What we collect, what we promise,
and what this site does not do.

Who is responsible

The data controller is Dr Zain Ahmad, trading as Axial Systems. Axial Systems is a trading name and not a registered company, so the controller is the individual named rather than a corporate body. You can reach us at hello@axialsystems.co.uk.

What is collected, and when

Nothing is collected simply by reading this site. There is no analytics package, no tag manager and no advertising pixel, so browsing these pages creates no record of you anywhere.

If you use the contact form, we receive the fields you fill in: your name, email address, business website, sector, and whatever you write in the message box. That is the whole of it — the form asks for nothing it does not need in order to reply.

If you create an account for the client dashboard, we hold your email address, an authentication record, and the diagnostic results you choose to save. Accounts are handled by Supabase, acting as our processor.

The on-page tools collect nothing. The workflow leakage audit and the economic models run entirely in your browser. The figures you enter are never transmitted, never stored, and disappear when you close the tab.

The chat assistant never asks for your contact details in conversation. Axiom, the assistant in the corner, answers questions about us from answers we have approved. It may ask what kind of business you run and what you want to improve, so it can point you to the right service. If you choose to send an enquiry, a form opens inside the chat, as described next. What you type into the conversation itself is sent to our server so that Axiom can reply; we do not store it, and the conversation is gone when you reload. It is described in full under Cookies below.

If you send an enquiry from the chat, we receive what you enter in its form: your name, email address, company if you give one, and your message. It is stored in our database and emailed to us so that we can reply. The site never sends email to the address you enter; the reply comes from us.

With each enquiry or booking we also keep a keyed, one-way fingerprint of the email address and of the network (IP) address it came from. It lets us count repeat submissions, so the forms cannot be used to flood us or anyone else, and it is used for nothing more.

Why, and on what lawful basis

Enquiry details are processed on the basis of legitimate interests — responding to someone who has asked to be contacted about our services. Account data is processed on the basis of performance of a contract, being the account you asked us to create. Where we are required to keep records for tax or accounting purposes, the basis is legal obligation.

What you type into the chat is processed on the basis of legitimate interests: answering the question you asked. The fingerprints kept with enquiries and bookings rest on legitimate interests too: stopping the forms being misused.

Who else sees it

We do not sell personal data, and we do not share it for anyone else's marketing. It is seen by the small number of people working on your enquiry, and by the service providers who host the site and handle accounts and email on our behalf — each under contract, and only to the extent the service requires. They include Vercel, which hosts the site; Supabase, which runs our database and dashboard accounts; DeepSeek, whose model the chat assistant uses; Anthropic, whose model it uses when DeepSeek is unavailable; and SMTP2GO, which delivers the notification emails the chat sends us.

Some of those providers operate outside the UK. DeepSeek is based in the People's Republic of China, and what the chat sends it is processed there. For the others, where data is transferred abroad it is done under the safeguards UK data protection law requires, such as an adequacy decision or standard contractual clauses.

How long it is kept

Enquiries are kept for as long as there is an active conversation and for a reasonable period afterwards, so that we can pick up where we left off; where nothing comes of an enquiry it is deleted. Account data is kept while the account is open and removed on request. Records we are obliged to retain for tax purposes are kept for the period the law specifies.

Enquiries made through the chat are deleted from our database automatically twelve months after they are made.

We keep no record of the chat conversation itself.

Your rights

Under UK GDPR you have the following rights. To exercise any of them, email hello@axialsystems.co.uk. We will respond within one month.

To be informed

To be told what is collected and why — which is what this notice is.

Of access

To ask for a copy of the personal data held about you.

To rectification

To have inaccurate data corrected, and incomplete data completed.

To erasure

To ask for your data to be deleted where there is no overriding reason to keep it.

To restrict processing

To ask that data be stored but not otherwise used, while a question about it is resolved.

To data portability

To receive data you provided in a structured, commonly used, machine-readable form.

To object

To object to processing carried out on the basis of legitimate interests, including at any time.

Regarding automated decisions

Not to be subject to a solely automated decision with legal or similarly significant effect. No such decisions are made here.

Complaints

If you think we have handled your data badly, please tell us first — it is usually the fastest route to fixing it. You also have the right to complain directly to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk.

There is no cookie banner on this site because there is nothing to ask you about. We set no analytics cookies, no advertising cookies and no third-party trackingof any kind. Under the UK's PECR rules, consent is required for cookies that are not strictly necessary; we do not use any.

Here is the complete list of what this site stores in your browser.

ax-intro-v1 — session storage, not a cookie

Records that you have already seen the homepage opening sequence, so it does not replay on every page load. It holds the value 1 and nothing else, is never sent to a server, and is cleared when you close the tab.

Authentication cookies — strictly necessary

Set only if you sign in to the client dashboard, and only to keep you signed in. Issued by Supabase, our authentication provider. If you never create an account, this site sets no cookies at all.

Fonts and media

The typeface is served from this site rather than fetched from a font provider, so reading these pages sends no request to a third party. Video and imagery are served from our own hosting for the same reason.

The faces beside the client testimonials are illustrations, not photographs. They are drawn from Personas by Draftbit, used under the Creative Commons Attribution 4.0 licence, and served from this site. They stand in for clients who asked to be identified by initials only, and do not depict anyone.

The chat assistant

Axiom, the chat assistant in the corner, is the same product we build for clients, running on our own content. It sets no cookies and no site storage, and the conversation is gone the moment you reload.

It does not collect details in the conversation. If you choose to send an enquiry, a form opens inside the chat, and what you enter goes from that form to our server, never to the model. What happens to it is described under Privacy above.

What you type is sent to our server, and from there to a model from DeepSeek, or from Anthropic when DeepSeek is unavailable, together with the last few exchanges of the conversation so that a follow-up question makes sense. An email address or phone number typed into the conversation is replaced with a placeholder before it leaves our server. The model writes each reply in its own words, using only a set of approved answers we maintain, and names the ones it drew on. Automatic checks hold back any reply that states a figure, a timescale, a promise or a page those answers do not contain, and it will say when it has no approved answer rather than guess. The recent conversation is kept in the open page, signed so that any change to it is detected, and sent back with each message; we keep no transcript. Messages that our own safety rules claim first — clinical questions, for instance — are answered locally and never reach a provider, then or later in the conversation.

If the assistant is ever connected to a real client system, or given anything more to do, this section changes with it. The site’s no-fabrication rule applies to what it says about itself.

Controlling storage yourself

Every browser lets you block or clear site storage in its settings. Doing so here costs you nothing except that the homepage opening sequence will play again, and you will be signed out of the dashboard if you were using it.