# Privacy Policy *Last updated October 3, 2026* AX Rush measures how ready websites and the public channels of brands and creators are for AI agents. This policy explains what information Warp Valley Inc. handles to run that service, why, and what your choices are. ## Who we are AX Rush is operated by Warp Valley Inc. (“Warp Valley”, “we”, “us”). The service, at axrush.com, measures how ready websites and social channels are for AI agents and helps their owners understand and improve that readiness. For anything in this policy (questions, requests, complaints), write to info@axrush.com. That address is read. ## Information you give us - Your email address and, if you use one, a password. Passwords are stored only as a cryptographic hash by our authentication provider; we cannot read them. - The name of your organization, the websites and brand or creator identities you add, the channels you declare, and the settings you choose, including monitoring, alert rules and research schedules. - Context you write, edit or accept, which may include business contact information, audiences, products and other facts. Your saved visibility choices determine which context fields are eligible for generated public content. - Anything you send us directly, such as email to info@axrush.com. ## Signing in with GitHub or Google If you sign in through an identity provider such as GitHub or Google, we receive the profile the provider shares: your name, email address and avatar. We never see your password for that provider. When a provider has verified your email address, the sign-in is linked to any existing account with the same address, so you remain one user rather than becoming two. ## Information collected automatically Our servers keep ordinary request logs: IP address, user agent, timestamps and the path requested. We use them to keep the service secure, to enforce rate limits, and to investigate abuse; for example, the anonymous scanner is rate-limited by IP address. There is no cross-site tracking on this site and there are no advertising cookies. The cookies that do exist, and the analytics that runs only with your consent, are described in the next section. ## Cookies and analytics Two kinds of cookies exist on this site, and only the first is set without asking. - Essential cookies: the session cookies that keep you signed in, and one cookie named ax_consent that remembers your answer to the question below, so it is not asked on every visit. It holds that answer and nothing else, and it expires after six months. - Analytics cookies: set by Google Analytics, and only after you accept them. They are named _ga and _ga_ followed by an identifier, they hold a random identifier that lets Google Analytics tell one visit from another, and they last up to two years unless you decline, which removes them. We use Google Analytics, loaded through Google Tag Manager, to learn which pages are read, in which language, and how a visitor goes from a scan to an account: the measurements that tell us what to improve. Google processes this data on our behalf. Google Analytics does not log or store IP addresses, the settings that would share its data with Google for advertising are off, and we never combine it with your account. Analytics data is kept for 14 months and then deleted. Until you accept, Google Analytics runs in a mode that sets no cookies: what reaches Google is the page, the time, the referring page and the browser type, with no identifier that persists from one page to the next, so no visit can be traced to a person. You are asked the first time you visit, and you can change your answer at any time from the Cookies link in the footer of every page. Declining, or withdrawing, removes the analytics cookies from your browser. ## Data about scanned websites When a scan runs, we fetch publicly accessible resources of the scanned domain (pages, robots.txt, published files, response headers) with a small, bounded number of requests, the same way any visitor or crawler could. We store the resulting measurements, and excerpts of what was fetched, to produce the report and its history. This is data about websites, not about people. Where a published page happens to contain personal data, we process it only as the site itself published it, and only to measure that site. Scans submitted through the anonymous public scanner produce reports that are public and may be indexed by search engines. If you operate a website and want its public report removed, write to info@axrush.com and we will remove it. Agent tasks fetch pages of a site you added in the same bounded, read-only way, identifying themselves as AXRushAgent and obeying that site's robots.txt. We store what the run did, the short passages it quoted, and a hash of each page fetched. We do not store the pages themselves. A recording of a run is private to your organization unless you publish it, and publishing one can be withdrawn at any time. ## Data about social channels An identity in AX Rush represents a brand or a creator and can have several separately declared channels. A YouTube channel is read through YouTube API Services, Google's official interface, without connecting a YouTube account. A reading fetches its public title, handle, description, keywords, country, topic categories, subscriber and video counts, and the title, description, tags, publication date and caption availability of its last 25 uploads. The anonymous channel scanner uses the same public interface. You can stop monitoring or remove the channel or identity to stop future readings. TikTok requires the account owner's authorization through TikTok Login Kit before AX Rush can read that account. We request user.info.basic, user.info.profile and video.list: account identification, public profile information and public videos. We do not request posting permissions or follower, following, like or total video statistics. A reading uses the account identifier, username, display name, bio, profile link and verification status, plus the title, description, hashtags, publication date and duration of up to 20 recent public videos. We store authorization tokens encrypted on the server. You can disconnect TikTok from the channel page in AX Rush or revoke access in TikTok's own settings. Disconnecting in AX Rush stops new use of the connection immediately and requests revocation from TikTok. If TikTok is temporarily unavailable, the interface reports the pending operation and retries it. Encrypted credentials remain only as needed to finish that revocation and are deleted when it completes. Removing a connected TikTok channel or an identity with a TikTok connection also waits for provider revocation before reporting completion. Disconnecting preserves the channel declaration and permitted history; removing the identity deletes its associated social data. Raw platform data expires no later than 30 days after a reading. Retention cleanup deletes those fields, and expired data is excluded from further use. We retain our own check results and counts as history, rather than the platform's original text. YouTube has eight checks; TikTok has seven. Context research may use current channel text as described under AI analysis. Its supporting channel quotations and unaccepted proposals are cleared when the source expires, is removed or loses authorization. Context declarations already accepted manually or under your automation settings remain editable until you change or delete them. A reading through the anonymous channel scanner stores no channel data. We use platform data to provide readings, findings and supported documents, and for context research you request or configure. We do not sell it or use it for advertising. Service providers receive the information necessary for their roles, as described below. TikTok's handling is described at https://www.tiktok.com/legal/page/row/privacy-policy/en. Google's handling is described at https://policies.google.com/privacy. Using YouTube features is subject to the YouTube Terms of Service at https://www.youtube.com/t/terms. Where enabled for your workspace, Instagram requires authorization from a professional Business or Creator account. We request instagram_business_basic and read the account identifiers, username, display name, account type, biography and website, plus the identifier, caption, media type, publication time and link of up to 20 recent owned media items. Facebook requires authorization and selection of a managed Page. We request pages_show_list and pages_read_engagement, discover eligible Page choices, and read the selected Page identifier, name, username, link, about text, description and website, plus the identifier, text, publication time and link of up to 20 Page-authored posts. We do not request visitor content, messages, publishing, advertising or insights permissions for this preview, and do not download media files. Meta access tokens are stored encrypted on the server. Disconnecting Instagram or Facebook removes the selected channel’s stored AX Rush access. It does not revoke your entire Meta app authorization or disconnect other Page channels. To withdraw that provider authorization, use Meta’s own app settings. Disconnecting an Instagram or Facebook channel removes its stored AX Rush access and stops monitoring. It retains permitted findings and a one-way hashed app-subject/channel binding so a later provider deletion request can still identify covered data. A verified Meta deauthorization callback stops app-subject access across matching channels. A verified provider deletion request removes covered tokens, raw readings, checks, verifications and alerts while preserving independently entered channel declarations, context and Answers. ## AI analysis Parts of AX Rush use third-party language model APIs, currently Anthropic, OpenAI and Google. These include website analysis, agent tasks, context research and comparison, question suggestions, generated publishing files and Answers measurements. Inputs depend on the operation and may include excerpts of public website content, declared context, collected channel information, questions you configure and previous results needed for that operation. These providers process the inputs under API terms that do not permit training on that data. For social context research, AX Rush can send a current channel's display name, bio or description, keywords and topics where available, and the titles and descriptions of up to five recent videos. For a connected TikTok channel, this can include the bio and video text obtained through its authorized Display API reading. Research can also use the linked website. The model proposes context with sources; your manual edits and saved automation settings control acceptance. A context comparison can additionally send stored Answers results to identify differences. Editing context does not rewrite past measurements or provide expected answers to the independently measured assistants. Agent tasks send the page text needed to attempt the requested goal; their retained evidence is described under Data about scanned websites. Answers sends configured questions about a website, brand or creator, and relevant rivals, to models with web search enabled and stores their responses. These responses describe what those models said, not facts we independently verified. The separate use of ChatGPT or another connected client is described under Apps you connect. Collected Instagram and Facebook profile, media and post evidence is excluded from AX Rush managed AI context research during this preview. Authorized private REST and MCP reading tools can return Meta evidence to the requesting client, including AI clients. Your manually declared context, eligible other sources and independent Answers retain their separately described processing. ## Apps you connect When you connect ChatGPT or another supported client to AX Rush, the consent screen identifies the team and requested permissions. Read permissions can disclose the authorized team's websites, social identities and channels, saved measurements, findings, documents and other data covered by the selected scopes. Context access is a separate permission and may include private context and business contact information you entered. Repository access uses separate integration permissions. Write and run permissions are separate from reading. Depending on the permissions you grant, a client may change supported settings, edit context, manage monitoring or alerts, start supported AI research or generation, or prepare and approve a supported draft repository pull request. Paid operations remain subject to the current plan, limits, role and resource authorization. Granting access does not itself start these operations, and an older grant does not acquire new permissions automatically. TikTok account authorization still requires its own browser consent; AX Rush does not publish videos to TikTok. You can revoke a client connection from Account in AX Rush. Revocation prevents further authorized use and is checked for queued work; it cannot undo external work already performed or delete information the other service already received. The connected service's privacy policy and your settings govern its use, retention and deletion of that information. The API processing described under AI analysis does not describe your separate use of ChatGPT. Review the connected service's policy and controls before sharing team information. The axrush:social:connect client scope requires renewed consent to review, select or cancel Facebook Page choices from a provider connection you started. Ordinary saved social reads do not expose those Page choices. AX Rush client authorization and provider account authorization remain separate. ## Email We send transactional email only: account confirmations and the alerts you configured. Delivery runs through Resend, and we record delivery status so an alert that bounced is not counted as one that arrived. We do not add you to marketing lists. ## Payments Paid subscriptions are processed by Stripe. Your card details go to Stripe and never touch our servers; what we keep is your plan, its status, and billing history. ## Service providers We share personal data with the providers that run the service, each receiving what its role requires. We also share authorized team information with apps you explicitly connect, as described above: - Supabase: database and authentication - Vercel: hosting and request logs - Resend: email delivery - Anthropic, OpenAI and Google: AI analysis, and the engines a share of answer pass asks - Google: YouTube API Services, which receives the handle of each channel we read; and analytics, only after you accept analytics cookies - TikTok: Login Kit and the Display API, which receive authorization requests and the token of each connected account - Stripe: payments - GitHub and Google: sign-in, when you choose them Processing happens in the United States and the European Union. Where data crosses borders, it does so under recognized safeguards such as standard contractual clauses. Meta provides Instagram and Facebook authorization and authorized API reads for enabled channel connections. ## How we use information To provide and operate the service, to keep it secure and fairly rate-limited, to send the messages your settings ask for, and to understand and improve how the product works. We do not sell personal data, and we do not use it for advertising. ## Retention Account data is kept while your account exists. Website measurements are kept while the site remains in your account, and public reports are kept so their URLs remain useful. Request logs are kept briefly. Raw social platform fields expire within 30 days of a reading. Source quotations and unaccepted research proposals that depend on that data are cleared when their sources expire, are removed or lose authorization. Check history and accepted context declarations have separate lifetimes, as described under Data about social channels. For providers that require remote revocation, encrypted provider tokens may be retained while that revocation is pending, solely to complete it. When you delete your account, we delete the personal data associated with it, except what the law requires us to keep, such as billing records. For providers that require remote revocation, a pending revocation is shown as pending rather than reported as a completed removal. Disconnecting an Instagram or Facebook channel removes its stored AX Rush access and stops monitoring. It retains permitted findings and a one-way hashed app-subject/channel binding so a later provider deletion request can still identify covered data. A verified Meta deauthorization callback stops app-subject access across matching channels. A verified provider deletion request removes covered tokens, raw readings, checks, verifications and alerts while preserving independently entered channel declarations, context and Answers. ## Your rights Depending on where you live, including under the EU and UK GDPR and certain U.S. state privacy laws, you may have the right to access, correct, delete or receive a copy of your personal data, and to object to or restrict some processing. Write to info@axrush.com to exercise any of them; we will need to verify that you are you. You also have the right to complain to your data protection authority. ## Security Data is encrypted in transit and at rest. Access inside the service is enforced row by row at the database, and credentials are scoped to the least each component needs. No system is perfectly secure; if you believe you have found a vulnerability, write to info@axrush.com. ## Children The service is not directed to anyone under 16, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it. ## Changes to this policy When this policy changes, the new version is published here with its date. If a change materially affects account holders, we will email the address on the account before it takes effect. ## Contact Warp Valley Inc. info@axrush.com --- Représentation Markdown de https://axrush.com/privacy