Privacy Policy

Effective date: 1 November 2025 · Last updated: 12 October 2026

At One Axion, your privacy is our priority. This Privacy Policy explains how we collect, store, use, and protect your personal information in accordance with the UK GDPR, EU GDPR, and the Cyprus Personal Data Law 125 (I)/2018.

Who is responsible for your data

The controller of your personal data, the person who decides how it is used and is responsible for it, is Philip Neil, trading as One Axion. For any question about your data, or to use any of the rights below, email hello@oneaxion.com.

Information We Collect

We may collect personal information you voluntarily provide when:

• Purchasing a digital product.
• Booking virtual consultations.
• Contacting us via forms or email.
• Registering your interest in One Axion AI Business Agents.
• Asking for the free Mortgage Readiness Checklist.

This may include your name, email address, contact details, and payment information.

Please do not send health details through our forms. We check every message automatically, and one that appears to mention them is kept only in our email inbox, to reply to you, not in our database or our admin panel.

When you buy, the checkout also records two things, if there are any: the campaign tag on the link that brought you to the page you bought from (for example utm_source=youtube), and your answer to the optional question “How did you hear about One Axion?”. Both are kept by Stripe with your order and shown to us when you buy. They tell us which of our videos and posts lead to sales, not who you are, and we rely on our legitimate interest in knowing that. You can leave the question blank.

If you register your interest in AI Business Agents, we also ask for your business name, what kind of business it is, and which language you would like your customers answered in. We use those three things for one purpose: to prepare for the conversation and to reply to you in the right language. They are not used to profile you, they are never sold or shared, and if you would rather not give them, email us instead and we will pick it up from there. Please do not put details about your own customers or patients in that form.

The assistant on this site and the demo agent on the AI Business Agents page are both AI, and they say so. What you type into either one is sent to Anthropic, in the United States, which runs the model that writes the reply. Anthropic deletes it within 30 days in the ordinary course, and does not use it to train its models; a conversation flagged under its own usage rules can be kept for longer. We keep no copy: nothing you type into the chat is written to our database or shown in our admin panel. Please do not type anything sensitive into it (health details in particular) and never type a password or a card number. If you need to tell us something private, email hello@oneaxion.com instead.

If you accept analytics cookies, we also collect information automatically: pages visited, approximate location from your IP address, device and browser type, and a random visitor ID that Google generates. If you decline, none of that is collected.

Separately from analytics, and whatever you choose on the cookie banner, our servers briefly record the IP address a form submission or download request comes from, so the same address cannot hammer them. When a form sends an email to an address you typed in, we also keep a one-way fingerprint of that address (never the address itself) for no more than 2 days, so that no address is emailed more than once a day by the same form, and nobody can use our forms to fill a stranger’s inbox. And if you subscribe to the newsletter we store the IP address of your signup as the record of your consent, as set out below.

How We Use Your Information

We use your personal data to:

• Process and deliver orders or consultations.
• Deliver the files or the consultation you paid for.
• Provide customer support.
• Improve user experience and website performance.

We do not sell, trade or rent your information. We share it only with the companies that run parts of this business for us, each under a written data processing agreement: Netlify (hosting), Stripe (payments), Supabase (our database: enquiries, newsletter subscribers, checklist requests, orders and reviews, hosted in the EU), Resend (email delivery), Cal.com (bookings), Anthropic (the site assistant and the AI Business Agents demo, which send the questions you type to its AI model to write the reply), Cloudflare (our domain, privacy-friendly visitor counts, and the bot check on our forms, described below), Google (our email inbox, through Google Workspace, and site analytics, only if you accept analytics cookies), and Zapier and Notion (our lead counts, which hold no email address: the date, the page and the campaign tag of each checklist request). If you message us on WhatsApp, your messages are also handled by WhatsApp, which is part of Meta, and by Zapier, which runs the automated assistant that answers them there.

Several of those are US companies, so some of your data is processed outside the EEA. Where that happens we rely on the safeguards recognised under the GDPR: the EU-US and UK-US Data Privacy Framework where the company is certified under it, and the European Commission’s Standard Contractual Clauses (with the UK addendum) where it is not. Email hello@oneaxion.com and we will tell you which applies to which and send you a copy.

Newsletter & Email Marketing

If you choose to subscribe to the One Axion newsletter, we collect your email address (and, if you provide it, your name) together with a record of your consent: the exact wording you agreed to, and the date, time and IP address of your signup. Our lawful basis for sending you the newsletter is your consent, which you give by ticking the (un-ticked by default) box on the signup form. We then email you a link to confirm your subscription, and if you don’t confirm within 7 days, your address is deleted.

If you ask for the free Mortgage Readiness Checklist, we email a link to it to the address you type in, and that one email is all we send unless you ask for more. Our lawful basis for that email is our legitimate interest in sending you what you asked for. If the link isn’t opened within 7 days, your address is deleted. The link opens a download page, which asks once, separately, whether you would also like two follow-up emails a few days apart and, after them, the newsletter. Nothing is chosen for you, and the checklist never depends on your answer. If you press its button, that is your consent, and we record the exact wording you agreed to and the date, time and IP address of that press. That page can only be reached through the link we emailed you, so pressing it also shows the address is yours, which is why no separate confirmation email is sent. If you don’t ask for the follow-ups, your address is deleted 30 days after you first opened the link.

If the link that brought you to the checklist page carried a campaign tag (for example utm_source=youtube), we store that tag with your request, so we know which of our videos or posts people come from. It names the campaign, never you, and it is deleted if you unsubscribe. When you first open the link, and again if you ask for the follow-ups, we add a line to our lead counts through Zapier and Notion: the date, the page and the campaign tag, never your email address or your name.

We use this information only to send you the follow-up emails you asked for, if you did, and occasional updates, new tools and practical tips. Subscriber data is stored with Supabase (hosted in the EU) and emails are delivered via Resend; both act as data processors under GDPR-compliant terms. We never sell or share your address with anyone else.

You can withdraw your consent and unsubscribe at any time. Use the unsubscribe link in any newsletter or follow-up email, or contact hello@oneaxion.com and we will remove you promptly. Unsubscribing from the newsletter does not affect any other communications relating to services you have purchased.

Cookies and what we store on your device

This site sets no cookies of its own. The only cookies you can receive here belong to Google Analytics, and they only appear if you press Accept on the banner.

The banner appears on your first visit and stays with you, page after page, until you answer it. Two buttons: Decline and Accept. Press Decline and no cookies are set and Google Analytics never loads, then or ever. Press Accept and we load Google Analytics, which measures how many people visit and which pages they read. It tells us page views, rough location, device and browser. It does not tell us who you are and we do not use it to build a profile of you. Google is based in the United States and receives that data as our analytics provider.

Until you press one of those buttons, nothing that stores anything on your device loads. There is no third option and no pre-ticked box. Ignoring the banner is not consent, and neither is carrying on browsing.

Whichever you choose, we also run Cloudflare Web Analytics, which counts page views and measures how quickly pages load. It sets no cookies, stores nothing on your device, and does not follow you to other websites, which is why it sits outside the banner: there is nothing on your device for you to consent to. Cloudflare receives your IP address to work out an approximate country and does not retain it. It is what tells us how many people reach the site at all, including the majority who quite reasonably press Decline.

When you start filling in one of our forms, we also load Cloudflare Turnstile, a check that tells people apart from automated bots, so our forms cannot be used to send email to strangers. For almost everyone it is invisible; now and then it asks you to tick a box. To work, Cloudflare looks at technical signals from your browser, such as your IP address and browser type. We rely on our legitimate interest in keeping the forms working and free of abuse. Cloudflare runs the check for us, and also uses those signals, as a separate controller, to improve its bot detection; it says it does not use them to identify, profile or target anyone. The check is strictly necessary for a form to be sent, and it loads only once you type in or choose something in a form (never while you are simply reading), which is why it sits outside the banner. See Cloudflare’s Turnstile privacy addendum.

We also store a small amount of information in your browser’s local storage, which is not a cookie and never leaves your device. Today that is: your Accept or Decline choice, so we do not ask again; and, if you use one of our interactive checklists, which boxes you have ticked, so your progress is still there when you come back. We never see any of it. Each checklist has a Reset button that clears its own entry. (Our own private admin panel also keeps a key in local storage, but that runs on our computer, never yours.)

Our page fonts are served from our own website, so showing you text involves no third party at all. (Until September 2026 they came from Google Fonts, and this policy had to disclose that Google saw your IP address on every page. It no longer does, because that is no longer how it works.)

Changing your mind

You can change your answer at any time: press Cookie settings at the bottom of any page and the banner comes straight back, ready to answer differently. Withdrawing is as easy as agreeing was. If you had accepted and then decline, the page reloads so that analytics genuinely stops rather than running on until you leave.

Your choice is stored in your browser, not on our servers (so we hold no record of who accepted what), which also means it is per device and per browser: deciding on your laptop does not decide for your phone.

Data Security

We employ reasonable technical and organisational safeguards to protect your data against unauthorised access, alteration, disclosure, or loss.

However, while we take every precaution, no system is entirely immune to cyber risk. If a breach ever affects your data we will report it to the relevant authority and tell you directly where the law requires it, and we will not try to duck what we owe you: we do not exclude our liability under data protection law for a breach caused by our failure to protect your data properly.

Your Rights

Under UK, EU, and Cyprus law, you have the right to:

• Access the personal information we hold about you.
• Request correction or deletion of your data.
• Withdraw consent for data processing. For the newsletter and the checklist follow-ups, use the unsubscribe link in any email. For analytics cookies, press Cookie settings at the bottom of any page and answer the banner again.
• Object to or restrict certain processing activities.
• Request data portability.
• Complain to a data protection authority. In Cyprus that is the Office of the Commissioner for Personal Data Protection (dataprotection.gov.cy); in the UK, the Information Commissioner’s Office (ico.org.uk); elsewhere in the EU, your own national authority. You do not have to come to us first, though we would rather you did.

To exercise your rights, please contact: hello@oneaxion.com

Why we use your data, and how long we keep it

The main things we use personal data for, the lawful basis for each under the GDPR, and how long we keep it. When a period ends we delete the data, unless the law requires us to keep it longer or we need it to deal with a dispute that is already under way.

If we delete your details, at your request or because they are no longer needed, a copy is kept for up to 30 days so a mistake can be undone, then it is deleted for good.

Policy Updates

We update this policy when the law changes or when we change how the site works. The version on this page is always the current one and carries its date. If we ever start using your data for something materially different, we will ask you first rather than assume you agreed by carrying on reading.