AX Frame privacy notice
The short version
AX Frame is a ledger of a customer's own digital infrastructure: the services, domains, subscriptions and AI or API spend they pay for, their renewal dates, and how those things fit together.
Almost everything AX Frame holds is data you typed in about services you already pay for. It records what you tell it; it does not scan your network or discover accounts. AX Frame stores where you log in and as whom, never the password or key itself.
There is no advertising tracker, no third-party analytics and no session recording in AX Frame. The only cookie set is the one that keeps you signed in, which is strictly necessary for the service. We do not sell personal data.
Who we are
AX Frame is an AntaraX product. AntaraX is a product brand of REKA Inisiatif Sdn Bhd (company registration 1244206-A / 201701030037), whose registered address is 26A, 1/42 Taman City, Off Jalan Kuching, 51200 Kuala Lumpur, WPKL, Malaysia. In this notice, "REKA", "we" and "us" mean REKA Inisiatif Sdn Bhd. REKA is an R&D company.
For the personal data described below, REKA decides why and how it is used, and is the data controller under Malaysia's Personal Data Protection Act 2010 (PDPA). Where a business customer puts personal data of other people into AX Frame, REKA handles that data on the customer's instructions; the data processing addendum covers that.
For anything in this notice, write to us at support@go.antarax.ai.
What is collected
Account. Name, email address and profile picture from your Google account, or just your email address if you sign in with an emailed link.
Why: To sign you in, to show teammates who did what, and to email you.
What you enter. Asset names, vendors, costs, renewal dates, notes, monitoring URLs, project briefs, and the way you group things into stacks, systems, teams and projects. Assets and projects you delete go to Trash and are deleted for good after 30 days.
Why: This is the product. It is your record of your own estate.
Billing. Subscription status, plan and invoice history. Card details are held by Stripe, never by AX Frame.
Why: To run your subscription.
Sign-in records. Each sign-in attempt: whether it worked, how (Google or an emailed link), the browser family, and your network address with its last part removed. Kept for 90 days.
Why: To spot attacks on accounts and to help when someone cannot sign in.
Error reports. When a page breaks: the reference shown to you, the page path without anything after a question mark, a one-line message with secrets removed, and your user and workspace ids. Kept for 90 days.
Why: So that a reference you quote to support can be found and fixed.
Product usage. A first-party log of significant actions, such as an asset created or a plan generated, with your user id and a timestamp. There is no third-party analytics, no advertising tracker and no session recording.
Why: To understand which parts of the product are used, and to investigate faults.
Why we use it
We use this data to provide AX Frame to you: to sign you in, run your account, show you what you have recorded, send the emails the product needs to send, keep the service working, protect it against abuse and investigate faults. We may also keep records needed to meet legal obligations or to establish, exercise or defend legal claims. Where consent is needed for a purpose, we rely on your agreement for that purpose, and we do not treat merely using the product as consent to unrelated uses.
Who else touches it
Running AX Frame means other companies process some of this data on our behalf. This is the complete list for AX Frame, and exactly what reaches each one. The same list is published as the subprocessor list.
Supabase. Database, sign-in and file storage. The system of record for the product. It receives: Everything a customer enters into the product, plus the name, email address and profile picture used to sign in. Location: A cloud region outside Malaysia (see where the product stores its data). Their privacy policy.
Vercel. Runs and serves the application. It receives: Request metadata (IP address, user agent, requested path) in server logs. Location: Global edge network; outside Malaysia. Their privacy policy.
Google (sign-in and logo service). Sign-in with a Google account, and the small logo beside a vendor or website. It receives: The sign-in request. Google returns the person's name, email address and profile picture. To draw a logo for a vendor or website without a bundled logo, the browser asks Google's favicon service for it by domain name only. Location: Global; outside Malaysia. Their privacy policy.
Stripe. Subscription payments. It receives: The customer's email address and payment details. Card numbers go to Stripe directly and are never stored by the product. This applies: Only for products with paid plans, and only once someone subscribes. Location: United States and other regions; outside Malaysia. Their privacy policy.
AntaraX email (delivered through Resend). Sends the emails a product needs to send. It receives: Recipient email addresses and message contents, such as sign-in links, renewal reminders, summaries, alerts, invitations and announcements. Location: United States. Their privacy policy.
Anthropic (Claude). Generates text and structured results with an AI model. It receives: The project brief you write, any focus you type for a review, and the names, vendors, categories and monthly costs of the assets in scope, plus your earlier decisions on suggestions. Your name, email address, account identifiers and access details are never included. This applies: Only when an API key has been configured. Without one, plans are built from a local catalogue and no data leaves AX Frame. Location: Provider infrastructure outside Malaysia (United States). Their privacy policy.
Google (Gemini). Generates text and structured results with an AI model. It receives: The project brief you write, any focus you type for a review, and the names, vendors, categories and monthly costs of the assets in scope, plus your earlier decisions on suggestions. Your name, email address, account identifiers and access details are never included. This applies: Only when an API key has been configured. Without one, plans are built from a local catalogue and no data leaves AX Frame. Location: Provider infrastructure outside Malaysia (the exact region depends on Google's service). Their privacy policy.
ScreenshotOne. Captures a thumbnail of a monitored site so a person can see it is up. It receives: The monitoring URL entered for an asset. This applies: Only for assets with a monitoring URL, and only if a key has been configured. Location: Provider infrastructure outside Malaysia. Their privacy policy.
Cloudflare. Hosts websites and applications and passes traffic and email to the product, and answers public DNS lookups where a product offers domain checks. It receives: The domain names of Domain assets, and of any domain you run the domain check on, as an ordinary public DNS question. Only if thumbnails are set to use Cloudflare: the monitoring URL you entered for an asset. This applies: The DNS lookups run for assets in the Domain category and for the domain check; thumbnails only if a key has been configured. Location: Global network; outside Malaysia. Their privacy policy.
rdap.org (the domain registries). Looks up who a domain is registered with and when it expires. It receives: The domain name a person types into the domain check, and nothing else. rdap.org passes it to the registry for that domain's ending (.my, .com and so on). This applies: Only when a person checks a domain. Location: Depends on the registry for the domain. Their privacy policy.
Google PageSpeed Insights. Measures how fast a website loads, on request. It receives: The public website address of the asset a person runs a speed test on. This applies: Only when a person presses the speed-test button. Location: Global; outside Malaysia. Their privacy policy.
Google Workspace (REKA mail and support). REKA's own email and the shared support mailbox, used to receive and answer messages. It receives: Messages people send to REKA or to a product's support address, including the sender's address and anything written in the message. Location: Global; outside Malaysia. Their privacy policy.
AI features
Two features can send data to a language model: generating an infrastructure plan, and generating cost-optimisation suggestions. What goes into those prompts is the project brief you wrote, any focus you typed for a review, and the names, vendors, categories and monthly costs of the assets in scope, plus your earlier decisions on suggestions so it does not repeat itself. Your name, email address, account identifiers and access details are never put in a prompt. If no API key is configured, neither feature calls out at all: plans are assembled from a local pricing catalogue and nothing leaves AX Frame. When a feature does call out, the model provider (Anthropic or Google) processes the prompt under its API terms, which are linked in the subprocessor list.
Where it is stored, and processing outside Malaysia
AX Frame stores its data with Supabase, outside Malaysia. Some of the companies listed above operate outside Malaysia, so using them means personal data is processed outside Malaysia. That is inherent to using a hosted product, and it is listed above so you can judge it. Overseas processing must meet an applicable condition under section 129 of the PDPA, and this notice is not a request for blanket consent to every overseas transfer. Contact us for information about a transfer affecting your data.
Your rights
Subject to the PDPA's conditions and exceptions, you may ask for access to or correction of your personal data, withdraw consent, object to direct marketing, and ask us to prevent processing likely to cause damage or distress. You may also ask for deletion; we will explain any legal reason that requires us to keep something.
In AX Frame:
- A copy. Every screen exports what it shows, as CSV, Markdown or JSON. Download my data on the Your account page returns a single file with every record held about you and your workspace.
- Corrections. Almost everything is editable in the product directly. For anything that is not, email us.
- Deletion. Delete my account on the Your account page shows, workspace by workspace, exactly what will be removed, and if you own a workspace other people work in, asks you to hand it over or delete it.
For any of these, or a question this notice does not answer, write to support@go.antarax.ai. We may need proportionate identity verification before releasing or changing data. There is no charge for ordinary requests. If you have an unresolved complaint, you may raise it with Malaysia's Personal Data Protection Commissioner.
How long it is kept
Your estate data is kept for as long as your account exists, because a ledger that forgets is useless. Deleted assets and projects sit in Trash for 30 days. Sign-in records and error reports are kept for 90 days.
When an account is closed, its workspace data is deleted within 30 days. Billing records are kept for 7 years, as Malaysian law requires.
Security
We apply reasonable technical and organisational protection appropriate to the data, and limit access to authorised purposes. No online service can guarantee absolute security. If a personal data breach occurs, we will assess it and make the notifications that applicable law requires.
Children
AX Frame is intended for business audiences and is not directed at children. If you believe a child has provided personal data without appropriate authorisation, contact us.
Changes
If this notice changes in a way that affects you, we will say so in the product or by email rather than quietly editing this page. The version and effective date at the top of this page identify the current text, and the changelog lists every change.
Contact
support@go.antarax.ai · REKA Inisiatif Sdn Bhd, 26A, 1/42 Taman City, Off Jalan Kuching, 51200 Kuala Lumpur, WPKL, Malaysia.