Privacy Policy
How ThirdAxis AI LLC handles data in on hand: what we collect, who processes it, how it is protected, how long it is kept, and the rights you have over it.
Effective September 20, 2026
1. Who this covers
This policy applies to on hand and to ThirdAxis AI LLC as the company operating it. It covers two different kinds of data, and the distinction matters throughout:
- Account data, which is about you and your business: who signed up, billing, and how the product is used. We are the controller of this.
- Customer content, which is the material an employee works on: your accounting records, your mailbox, your documents. We process this on your instructions, as your processor, to do the job you hired the employee for.
2. What we collect
From you directly. Your name, business email, phone number, business details, the description of the job you want done, and billing information. Payments are handled by a payment processor; we do not store full card numbers.
From the systems you connect. Only what the job needs, at the scopes you approved. For an accounting system that means records such as transactions, invoices, bills, vendors, customers, and reports. For a mailbox it means message contents, headers, attachments, and folder or label structure. For a phone channel it means call audio and transcripts.
From use of the product. Sign-in events, actions taken in the portal, and an audit record of what an employee did: which tool it called, when, what changed, and who approved it. That record exists so the work can be reviewed and reconstructed.
We do not run advertising, we do not use advertising trackers, and we do not buy personal information about you from data brokers.
3. Why we process it
- To do the work you hired the employee to do, inside the systems you connected
- To let a person at our company supervise that work and be accountable for it
- To show you what happened, through the conversation, task recaps, and documents
- To support you, investigate problems, and improve reliability
- To keep the service and its customers secure, and to detect abuse
- To bill you, and to meet our legal and tax obligations
Where the UK or EU GDPR applies, our legal bases are performance of a contract, our legitimate interests in operating and securing the service, compliance with legal obligations, and consent where we ask for it.
4. AI processing, and what is not done with your data
An AI employee reasons using models operated by an AI provider. To do a task, the content needed for that task is sent to that provider and the response comes back. This is how the product works, and you should understand it before connecting a system.
Your business content is not used to train AI models. Under the commercial API terms we operate on, inputs and outputs are not used for model training.
We do not sell your data, and we do not share it for cross-context behavioral advertising.
We do not give one customer access to another’s data. Each customer runs in its own isolated environment with its own credential store.
We use aggregated and de-identified information, which does not identify you or any individual, to understand cost and reliability and to improve the service. What an employee learns about how to do a job well may be generalized into our own role guidance, with customer-identifying details removed.
5. Who processes data on our behalf
We use the providers below. Each one receives only what its function requires, and each is bound to protect it. We do not hand customer content to anyone beyond what running the service requires.
| Provider | What it does | What it receives |
|---|---|---|
| Anthropic | The AI models an employee reasons with. Receives the task and the material needed to do it.Under Anthropic's commercial API terms, inputs and outputs are not used to train their models. | Business content relevant to the task, which can include accounting records and email contents |
| Intuit (QuickBooks Online) | The accounting system itself, where the customer has connected it.The customer authorizes this directly in their own Intuit account and can revoke it there at any time. | Read and write access to the connected company file, at the scopes the customer approved |
| Google / Microsoft | The mailbox itself, where the customer has connected Gmail or Outlook.The customer authorizes this in their own account and can revoke it there at any time. | Read and write access to the connected mailbox, at the scopes the customer approved |
| Google Cloud Platform | Hosting. Every employee and its data run on our own isolated machines in Google Cloud, in the United States.Infrastructure only. Google has no access to the content and does not process it for its own purposes. Google Cloud Identity Platform also handles sign-in credentials. | All customer content at rest and in transit, encrypted, in region us-central1 |
| Cloudflare | The anti-abuse check on our sign-in and sign-up pages.Cloudflare Turnstile does not profile the person or track them across sites. | IP address and browser signals of the person solving the check, no business content |
| Resend | Delivering and receiving email sent by an employee from its own address.Used only where employee email is switched on. | Message contents, sender and recipient addresses, attachments |
| Bland AI | Placing and answering phone calls, where a phone channel is switched on.Used only where a phone channel is switched on. | Call audio, transcripts, and the phone numbers involved |
We also use infrastructure and hosting providers to run the service. We may disclose data if required by law, to enforce our agreements, or in connection with a merger or acquisition, in which case we will tell you before your data becomes subject to a different policy.
6. QuickBooks and other connected accounting systems
Where you connect an accounting system such as QuickBooks Online, some specific commitments apply:
- We access it only through the provider's official authorization flow, at the scopes you approve. We never ask for your accounting password.
- Authorization tokens are held encrypted in a per-customer store and are not held by the runtime that performs the work.
- We use the data only to operate the service for you. We do not sell it, and we do not use it for advertising or for any purpose beyond the functional operation of the product.
- Deletion is never performed by an employee. Records can be created and updated within the approvals you set; deletion is off.
- You can revoke access at any time in your own account with that provider, and we delete the stored authorization when you disconnect.
7. How it is protected
- Each customer runs in an isolated environment with its own kernel, rather than sharing a process with other customers.
- Credentials for connected systems live in a per-customer store and are attached to requests at the network boundary, so the runtime doing your work does not hold a reusable credential.
- Outbound network access is denied by default. Only the specific services a job requires are reachable, and the providers' own token endpoints are not among them.
- Actions are classified by risk. Writes that leave your business or touch money wait for a person to approve them according to the mode you are in.
- Data is encrypted in transit. Access by our staff is limited to those who need it to support and supervise your employee, and their actions are logged.
No service can promise perfect security. If a breach affects your data we will notify you without undue delay and in line with applicable law.
8. How long it is kept
- Customer content stays while your employee needs it to do the job and while your account is active.
- Authorization tokens are deleted when you disconnect a system or close your account.
- On termination we delete or return customer content within 30 days of your request, and in any case within 90 days of the account closing, except where we must keep something to meet a legal obligation.
- Audit and billing records are kept longer where law or legitimate business need requires it.
- Backups age out on their own cycle; data deleted from the live service is removed from backups as they expire.
9. Your California privacy rights
This section is the notice at collection required by the California Consumer Privacy Act as amended by the California Privacy Rights Act, and it applies to California residents.
Categories we collect. In the twelve months before the effective date of this policy, we collected the categories below. We collect them from you, from the systems you connect at your direction, and from your use of the product. We use them for the purposes in section 3 and disclose them for a business purpose to the providers in section 5.
| Category | Examples | Sold or shared |
|---|---|---|
| Identifiers | Name, business email address, phone number, account identifiers | No |
| Commercial information | Records of services purchased or considered, billing records | No |
| Internet or network activity | Sign-in events, pages used in the portal, application and audit logs | No |
| Professional or employment-related information | Your role at the business, the job you hire an employee to do | No |
| Financial information | Accounting records from a connected system, such as transactions, invoices, vendors, and balances | No |
| Electronic communications content | The contents of a connected mailbox, email an employee sends or receives, and call transcripts where a phone channel is on | No |
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months, and we do not knowingly do so for anyone under 16.
Sensitive personal information. Content in a connected mailbox or accounting system can contain information California treats as sensitive. We use it only to perform the service you requested and for the purposes permitted under section 7027(m) of the CCPA regulations. We do not use or disclose it to infer characteristics about anyone, so the right to limit its use does not arise; we honor the request regardless if you make one.
Your rights. Subject to verification, you may:
- Know what personal information we have collected, the sources, the purposes, and who we disclosed it to
- Access a copy of it, in a portable form where technically feasible
- Correct inaccurate personal information
- Delete personal information, subject to the exceptions the statute allows
- Opt out of sale or sharing, which is already our practice, so there is nothing to opt out of
- Limit the use of sensitive personal information
- Not be discriminated against for exercising any of these rights. We will not deny service, charge a different price, or give you a lower quality of service because you did
How to exercise them. Email roman@thirdaxis.ai with the request. We will confirm receipt within 10 business days and respond within 45 calendar days, extending once by a further 45 days where necessary and telling you if we do. We verify requests by matching them against the account, and we may ask for more information where the request concerns sensitive data. An authorized agent may act for you with written permission, and we may ask you to confirm it directly.
Where we act for a business. Where we process customer content on behalf of a business customer, we are a service provider under the CCPA. We do not retain, use, or disclose that information for any purpose other than performing the service, and we will direct a consumer who contacts us to the business whose data it is, and help that business answer the request.
Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.
Text messages. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Our text messaging terms are at on-hand.ai/sms-terms.
10. Other privacy rights
Residents of other US states with comprehensive privacy laws, including Colorado, Connecticut, Virginia, Utah, Texas, and Oregon, have comparable rights of access, correction, deletion, portability, and appeal. Use the same contact address and tell us which state you are in. If we decline a request you may appeal by replying, and we will respond with our reasoning.
Under the UK and EU GDPR you have rights of access, rectification, erasure, restriction, portability, and objection, and the right to complain to your supervisory authority. Data we hold is processed in the United States; where we transfer personal data from the UK or EEA we rely on appropriate safeguards such as standard contractual clauses.
12. Children
The service is for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe we have, contact us and we will delete it.
13. Changes
We may update this policy. If a change is material we will give reasonable notice by email or in the product before it takes effect, and we will update the effective date above.
14. Contact
Privacy questions, requests, and security reports go to roman@thirdaxis.ai.
ThirdAxis AI LLC
560 W Roosevelt Rd, West Chicago, IL 60185, United States
See also the Terms of Service.