request about your booking data to that Studio first. We will assist the Studio in responding, but the Studio is responsible for your data. See section 12 for details. ================================================================ 3. PERSONAL DATA WE COLLECT ================================================================ 3.1 Data you give us when you create or manage a Studio account - Account data: full name, business name, email address, and password. - Authentication data: your user identifier, session and authentication tokens, and password hashes managed by our authentication provider. - Business profile data: business name, public URL (slug), business address, logo, gallery images, opening hours, services, prices, staff members and their working hours. - Billing data: your chosen plan, subscription status, trial dates, billing period, cancellation status, and the identifiers of transactions and subscriptions held by our payment provider. We do not receive or store your full card number, CVC or bank credentials — see section 7. - Communications: messages you send us by email, through the contact form on the website, or through the in-app support system, together with any files you attach. 3.2 Data about your staff members If you add staff members to your Studio account, you may provide their name, email address, telephone number, role, photograph, biography and specialties. You are responsible for having a lawful basis to provide this information to us. 3.3 Data about your End Customers When you use the Platform to manage bookings, the Platform stores the data you enter about your End Customers, including their name, email address, telephone number, appointment history, service selected, assigned staff member, price, status and any free-text notes you add. 3.4 Data collected automatically - Technical data: IP address, browser type and version, device type, operating system, referring page, and the pages and features you use. - Log data: timestamps, request information and error diagnostics, used for security, debugging and abuse prevention. - Push notification data: if you enable browser push notifications, we store a push subscription endpoint and associated technical keys, together with your browser's user-agent string, so that we can deliver notifications to your device. - Cookie and similar technology data — see our Cookie Policy at https://axioscore.im/cookies 3.5 Data we receive from third parties - Payment provider data: subscription and transaction identifiers, plan, payment status, billing dates and, where relevant, tax information, received from our payment provider. - Payment account data (Studios that connect an external card terminal account): connection status, merchant identifier and related technical tokens received from that payment provider when a Studio links its own payment account. We do not intentionally collect special category data (such as health data). If you choose to record such information in free-text notes about an End Customer, you do so as the controller of that information and you are responsible for having a lawful basis and appropriate safeguards for it. ================================================================ 4. WHY WE USE YOUR DATA AND OUR LAWFUL BASES ================================================================ Purpose | Lawful basis -----------------------------------------------|-------------------------- Creating and managing your account, providing | Performance of a contract the booking and business management features | -----------------------------------------------|-------------------------- Processing subscription payments and managing | Performance of a contract trials, upgrades, downgrades and cancellations | -----------------------------------------------|-------------------------- Sending service and transactional emails | Performance of a contract (booking confirmations, cancellations, | reminders, account and billing notices) | -----------------------------------------------|-------------------------- Providing customer support | Performance of a contract / | legitimate interests -----------------------------------------------|-------------------------- Securing the Platform, preventing fraud and | Legitimate interests / abuse, enforcing our Terms | legal obligation -----------------------------------------------|-------------------------- Maintaining, debugging and improving the | Legitimate interests Platform and its performance | -----------------------------------------------|-------------------------- Sending browser push notifications you have | Consent opted in to | -----------------------------------------------|-------------------------- Sending marketing or product news | Consent or legitimate | interests (with an | unsubscribe option in every | message) -----------------------------------------------|-------------------------- Complying with tax, accounting and other legal | Legal obligation requirements | -----------------------------------------------|-------------------------- Establishing, exercising or defending legal | Legitimate interests claims | -----------------------------------------------|-------------------------- Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may object to processing based on legitimate interests at any time (see section 12). ================================================================ 5. EMAILS WE SEND ================================================================ Transactional emails (sent because the service requires it, not for marketing): - account and signup related notices; - booking confirmations and cancellations (to End Customers, on behalf of the Studio); - appointment reminders (to End Customers, on behalf of the Studio); - subscription, trial, payment, cancellation and billing notices; - support replies. Marketing emails are sent only where we have a lawful basis to do so, and every marketing email contains a way to unsubscribe. ================================================================ 6. COOKIES AND SIMILAR TECHNOLOGIES ================================================================ We use cookies and similar technologies (such as local storage and session storage) to keep you signed in, to remember your choices, to secure the Platform and to measure and improve it. Full details, including the name, purpose and duration of each cookie, are set out in our Cookie Policy at https://axioscore.im/cookies. We currently do not set any analytics or advertising cookies. If we introduce them in future, they will only be loaded after you have given your consent through our cookie banner, and you will be able to change or withdraw your consent at any time. ================================================================ 7. PAYMENTS AND CARD DATA ================================================================ Subscription billing is handled by our payment provider, Paddle.com Market Ltd and its group companies ("Paddle"), which acts as the merchant of record for subscription payments. Paddle collects and processes your payment details, including card data, directly. We never receive or store your full card number, CVC or bank credentials. We receive only the information we need to operate your subscription, such as the subscription identifier, plan, payment status and billing dates. Within our commitment to data minimisation, temporary signup passwords that are stored before an account is created are encrypted in our database using AES-256-GCM, and are deleted or invalidated automatically after 24 hours or once the account is created. Studios may connect their own third-party payment account (for example, a card terminal account) to accept payments from End Customers. In that case, End Customer payment card data is processed by that payment provider directly under the Studio's own agreement with them. We do not store End Customer card data. ================================================================ 8. WHO WE SHARE DATA WITH ================================================================ We share personal data only where necessary, and only with organisations that process it on our behalf under written terms, or where we are legally required to do so. Our current service providers are: - Supabase — database, authentication, and file storage. Stores account, Studio, staff, booking, gallery image and subscription records. - Paddle — subscription billing, payment processing, invoicing, tax calculation and merchant-of-record services. Acts as an independent controller for its own regulatory obligations. - Resend — delivery of transactional emails (account, booking, reminder, support and billing emails). - Vercel — application hosting, content delivery and infrastructure logging. - SumUp (where a Studio connects its own SumUp account) — processing of End Customer payments made directly to that Studio. - Legacy billing providers (Stripe and/or Braintree) — retained only for historical subscription and transaction records created before our migration to Paddle. Not used for new subscriptions. - Third-party embedded content — some Studio pages may embed external content, such as a Google Maps location map. When that content loads, the relevant third party may receive your IP address and set its own cookies. See our Cookie Policy. - Professional advisers, insurers and authorities — where necessary to comply with law, enforce our Terms, or protect our rights, property or safety, and the rights of our users. We do not sell your personal data, and we do not share it for cross-context behavioural advertising. ================================================================ 9. INTERNATIONAL TRANSFERS ================================================================ Our service providers may store or process personal data outside the country in which you live. Where personal data is transferred outside the Isle of Man, the United Kingdom or the European Economic Area, we rely on appropriate safeguards, such as standard contractual clauses or an equivalent lawful transfer mechanism offered by the relevant provider. ================================================================ 10. HOW LONG WE KEEP DATA ================================================================ - Account, Studio, staff, service and booking data: retained for as long as the Studio account is active, and then for a limited period afterwards as needed for backup, dispute resolution, and legal or accounting requirements. - Temporary pending signup records (including the encrypted temporary password): automatically expire 24 hours after creation, and are marked as used once the account is created. - Billing, invoice and tax records: retained as long as required by applicable tax and accounting law. - Security and server logs: retained for a short, limited period for security and troubleshooting. - Support tickets and messages: retained for as long as needed to handle the request and to maintain a record of our dealings, then deleted or anonymised. - Push notification subscriptions: retained until you disable notifications or the subscription becomes invalid. When data is no longer needed, we delete it or anonymise it. ================================================================ 11. SECURITY ================================================================ We use technical and organisational measures designed to protect personal data, including: - encryption in transit (HTTPS/TLS) for all traffic to and from the Platform; - encryption at rest for stored data and for sensitive fields; - encryption using AES-256-GCM for temporary signup passwords; - row-level security in our database, so that each Studio can access only its own data, with strict separation between tenants; - role-based access control, so that Studio owners, staff members and platform administrators have different levels of access; - column-level restrictions and access controls that limit exposure of personally identifiable information and payment integration tokens; - auditability of administrative access, including our use of a read-only support impersonation mode. No method of transmission or storage is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, the affected individuals, without undue delay. ================================================================ 12. YOUR RIGHTS ================================================================ Subject to applicable law, you have the right to: - be informed about how we use your personal data; - access a copy of your personal data; - have inaccurate or incomplete personal data corrected; - have your personal data erased; - restrict or object to certain processing; - receive your personal data in a portable, machine-readable format, or have it transmitted to another controller; - withdraw consent at any time, where we rely on consent (for example, for push notifications or marketing emails). Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal; - lodge a complaint with a supervisory authority. To exercise your rights, contact us at support@dever.im. We will respond within the period required by applicable law, normally within one month. We may ask you to verify your identity before we act on your request. If you are an End Customer of a Studio: your booking data is controlled by that Studio, not by us. Please contact the Studio directly. If you contact us, we will forward your request to the Studio and assist it in responding, as required by law. Complaints: you have the right to complain to the Isle of Man Information Commissioner (the supervisory authority for data protection in the Isle of Man). If you live in the United Kingdom or the European Economic Area, you may also complain to your local supervisory authority. We would appreciate the chance to address your concern first. ================================================================ 13. CHILDREN ================================================================ The Platform is a business tool intended for use by adults. Accounts may only be created by individuals who are at least 18 years old and able to enter into a binding contract. We do not knowingly collect personal data from children. If a Studio records information about a minor as part of a booking, the Studio is responsible for obtaining any required parental or guardian consent and for complying with applicable law. ================================================================ 14. AUTOMATED DECISION-MAKING ================================================================ We do not make decisions about you that produce legal effects, or similarly significant effects, based solely on automated processing. We may use automated checks for security, fraud prevention and abuse detection; these are reviewed by humans where they could materially affect you. ================================================================ 15. CHANGES TO THIS PRIVACY POLICY ================================================================ We may update this Privacy Policy from time to time, for example to reflect changes to our services, our providers, or the law. When we make material changes, we will notify you by email or through the Platform, and we will update the "Last updated" date above. Continued use of the Platform after an update means you accept the updated Privacy Policy. ================================================================ 16. CONTACT ================================================================ For any question about this Privacy Policy or about how we handle personal data: Email: support@dever.im Post: Doncho Ivanov t/a DEVer Studio, 17A Elm Drive, Onchan, Isle of Man, IM3 4EH For data protection enquiries, please use the subject line "Data Protection". ================================================================ END OF PRIVACY POLICY ================================================================