Privacy policy

Axum provides AI capabilities for business operations under the Axum brand. Its parent companies are FIVESIX MEDIA LLC in the United States and FIVESIX MEDIA LTD in Nigeria (“Axum”, “we”, “us”, “our”). FIVESIX MEDIA LLC does business as Axum and Axumworks.

We are governed by the Nigeria Data Protection Act 2023 (NDPA). Where we serve customers or handle data connected to the European Economic Area or the United Kingdom, we align our practices with the EU General Data Protection Regulation (GDPR) and extend the same core rights — access, rectification, erasure, portability, restriction and objection — to everyone we hold data about, regardless of location.

You can reach us at support@axumworks.com about anything in this policy.

How we handle data depends on whose data it is. It matters because it decides who you contact to exercise your rights.

a. When you visit our site or request a demo

When you submit the demo form, or the business-case form on the ROI page, we collect the details you provide. We also collect a small amount of technical data with the submission:

• You give us: your name, work email, company, and any free-text message you write. On the ROI page you also give us your business name and your WhatsApp number. You also give us the calculator figures: receipts a month, minutes for each receipt, staff cost an hour, and the number of distributors. A team member may contact you on WhatsApp about your request. We do not send an automated message.
• Captured automatically with the submission: your IP address, browser user-agent string, and the date and time — used to prevent abuse of the public form and to understand where enquiries come from.

With your permission, our public website uses Google Analytics to measure visits, campaign sources, and interactions such as booking-link clicks, and the OpenAI (ChatGPT Ads) measurement pixel to measure page views, completed enquiries and clicks through to book a call from our ChatGPT ads. Questionnaire answers are not sent to either (see Cookies).

b. Business data you connect to Axum

A customer can connect Axum to Odoo or to a Google Sheet, or send a spreadsheet export that our team imports. We then process the records needed to watch account activity. This can include the names and contact details of the customer’s own end-customers or distributors, order and invoice history, product lines, and revenue figures. Each customer’s data is isolated per organization; it is never pooled with, or exposed to, another customer. For this data we act as a processor.

c. WhatsApp and messaging agents

Axum can operate over Slack and WhatsApp (via the Meta WhatsApp Cloud API). For customers who use the WhatsApp bookkeeping agent, we process the messages, phone numbers, and images of receipts or invoices sent to the agent. These are read to extract accounting entries, which are only written to the customer’s accounting system after a human confirms them. We do not use WhatsApp content for advertising or profiling.

d. Operator console & account data

Operators who log in to the Axum console have account credentials (an identifier and a securely hashed password) and a session. We also process the queries operators type when they “ask their sales data” a question, in order to return an answer.

We use personal data only for these purposes:

• To respond to you — reply to demo requests, set up pilots, and provide support.
• To provide the service — detect quiet accounts, generate recommendations and digests, answer questions about the connected data, and extract bookkeeping entries.
• To secure and operate the platform — authenticate operators, prevent abuse and fraud, keep audit trails, and troubleshoot.
• To improve Axum — understand how features are used, in aggregate.
• To meet legal obligations — accounting, tax, and lawful requests.

Where the GDPR or the NDPA requires a lawful basis, we rely on:

• Consent — when you submit the demo form or the business-case form on the ROI page, or opt into messaging over WhatsApp. You can withdraw consent at any time.
• Contract — to deliver the Axum service to a customer who has signed up or is in a pilot.
• Legitimate interests — to secure our platform, prevent abuse, and understand demand for the product, balanced against your rights.
• Legal obligation — where the law requires us to retain or disclose data.

Axum uses large-language-model AI to read questions, analyse account activity, and extract data from receipts and invoices. To do this, relevant text and images are sent to an AI provider, which processes them on our behalf and returns a result. We use the providers below, each for a different part of the product:

• OpenAI — the “ask your sales data” chat assistant. Your question, and the sales records needed to answer it (which can include your customers’ or distributors’ names and revenue figures), are sent to OpenAI. It also produces the plain-English summaries shown alongside forecasts and anomalies, and the short titles and saved facts derived from your chat threads.
• OpenAI (speech to text) — voice notes and other audio files you send to the WhatsApp bookkeeping assistant. We send the audio to OpenAI to turn it into text. We keep the text. In our message log, we hide long numbers such as account numbers. If your words change a receipt draft, we keep those words with the draft. We do not keep the audio. We do not transcribe forwarded voice notes.
• Anthropic (the Claude API) — the WhatsApp bookkeeping assistant, which reads the receipt and invoice images and text you send and turns them into a draft accounting entry. It also writes the plain-English product-health notes in the console (product names, their health scores and coverage) and the guidance attached to upcoming local events (event details and your product lines).
• Other AI model providers — run some Marketer and chat tasks and check the quality of AI answers, only if enabled. They pass requests to AI models.

We check the quality of some Analyst reports: revenue trend, period comparison and margin walk. We record how Axum produced each report with a monitoring service. This runs only if enabled. Each record includes your organization and thread identifiers, which AI model answered, its timing and cost, and the Analyst's written answer. We record the written answer before we fill in any figures, so it refers to them by placeholder. We do not send an answer that writes a number out directly. It can still name your products or customers. The monitoring service stores these records on our behalf.

We do not sell personal data and we do not sell or rent contact lists. We share data only with the service providers (sub-processors) that make Axum work, each of which uses it only for the service:

We may also disclose data where required by law, or to protect our rights, safety, or property. If Axum is ever involved in a merger or acquisition, we will notify affected parties before data becomes subject to a different privacy policy.

Some of our providers process data outside Nigeria — for example in the United States or the European Union. When we transfer personal data across borders, we use providers whose terms include data protection commitments.

• Demo requests and ROI business-case requests — kept while we are in contact and for a reasonable period after, then deleted or anonymised.
• Customer business data — kept for the life of the customer’s account and deleted after the service ends, per the customer agreement and their instructions.
• Operator accounts & logs — kept while the account is active; security logs kept for a limited period for audit and abuse prevention.

We keep data only as long as needed for the purpose it was collected or as the law requires, then delete or anonymise it.

We protect data with encryption in transit (TLS/HTTPS), access controls and authentication for the console, per-organization isolation so one customer cannot see another’s data, hashed credentials, rate limiting on public endpoints, and human confirmation before any financially consequential action. No system is perfectly secure, but we work to keep the risk low and to respond quickly if something goes wrong.

Under the NDPA and GDPR you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct data that is wrong or incomplete.
• Erasure — ask us to delete your data (“right to be forgotten”). See Delete my data for the quickest route.
• Restriction & objection — limit or object to how we use your data.
• Portability — receive your data in a portable, machine-readable format.
• Withdraw consent — at any time, without affecting prior processing.

To exercise any right, email support@axumworks.com. We respond within the time the law allows (generally 30 days). A business that uses us may have connected your data to Axum. That business is the controller of it, so we will point you to that business.

• Public website — Google Analytics and the OpenAI (ChatGPT Ads) measurement pixel load only after you choose Allow analytics. They measure website usage, campaign attribution and ad conversions using analytics cookies and similar identifiers. Choose Analytics preferences on any public page to change your choice. Declining leaves the website and booking flow available.
• Operator console — a single strictly-necessary session cookie to keep you signed in. It carries no tracking and is not shared.
• Preferences — your analytics choice, and the currency that you pick on the pricing page, stay in your browser’s local storage. We do not receive them.
• Fonts — our public website serves its typeface from our own servers. The signed-in app and the status page load typefaces from Google Fonts, which receives the visitor’s IP address to serve the font files. No cookie is set by this.

Axum is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy as Axum evolves or the law changes. When we do, we revise the “last updated” date above, and for material changes we take reasonable steps to notify customers. Continued use of Axum after an update means you accept the revised policy.

For any privacy question or to exercise a right, contact us:

If you are in Nigeria and believe we have not handled your data lawfully, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC). If you are in the EEA or UK, you may complain to your local data-protection supervisory authority. If you are in the United States, you may have rights under applicable state privacy laws, such as the Connecticut Data Privacy Act. We would appreciate the chance to resolve it with you first.