1. Scope and responsible operator
This Privacy Policy explains how the service operator identified in your BeltLabs order, checkout record or invoice (BeltAxis, BeltLabs, we, us or our) handles personal information in connection with beltaxis.com, the BeltLabs platform, support and related services. BeltLabs is a product of BeltAxis. This Policy applies to account users, prospective customers, website visitors, customer contacts and other individuals whose information we process for our own purposes. When a Customer uploads personal data to its workspace, the Customer generally determines the purpose and means of processing and we process that data on its behalf.
2. Information we collect
Depending on your interaction, we collect identifiers and contact details; organisation, role and account data; authentication and security events; subscription and transaction references; support and sales communications; device, browser, IP, request and diagnostic data; feature activity and audit history; and Customer Data submitted to a workspace, including asset, work, supplier, technician, photograph, document and operational records. Paddle processes full payment-card details; we ordinarily receive transaction, subscription, tax, country and payment-status information rather than full card data.
3. Sources of information
We collect information directly from you and your organisation, automatically from your use of our websites and Service, from workspace administrators or other authorised users, from identity providers when you choose federated sign-in, from Paddle in connection with a transaction, and from service providers that help us prevent abuse, secure the Service or deliver communications. We may combine information from these sources where lawful and reasonably necessary for the purposes described below.
4. Purposes and legal bases
We process personal information to provide and administer the Service; authenticate users and enforce permissions; fulfil subscriptions; communicate service, security and billing information; answer enquiries; preserve auditability; prevent fraud and misuse; maintain, troubleshoot and improve performance; comply with law; establish or defend legal claims; and market the Service where permitted. Depending on the jurisdiction and context, our legal basis is performance of a contract, steps requested before contract, compliance with legal obligations, legitimate interests that are not overridden by individual rights, consent, or another basis recognised by applicable law.
5. Customer-controlled workspace data
Customers decide what information to place in their workspaces, who may access it and how it is used. For that information, the Customer is responsible for privacy notices, lawful bases, data accuracy, access decisions and responding to individuals. We process workspace personal data on documented instructions embodied in the Agreement, Customer's configuration and authorised user actions, except where law requires otherwise. Individuals should first direct workspace-record requests to the relevant Customer; we will reasonably assist the Customer where required.
6. Disclosure and service providers
We disclose information only as reasonably necessary to operate the Service, follow Customer instructions, complete transactions, comply with law, protect rights and security, or support a corporate transaction. Recipients may include infrastructure, database, storage, email, identity, customer-support, monitoring, professional-adviser and payment providers; authorised Customer users; competent authorities; and a successor in a merger, financing, reorganisation or sale. Providers receive only the access reasonably required for their function and are subject to contractual or legal duties. We do not sell personal information for money.
7. Paddle transactions
Paddle acts as merchant of record for applicable purchases and independently processes buyer, payment, tax, fraud and transaction information under Paddle's own buyer terms and privacy notice. Paddle may provide us with information needed to provision the Service, associate a subscription with a workspace, provide support, prevent fraud and reconcile transactions. Refunds, cancellations and payment disputes are administered through Paddle's buyer-support processes as described in our Refund Policy.
8. Identity providers and integrations
If you choose Google or Microsoft sign-in, the provider supplies identity attributes such as your name, email, provider account identifier and authentication result. If a Customer enables another integration, information is exchanged according to the permissions and instructions selected by its authorised administrator. The third party processes information under its own terms and privacy practices. Disconnecting an integration stops future authorised exchange but does not automatically delete data already transmitted or lawfully retained.
9. Cookies and similar technologies
We use first-party cookies and comparable storage required for authentication, security, OAuth state, customer-portal sessions, impersonation controls where authorised, and interface preferences. We do not currently use cross-site advertising cookies. Our Cookie Policy identifies the purposes, typical duration and available controls. If we introduce optional analytics or advertising technologies, we will update our disclosures and obtain consent where applicable law requires it.
10. International processing
Our users and providers may operate in different countries, so information may be processed outside the country where it was collected. Where applicable law requires a transfer mechanism, we use an available lawful safeguard appropriate to the transfer, which may include adequacy regulations, approved contractual clauses or another recognised mechanism. Customers with specific residency or transfer requirements must obtain written confirmation in their order or data-processing addendum before submitting regulated data.
11. Retention
We retain information for the period reasonably necessary to provide the Service, fulfil the purposes described in this Policy and meet contractual, security and legal obligations. Workspace data is ordinarily retained while the subscription is active and through the documented post-cancellation export window. When authorised deletion becomes effective, data is removed from active systems subject to technical backup cycles. Transaction, consent, security, abuse-prevention, audit and legal-claim records may be retained longer where reasonably necessary or legally required. Retention decisions consider data type, sensitivity, volume, purpose and risk.
12. Security
We maintain administrative, technical and organisational measures designed to protect information against unauthorised access, alteration, disclosure and loss. Measures include tenant-scoped access, role controls, protected production cookies, credential safeguards and audit records. No system or transmission method is completely secure, and we cannot guarantee absolute security. Customers remain responsible for user administration, endpoint security, appropriate permissions and secure handling of exports. Suspected security issues should be reported promptly to support@beltaxis.com.
13. Individual rights
Subject to applicable law and exemptions, you may have rights to access, correct, delete or obtain a copy of personal information; restrict or object to processing; withdraw consent without affecting earlier lawful processing; and complain to a competent data-protection authority. You may also have a right to data portability or to appeal a refusal. We verify requests proportionately and may need to retain limited information to document and lawfully respond. Rights concerning Customer-controlled workspace records should be directed to that Customer first.
14. Regional disclosures
Some jurisdictions require additional disclosures or choices. Where applicable, residents may request information about categories of personal information collected, sources, purposes, recipients and retention, and may exercise rights without unlawful discrimination. We do not knowingly sell or share personal information for cross-context behavioural advertising. Because we do not currently engage in that activity, we do not offer a separate sale opt-out mechanism. A legally recognised preference signal will be honoured where it applies to processing we conduct.
15. Marketing communications
We may send product and business communications where you request them or applicable law otherwise permits. You can opt out of promotional email using its unsubscribe control or by contacting support@beltaxis.com. Opting out of marketing does not prevent transactional, billing, account, legal or security communications necessary to administer the Service or relationship.
16. Automated decisions and model training
We do not use Customer Data to train general-purpose machine-learning models. We do not currently make decisions producing legal or similarly significant effects about individuals solely by automated processing. Operational scores, alerts, summaries or recommendations, if displayed, are decision-support outputs that Customer personnel must review and are not a substitute for professional judgement.
17. Children
The Service is designed for organisations and authorised workplace users, not children. We do not knowingly solicit personal information from children or permit them to create accounts. If you believe a child has provided personal information without lawful authorisation, contact support@beltaxis.com so we can investigate and take appropriate action.
18. Changes, requests and complaints
We may update this Policy prospectively to reflect operational, legal or technical changes. We will give reasonable notice of a material adverse change where required. The effective date identifies the current version. To exercise a privacy right, request current sub-processor information, raise a complaint or contact the responsible operator, email support@beltaxis.com. We will respond within the period required by applicable law. You may also complain to the data-protection authority competent for your location or the relevant processing.
