Privacy Policy

Privacy Notice

Privacy Notice Effective Starting Date: October 5^th 2026 This Privacy Notice was developed by PaxFlow ehf. for the software “PaxFlow” (“we”, “us” or “our”) and applies to personal information we collect from visitors, and registered users of our PaxFlow Services, including from our Websites. This Policy describes how personal information is collected, for what purposes it is collected, how we share it, how we handle the content you place in our products and services, and the steps we take to secure this information.

• Why do we collect personal information
• How do we collect personal information
• How we use your personal information
• With whom do we share your personal information
• Data retention
• Data security
• International data transfer
• Automated decision-making
• Your rights concerning your personal information
• Complaints
• Changes to the privacy notice
• Contacting us

Why do we collect personal information

Personal Information is information about you that can be used alone, or combined with other information, to identify you personally. Personal Information is a broad concept and includes a wide range of information such as name, email address, mailing address, IP addresses and cookie identifiers. Personal Information does not include information that has been anonymised such that it does not allow for the identification of a specific individual. We collect Personal Information to operate effectively, and to provide you the best experiences with our PaxFlow Services.

How do we collect personal information

We, and our service providers, collect personal information in a variety of ways. If you choose not to provide us with personal information when requested, we may not be able to provide you with the information and/or services you have requested or otherwise fulfil the purpose(s) for which we have asked for the personal information. Aside from this, your visit to our websites will remain unaffected. When we collect your personal information, we will let you know why we are collecting it and how we will use the information.

Personal Information you provide to us

Account and Profile Information:

We collect Personal Information when you register for an account or modify your account profile. Personal Information we collect may include your contact information (name, email address, telephone number, mailing address). You may provide this information directly when you enter it in PaxFlow Services, or in some cases another user may provide it on your behalf. If you are providing information (including Personal Information) about someone else, you confirm that you have the authority to act for that person, and to agree to this Privacy Notice. We do not request sensitive personal information.

User Content:

If you create, input, submit, post, upload, transmit, and/or store information (“User Content”) while using the PaxFlow Services, your Personal information such as name, email address or other contact information will be associated with that User Content. For example, information regarding a problem you are experiencing with a PaxFlow Service could be submitted to our Support Services or posted in our public forums. Payment Information: We may collect and process payment information from you when you subscribe or purchase PaxFlow Services. Payment information may include credit card numbers and billing information, using third party PCI-compliant service providers.

Personal Information we collect from your use of PaxFlow Services

Log files:

When you interact with the PaxFlow Services, we generate log files to help us operate and improve our PaxFlow Services. Web log files includes internet protocol (IP) addresses as well as browser type, internet service provider, URLs of referring/exit pages, operating system, date/time stamp, information you search for, locale and language preferences, identification numbers associated with your Devices and system configuration information. Occasionally, we connect Personal Data to information gathered in our log files as necessary to improve PaxFlow Services for individual customers.

Analytics Information from our Website:

We collect analytics information using cookies to help us operate and improve our website. The analytics information includes elements of content related to the function the user is performing. As such, the analytics information may include Personal Information.

Usage Data:

“Usage Data” is aggregated data about a group or category of services, features or users that should not contain Personal Information. If Usage Data will be collected and will contain Personal Information, it is a by-product of our efforts to understand broader patterns and trends. It is not a concerted effort by us to examine the content of any particular user.

Cookies and Other Tracking Technologies:

We use various technologies to collect information. For more information about our use of cookies, see our Cookie Notice. We also collect information using web beacons (also known as “tracking pixels”). Web beacons are electronic images that may be used in our Website or emails that help us to deliver cookies, count visits, understand usage and campaign effectiveness and determine whether an email has been opened and acted upon.

Personal Information we collect from other sources

Personal Information from third-party services:

In order to provide you with certain services, we may obtain Personal Information from our third-party service providers to verify and confirm the information you have submitted. For example, if you log into our PaxFlow services through a third-party service, that service may share your Personal Information with us.

How we use your personal information

When we use your personal information, it will be (a) with your consent, or (b) for one of two basic purposes: (1) to operate our business and provide (including improving and personalizing) the products we offer, and (2) to send communications, including promotional communications. Operating our Business. We use your information to provide and improve the products we offer and perform essential business operations. This includes operating the products, maintaining and improving the performance of the products, developing new features, conducting research, evaluating your suitability for employment opportunities, and providing customer support. Examples of such uses include the following:

• Providing the Products. We use your information to carry out your transactions with us and to provide our products to you.
• Customer support. We use your information to diagnose product problems and provide other customer care and support services.
• Product Improvement. We use your information to continually improve our products, including adding new features or capabilities.
• If you provide payment information, we use such information solely to collect payment from you. We use a third-party service provider to manage credit card processing.
• Security, Safety and Dispute Resolution. We use your information to protect the security and safety of our products and our customers, to detect and prevent fraud, to confirm the validity of software licenses, to resolve disputes and enforce our agreements.
• Business Operations. We use your information to develop aggregate analysis and business intelligence that enables us to operate, protect, make informed decisions, and report on the performance of our business.
• Legal Obligations. We use your information as required by law.
• We use your information to communicate with you and personalize our communications with you.

If your consent is the basis for our use of your personal information, then you have the right to withdraw your consent at any time. If you wish to withdraw consent, please email us in accordance with the “Contacting Us” section.

With whom do we share your personal information

Our third-party service providers:

Some of the services we provide require the involvement of third-party service providers such as application development, maintenance, virtual infrastructure (including storage and backup), payment processor providers, communications providers, customer relationship management providers, background check providers; recruitment firms; and software providers. We have carefully selected these third-parties and have taken steps to ensure that your Personal Information is adequately protected. We do not share your Personal Information with third-parties for their marketing purposes (including direct marketing).

Third-party applications:

You may choose to make use of third-party Add-Ons in conjunction with PaxFlow Services. Third-party Add-Ons are software written by third-parties to which you grant access privileges to your content (which may include your Personal Information). PaxFlow Privacy Notice does not cover the collection or use of your data by third-party Add-Ons. You should examine the privacy policies governing each third-party Add-Ons.

Google API Services:

PaxFlow’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. See our Google Limited Use Disclosure for details on how PaxFlow uses Google user data.

Compliance with Laws and Legal Requests:

We may disclose your Personal Information to a third-party if we believe that disclosure is reasonably necessary to comply with any applicable law, regulation, legal process or governmental request.

Protection of PaxFlow Services:

We may disclose your Personal Information to a third-party, if we believe it is reasonably necessary to (a) to enforce our agreements, policies and terms of service; (b) to protect the security or integrity of PaxFlow’s products and services; (c) to protect PaxFlow, our customers or the public from harm or illegal activities; or (d) to respond to an emergency which we believe in the good faith requires us to disclose information to assist in preventing the death or serious bodily injury of any person.

Business Transfers:

In the case of a sale, merger, consolidation, liquidation, reorganization, or acquisition, any acquirer will obtain your personal information subject to our obligations under this Privacy Notice.

With Your Consent:

We will share your Personal Data with third-parties when we have your consent to do so.

AI assistant connections

You can connect an AI assistant, such as Claude by Anthropic or ChatGPT by OpenAI, to PaxFlow. The assistant then looks up your company’s PaxFlow data and, if you allow it, changes that data or sends messages on your behalf. The connection uses the Model Context Protocol (MCP) at https://mcp.paxflow.io/mcp. Nothing is shared with an assistant until you connect it yourself. You connect by signing in with your PaxFlow account through our login provider, Auth0, in its EU region, or with a personal API key from PaxAdmin. The assistant never sees your PaxFlow password. Setup steps are in our help center.

What the assistant can see and do

The assistant has the same access as you have in PaxAdmin, and no more. It can only reach companies you are a member of and the sections your role allows. Depending on your request, it can read bookings, passenger names and contact details, departures, products, staff, shifts, resources and message templates.

The assistant can change data or send messages only when you have given it write access and your role allows the change. To send an email, SMS or WhatsApp message, the assistant first gets a preview of the message and its recipients. The message goes out only on a second, confirmed request. Claude and ChatGPT ask you to approve actions like these before they run.

What we receive and keep

For each request, we receive the name of the tool the assistant calls and its inputs, such as a date, a departure number or a search term. We do not receive your conversation with the assistant or its history.

We keep:

• An entry in your company’s audit log for each request: who made it, when, which tool ran, whether it succeeded and which records it changed. Company administrators can see this log. We delete entries after 12 months.
• Sign-in tokens. The access token expires after 24 hours. The refresh token expires after 30 days, or after 15 days without use. Each token works only for PaxFlow’s MCP address.
• API keys, stored as a hash, never as the key itself. A key works until it expires or you revoke it.

What we send to the assistant

We send only the data needed to answer your request. Once the assistant receives it, the provider of that assistant processes it under their own terms and privacy policy, including their rules on retention and model training:

• Anthropic: https://www.anthropic.com/legal/privacy
• OpenAI: https://openai.com/policies/privacy-policy

You choose which assistant to connect, and your agreement with its provider governs what happens to the data there. PaxFlow does not use data from these connections to train AI models and does not sell it.

We process this data to provide the service you asked for when you connected the assistant. We keep the audit log for security and so your company can see what was done in its name.

How to disconnect

Remove PaxFlow in the assistant’s settings, or revoke your API key on your profile page in PaxAdmin. A revoked key stops working at once. To ask us to remove a connection or its log entries, email info@paxflow.io.

Data retention

We retain your personal information for the length of time required for the specific purpose or purposes for which it was collected, plus an additional six (6) months, which allows you to resume use of our services without loss of data. We may be obliged to store some data for a longer time, for example, where a longer time period is required by applicable law. In this case, we will ensure that your personal information will continue to be treated in accordance with this Privacy Notice. Retention for AI assistant connections is described in AI assistant connections.

Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

International data transfers

We do not directly transfer personal information of visitors located in the EEA to third parties located outside of the EEA. We host PaxFlow on Google Cloud servers in Belgium (europe-west1). If you connect an AI assistant, the data you ask it to work with goes to that assistant’s provider, which may process it outside the EEA under its own terms. See AI assistant connections.

Automated decision-making

At this time, we do not use any automated decision making processes. However, we reserve the right to make automated decisions, including using machine learning algorithms or other artificial intelligence, about our customers and website visitors in order to optimize the products and services offered and/or delivered.

Your rights concerning your personal information

You have the following rights:

1. To review, change, or delete your personal information
2.  To object to direct marketing
3. To ask about how we are processing your personal information
4. To restrict our processing of your personal information
5. To have a copy of your personal information
6. To transfer your personal information from us to another person or business

Should you wish to exercise any of your rights, or if you should have any questions concerning your rights, please contact us using the information in Contacting Us section. We will respond within one month.

Complaints

If you have any complaints about this Privacy Notice or are unsatisfied with any response we provided, you may complain to the supervisory authority in Iceland: The Icelandic Data Protection Authority Rauðarárstígur 10 105 Reykjavík Iceland Tel. +354-510-9600 e-mail: postur@personuvernd.is https://www.personuvernd.is/information-in-english/ Additionally, contact details for data protection authorities in the EEA, Switzerland and certain non-European countries are available here.

Changes to the Privacy Notice

Any changes to this Privacy Notice will become effective when we post the revised Privacy Notice. Your use of the services following these changes means that you accept the revised Privacy Notice.

Contacting us

If you have questions or comments about our privacy practices, please contact us by e-mail at info@paxflow.io or by mail at the following address: PaxFlow ehf., Borgartún 27, 105 Reykjavík, Iceland.