Privacy Policy
Last Man Up Inc. · Draft — pending attorney review, not yet effective
This describes what Axis' Iliad collects, why, and your rights over it. It is published as a working draft ahead of formal legal review — the described behavior matches the current live system, but the document itself has not yet been reviewed by counsel.
Contents
1. Who We Are
Axis' Iliad ("Axis", "we", "us") is a hosted codebase-analysis and artifact-generation service, operated by Last Man Up Inc. The API is served at api.iliad.trustfabric.ai and the web dashboard at iliad.trustfabric.ai. The service is also reachable as an MCP (Model Context Protocol) server at the /mcp endpoint.
2. What We Collect and Why
2.1 Source code you submit
When you upload files or point Axis at a GitHub repository, the submitted file contents are stored as a snapshot in our PostgreSQL database (Neon, US). While you're logged in to the web dashboard, this lets you request additional analyses of the same snapshot without re-uploading. Logging out of the web dashboard discards that source content — we keep only file paths, sizes, and the analysis artifacts already generated for you, not the underlying code. This logout-triggered discard is specific to the web dashboard's login session; if you use the API, CLI, or MCP server directly, there's no login/logout session to trigger it, so that source content is retained until you delete it via DELETE /v1/snapshots/:snapshot_id, DELETE /v1/projects/:project_id, or the dashboard. We do not sell, license, or train machine-learning models on your source code.
2.2 Account information
When you create an account we store your name, email address, billing tier, and account creation timestamp. We use your email to operate your account (key recovery, billing notices, transactional messages) — never for third-party advertising.
2.3 API keys and GitHub tokens
API keys are shown to you once at creation; we store only a SHA-256 hash, never the raw key. Revoked keys are purged 90 days after revocation. A GitHub personal-access token you connect is encrypted at rest with AES-256-GCM and can be listed or deleted at any time.
2.4 Payment information
Payments are handled by PAI'D Payments Intelligence, which settles transactions via Stripe, Inc. Card details are entered directly into Stripe-hosted surfaces and never touch Axis servers. Each purchase is a single one-time charge, not a recurring subscription — see the Terms of Service for the current billing model.
2.5 Usage counters and logs
We record per-account usage (which program ran, when, credits consumed) for billing, abuse prevention, and rate limiting, using first-party counters only — no third-party analytics or advertising trackers. Standard service logs (request method/path, status, latency) are written to our hosting provider's log stream for debugging and security monitoring.
3. Cookies and Local Storage
The Axis web dashboard does not use third-party advertising cookies. Your signed-in session is held in an HttpOnly session cookie, which JavaScript on the page cannot read. The dashboard additionally stores a non-sensitive session marker, your theme preference, and your most recent analysis result in your browser's localStorage — none of which is your actual credential. Logging out clears the session cookie and the stored marker, and also discards your uploaded source content (see 2.1).
4. Subprocessors
We share data with the following service providers, strictly to operate the service. We do not sell personal information to any party.
| Subprocessor | Purpose |
|---|---|
| Render (US) | Application hosting |
| Neon (US) | Managed PostgreSQL database — all persisted service data |
| Cloudflare | Web frontend hosting / CDN / object storage |
| GitHub | OAuth sign-in, repository fetching, webhooks |
| PAI'D Payments Intelligence | Payment orchestration |
| Stripe | Underlying payment processing (via PAI'D) |
| OpenAI | Embeddings proxy tool |
| Resend | Transactional email delivery |
| Firecrawl | Web research proxy tools |
5. Data Deletion
- Snapshots / projects: self-serve, immediate, via the API or dashboard.
- Stored GitHub tokens and webhooks: self-serve, via the API or dashboard.
- Full account deletion: email [email protected] from your account email address.
6. Your Rights — GDPR (EEA/UK Users)
If you are in the European Economic Area or the United Kingdom, you have the right to access, rectify, erase, restrict or object to processing, receive a portable copy of, or withdraw consent for your personal data, and to lodge a complaint with your local supervisory authority. Contact [email protected] to exercise any of these rights.
7. Your Rights — CCPA/CPRA (California Users)
California residents have the right to know, access, delete, and correct their personal information, without discrimination for exercising these rights. We do not sell personal information or share it for cross-context behavioral advertising. Contact [email protected] to exercise these rights.
8. Security
API keys are stored only as SHA-256 hashes; GitHub personal-access tokens are encrypted at rest with AES-256-GCM; payment-card data is handled exclusively by Stripe; webhook payloads are verified with HMAC-SHA-256 signatures; all API and dashboard traffic uses TLS in transit. No system is perfectly secure — if we become aware of a breach affecting your personal data, we will notify you as required by applicable law.
9. Children
The service is not directed at children under 16, and we do not knowingly collect personal information from them.
10. Changes to This Policy
We will post updates to this page and revise it accordingly. Material changes will be announced by email to account holders.
11. Contact
Questions, rights requests, or complaints about this policy:
Privacy & Data Requests
[email protected]Last Man Up Inc. · Full text: see PRIVACY_POLICY.md in the repository.