Privacy Policy

This Privacy Policy explains how Mahlum Innovations LLC ("Mahlum," "we," or "us") collects and uses personal information when you visit Axiom Helm or use its application, APIs, and related services (the "Service").

1. Who we are and scope

Mahlum Innovations LLC is a Montana company in the United States that operates Axiom Helm. This notice covers the public website, account and workspace features, browser voice, support, and connections that a customer chooses and authorizes. A third-party provider may also process data under its own terms. If a customer uses Axiom Helm for personal information about other people, that customer is responsible for having an appropriate legal basis and instructions.

A business using the Service may act as controller and Mahlum may act as processor for customer content. The general Data Processing Addendum is a separate draft. Viewing this public page does not form an executed DPA.

2. Information we process

Axiom Helm is not intended for protected health information (PHI) or other regulated health records. Customers must not provide it, including through accounts they connect. Health information is not knowingly processed as a HIPAA business associate. Axiom Helm is not HIPAA compliant and Mahlum Innovations LLC does not offer a Business Associate Agreement for it. No protected health information.

• Account and authentication data: Clerk account identifier, email, name and profile details supplied through sign-up/sign-in, authentication/session and security events, and the invitation/account state needed to operate access.
• Business and workspace information: records, objectives, leads, invoices, messages, documents, drafts, account notes, approvals, and other content that users create, connect, upload, or submit. The fields depend on the selected feature.
• Formation information: business and personal information a customer chooses to submit for a supported formation or filing, which may include member identity, addresses, ownership, agent, EIN, or classification information. A filing submission and government acceptance are different events.
• Connected-account information: connection identifiers, granted permissions, and the data made available by the specific Google, Microsoft, CRM, finance, email/calendar, storage, CMS, social, or other supported account and feature. A provider appearing in our code or this notice does not mean your account is connected.
• Model, research, and voice inputs: task prompts and the portion of workspace content needed to carry out a customer request; search queries sent to the selected grounded research provider; and, when an operator starts web voice, the requested audio turn and reply text.
• Billing and payment information: Stripe subscription and invoice identifiers, billing status, and limited card information Stripe displays to the Service. Axiom Helm's billing display does not expose full card numbers or CVCs. A separate customer payment integration can involve transaction details within its authorized scope.
• Support, usage, and security information: support requests, service state transitions, agent activity, approval outcomes, delivery receipts where supplied, request route/status/latency, and network or browser data needed for security and operation.
• Text ATLAS: if enabled, mobile number, associated account, verification, opt-in/STOP consent status, consent time/source/text version, and inbound/outbound message and delivery details.
• Browser-stored information: voice transcript history may be stored in the browser for the signed-in user and selected workspace; consent and display preferences may also be saved in the browser. Browser-stored information is not, by itself, server-side cross-device synchronization.

Waitlist: when you join the waitlist we collect your name, email, and company, plus any optional details you choose to give (website, role, industry, team size, needs, current tools, phone, and how you heard about us). We also record a referral code if you arrived through someone's share link, UTM campaign tags from the link you followed, and the page path where you signed up. These records are kept in our customer relationship (CRM) records to plan invitations and understand which channels bring owners to us. We send waitlist and launch emails only with your consent, and every email includes an unsubscribe link; unsubscribing stops those emails. We keep waitlist records until you are invited and onboarded or until registration needs no longer require them, and you can ask us to delete your waitlist record at any time through data deletion or by contacting us.

3. Optional Google access and Limited Use

Signing in with Google provides the basic identity/profile data required for authentication. It does not by itself authorize Google Drive, Gmail, Calendar, Analytics, Search Console, Business Profile, or Ads access. Those product features require their own connection, selected account, permissions, setup, and user authorization.

The scope of Google information depends on the connected feature. A feature may process Google account and resource identifiers; Gmail or calendar items; Drive files/metadata; Analytics/Search Console metrics; Business Profile data; or Ads account information. Access is limited by the permission and task actually selected. Disconnecting does not mean historical copies have been deleted.

Axiom Helm's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use information

• Provide, secure, maintain, troubleshoot, and support the Service and the features a customer enables.
• Authenticate users, scope workspace access, record approvals and outcomes, and protect accounts and systems.
• Carry out a customer-authorized operation, deliver email or SMS requested by the user, or transfer selected information to a third-party account or filing service.
• Respond to support/privacy requests, apply communication and analytics choices, and comply with legal duties.
• Measure product use or improve the Service only as described here and subject to the feature and consent controls that apply.

GDPR and UK GDPR lawful bases: Where those laws apply and Mahlum acts as controller, the relevant basis depends on the purpose. We rely on performance of a contract for requested account and service functions; legal obligations for required accounting, legal and regulatory records; and legitimate interests for security, abuse prevention, service maintenance and responding to support, subject to the required balancing of your rights and interests. Optional analytics and company identification rely on consent, and Text ATLAS requires the separate opt-in described below. You can withdraw an optional consent through the applicable controls without affecting the lawfulness of processing before withdrawal. Where we process customer content as a processor, we follow the customer's authorized instructions; the customer must establish the applicable lawful basis. These bases do not authorize an otherwise unapproved connection or action.

Connected mail and calendar AI choices

For a newly connected mailbox, AI sorting and ATLAS reading are on by default, with visible switches to opt out during connection or in Settings. Calendar AI assistance also starts on by default. Reconnecting the same verified mailbox or calendar account keeps its saved AI choices. Turning AI reading off does not remove ordinary provider reading needed for the human Inbox or Calendar.

Mail history defaults to all mail. Calendar reading covers available past and future events across connected calendars, including recurring-series records; display expansion is limited to the period you view. Older records load in the background. A connected account does not prove that its import is complete.

Full owner read access covers the owner's current and future personal mail/calendar sources, not teammates' sources. Turn it off in Preferences before narrowing individual sources. Reading or sorting does not authorize sending messages, calendar writes, notifications, or other external actions; separate permissions and required approvals still apply. Opening an email does not change its Gmail/Outlook read state unless you opt into that setting or deliberately mark it read. Existing disconnect, retained-data, deletion, and owner-access controls remain available in Preferences.

Counsel review required: Review these default-on AI and historical-data disclosures together with the patient-information restriction. This wording is not legal approval.

5. AI models, research, and provider training

Mahlum does not train its own general-purpose models on customer workspace content. When a model task is requested, the selected route may send prompts and relevant workspace content to an AI provider. Axiom Helm can use direct Anthropic and OpenAI response routes, Replit model routes, and OpenRouter routes, including routes to Claude, Grok, or Llama models. A model brand does not identify the processing company, endpoint, billing plan, or terms for a particular request.

We do not make a blanket claim that every outside AI provider is contractually barred from training on customer content, that every endpoint has zero-data-retention, or that no human review can occur. Provider rules differ by route and billing plan. For example, consumer/free and commercial/API terms can have different training, retention, and review conditions. The billing or plan status of every configured provider has not been verified. Do not submit highly sensitive information to a model route unless your organization has separately verified that route and its applicable terms.

Grounded Gemini is used for research/search tasks, not as the ordinary ATLAS agent-chat model route. Search providers may receive the query or URL needed for the requested task. A specific route depends on current configuration; a provider key in server configuration does not show which route handled a particular request.

6. When we disclose information

We disclose data to the providers and recipients needed for the Service or for an action the customer directs, including authentication, hosting/storage, database, billing, email/SMS, AI/research, voice, and separately connected apps listed in the Subprocessors Register. A selected provider receives only the input required by its feature, but the provider may process data under its own applicable contract and privacy terms.

• To a provider account or government filing office when an authorized user directs a supported filing, email, finance, CRM, social-publishing, CMS, or other connected workflow.
• To service providers acting for Mahlum, subject to the applicable configuration and contract. The provider register distinguishes current service paths from optional and planned paths.
• For legal compliance, security, abuse prevention, or protection of rights where disclosure is permitted or required by law.
• As part of a corporate transaction, subject to applicable confidentiality and privacy safeguards.

We do not sell personal information or share it for cross-context behavioral advertising. Text ATLAS information is not shared for third-party marketing.

7. Cookies, analytics, and public-site signals

Google Analytics 4 measures public marketing page views only after optional analytics consent. It is not loaded in authenticated app or admin areas. Our page-view events omit query strings, fragments and private-page referrers. Google may process browser, device and network information for these measurements. Rejecting optional analytics or enabling a browser Do Not Track or Global Privacy Control signal keeps this Google tag off.

Authentication and security storage, hosting/routing mechanisms, and contact-form abuse protection support essential functions and are separate from optional analytics. Google Fonts are requested on public pages and may receive network request information, including IP address. These font requests are not analytics and are not controlled by the analytics preference.

PostHog is optional product analytics and loads only after the visitor allows analytics in cookie preferences. Snitcher is optional company identification on eligible public marketing pages and the exact root sign-in/sign-up pages, only after the shared analytics choice and its current versioned notice are recorded in the same preference flow. Snitcher estimates an associated company from a network IP; it is not an individual identity provider. Automatic form-field capture is disabled. Only allow-listed name, email, and company fields from a voluntary successful public form or eligible first-party signup may be transmitted with the required choices active. Credentials, sign-in details, and private-app content are excluded. See the Cookie Notice for storage names, choices, and signals.

Replit published-traffic analytics is a separate, cookieless hosting feature an operator may enable in publishing settings. It is not controlled by this site's optional browser analytics setting.

8. Retention

We keep information for the time needed to provide the Service, administer a customer account, honor a request, resolve disputes, secure the platform, and meet lawful accounting or other duties. Different categories and third-party providers have different retention rules.

• Workspace and connected-account records are retained while needed for the account or requested feature. Disconnecting a connector historically removed local access in some features without removing all collected historical information. The new privacy workflow reports local removal and provider cleanup as separate work rather than asserting that disconnection deleted every copy.
• Billing, tax, legal, and security records may remain after account closure when required for a legal purpose. We will explain any applicable retained category in a request status or response.
• Replit's public service documentation reports default database backup coverage of 7 days on Core and 28 days on Pro/Enterprise, with configurable retention. Replit deployment and audit log retention is documented as 30 days. These are provider defaults, not a representation of our actual workspace tier, tenant configuration, independent database backups, or third-party provider retention. The actual configuration must be checked before a contractual commitment is made.
• We have not verified a universal expiration schedule for every application record, connected-provider copy, third-party backup, voice-provider record, email/SMS record, or security log. We do not claim a 35-day global backup rule or a 13-month log window.

9. International processing and provider locations

Mahlum is operated in the United States. This does not mean that every listed provider processes all data in the United States. Provider, endpoint, account, support, and subprocessor locations are not comprehensively verified in the deployment or executed-contract records available for this disclosure. The Subprocessors Register identifies known unknowns instead of representing an unverified residency guarantee. Contact us before using the Service if a particular residency commitment is required.

Where applicable law requires a transfer mechanism, the parties must complete the necessary transfer instrument, annexes, and assessment before relying on it. A reference to the EU Standard Contractual Clauses or a UK transfer mechanism does not prove an executed instrument or completed transfer assessment.

10. Privacy choices and requests

Depending on applicable law, you may have rights to access, correct, delete, or receive a portable copy of personal information, and to object or appeal. Rights and response periods depend on your location and the legal request. To exercise a right, email privacy@axiomhelm.com or use the authenticated privacy controls described on the Data Export & Deletion page. We may verify the requester and confirm which records they own or control.

An export reports its included and excluded categories. It may omit credentials, secrets, another person's personal mailbox/vault data, data we cannot safely associate with the requesting person, files held outside the inventoried data stores, and information held directly by a provider. It is not a complete download of each connected third-party account.

Account deletion may be blocked until shared venture ownership, other users' interests, or an active subscription is resolved. A deletion request does not itself delete shared ventures, cancel billing, delete the user's identity at an authentication provider, revoke each outside account permission, or delete a provider's copy. Available status will identify blockers and distinguish provider/infrastructure work from records the app can directly process. Where an app-owned request receives a target date, it is a target for in-scope application tasks, not a guarantee of erasure from every provider or backup. Information that law requires us to keep may be retained.

Disconnecting a connected service and deleting associated historic data are distinct actions. Some providers offer revocation, some can remove local access only, and some require a separate provider action. The authenticated controls report those outcomes separately; do not treat a local disconnect as proof that a provider deleted its copy.

U.S. state privacy laws may grant rights to know/access, correct, delete, or obtain personal information, opt out of sale/sharing or targeted advertising, and appeal a denial. Where applicable, we aim to respond within 45 calendar days, or sooner when the law imposes an earlier period, including the GDPR's one-month response period. We may extend a statutory deadline only where the applicable law permits and after giving any required notice. We do not sell or share personal information for targeted advertising. California residents may contact the California Privacy Protection Agency or Attorney General as permitted by law. EEA/UK individuals may complain to their supervisory authority. Authorized-agent processes and identity verification may apply.

For consent choices, optional PostHog and Snitcher remain off until the user chooses them; DNT is a strict opt-out. The public root has an owner-approved exception: GPC defaults optional processing off, but a current explicit acceptance in the preference flow can override GPC. The separate planned customer-site tag is not mounted and must not be treated as current collection.

11. Security and children

We use account access controls and safeguards appropriate to the Service. No security measure can eliminate all risk. More detail is on the Security page. Axiom Helm is a business service, not directed to children under 16, and we do not knowingly solicit information from children.

12. Text ATLAS SMS

Axiom Helm ATLAS is operated by Mahlum Innovations LLC.

If you choose to enable Text ATLAS, we process the mobile number you provide, account association, verification and opt-in history, consent source/text version, messages, and delivery data to verify your number, provide the messaging service, respond, and honor STOP or other choices. Message frequency varies by account activity. Message and data rates may apply. Reply STOP to opt out or HELP for help. Carriers are not liable for delayed or undelivered messages.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. See the Text ATLAS page.

13. Changes and contact

We may update this notice. We will identify a material revision by its version and last-updated date and provide notice where required by law or contract. An update to a privacy notice is not, by itself, acceptance of a separate DPA or a new optional connection.

Privacy requests and questions: privacy@axiomhelm.com. Support: support@axiomhelm.com. Postal mail: Mahlum Innovations LLC, c/o Privacy, 850 Holt Drive, Bigfork, MT 59911.