Privacy Policy

Who we are

AskThis is a product of Agochar Tech LLP, a limited liability partnership registered in India under the Limited Liability Partnership Act, 2008, with its registered office at 415 Decora Square, Sadhu Vasvani Road, Rajkot 360005, Gujarat, India. In this policy "we", "us" and "AskThis" mean Agochar Tech LLP.

We are the data fiduciary under India's Digital Personal Data Protection Act, 2023, and the data controller under the EU and UK GDPR, for the personal data described in "Publisher accounts" and "This website" below.

We have not yet appointed an EU representative under Article 27 GDPR. If you are in the EEA and need to reach us about EU data protection, use the privacy address above; we will respond on the same timelines set out in this policy.

Two different relationships

AskThis is an embeddable widget. That means we handle data in two distinct situations, and your rights differ between them.

• If you visit a website that has installed our widget, the website's owner (the "publisher") decides to use AskThis and is the controller of the data collected there. We act as their processor, and we also use aggregated, non-identifying signals derived from that data for our own products — for that narrow purpose we are a controller. The "Widget events" and "Commercial datasets" sections apply to you.
• If you are a publisher with an AskThis account, we are the controller of your account data. The "Publisher accounts" section applies to you.

The publisher, not AskThis, controls whether the widget appears on a page and what consent is sought before it runs. If you want data collection on a particular website to stop, that website's own privacy notice is the right starting point — though you can always contact us directly.

Widget events (website visitors)

When you interact with a page carrying our widget, we record pseudonymous interaction events. Each event contains only the following:

• The type of event — a page view, a share, a click on an AI answer engine, a reaction, or the fact that a question was asked.
• Which platform was chosen, where relevant (for example ChatGPT, Claude, or LinkedIn).
• A short hash of the page address, with any URL fragment removed, plus a coarse page type such as “article” or “product”.
• A random session identifier that exists only for the current browsing session.
• A two-letter country code, derived at our network edge and never accompanied by your IP address.
• A device class — mobile, tablet, or desktop.
• A timestamp, and the hostname (never the full address) of the page that referred you.

What we deliberately do not collect

• No cookies. The widget sets none at all.
• No IP addresses. Your IP reaches our edge network, which converts it to a country code and discards it. It is never written to storage.
• No names, email addresses, or phone numbers. Events whose identifier fields contain patterns that look like an email address or a long number are dropped at ingestion rather than stored; question text, where recorded, is handled as described below.
• No fingerprinting, no cross-site tracking, and no advertising identifiers.

Question text

Suggested-question clicks record the question text the site owner wrote — not anything you typed. If a site owner enables typed-question capture, the text you type in the ask-box is recorded after automated redaction of email addresses, links and number sequences, and is deleted within 90 days. On sites that leave this off (the default), your typed question never touches our servers — your browser sends it directly to the AI service you chose.

Pseudonymous, not anonymous

We describe this data as pseudonymous and we mean the distinction. The session identifier is random and expires when you close the tab, and page addresses are shortened into a hash rather than stored in full — but a short hash of a public web address can, with effort, be matched back to that address. We therefore treat this data as personal data and give it the protections described below, rather than claiming it is anonymous and outside the law.

Storage on your device

The widget stores a random session identifier in your browser's session storage so that repeated actions in one visit are not double-counted. Session storage is cleared automatically when you close the tab. Nothing is written to cookies or to long-term local storage.

Consent and your choices

How consent works depends on where you are. In the EU, EEA and UK, we do not store or process widget events at all without a consent signal. Everywhere else, events are collected for the publisher's own analytics, and your consent choice controls whether that data may additionally be sold or shared.

We would rather state that precisely than imply a single rule that isn't true everywhere. If you are in the EU, EEA or UK, our edge network discards your events when no consent signal is present — they are never written to storage, never analysed, and never sold. In other regions, the events are collected to give the publisher analytics about their own website, and your consent decision — signalled through that website's consent banner — determines whether the same data may additionally enter the commercial datasets described in the next section.

The default is refusal. Without a positive consent signal, an event is either discarded (EU/EEA/UK) or, elsewhere, marked as not saleable at the moment it is recorded and excluded from every commercial dataset from then on.

We honour Global Privacy Control. If your browser sends a GPC signal, our edge network treats it as a refusal regardless of anything the page says — a publisher cannot override your GPC signal.

A limit worth stating plainly: our server-side gate is what stops EU/EEA/UK data from being stored without consent. The widget still writes one temporary session identifier to your browser before that gate applies, so your publisher remains responsible for obtaining any prior consent their ePrivacy rules require before the widget runs. If you believe a site is running our widget without the consent your law requires, tell us at privacy@askthis.io and we will take it up with that publisher.

Commercial datasets

Our business model includes selling aggregated behavioural datasets — including what we call AI intent signals, meaning patterns in which topics send people to AI answer engines. We would rather you learn that here than infer it later.

Several hard limits apply, and they are enforced in our software rather than promised in prose:

• Only data carrying a positive consent signal is eligible. Everything else is filtered out at the first stage of the pipeline.
• A cohort smaller than 50 people is never sold. This k-anonymity floor is enforced independently in four places — the data API, the transformation models, the pipeline jobs, and an automated test that fails the build if a smaller cohort ever appears.
• Datasets contain aggregates only. No session identifier or per-person record is ever included in a product sold to a buyer.
• Deletion requests propagate. Once an identifier is on our suppression list, every downstream dataset excludes it.
• We never sell data that identifies you, and we never place advertising in the widget.

As of the date below, no dataset containing real personal data has been sold or delivered to any buyer. The capability is built; the commercial relationships are not live. We will update this page before that changes.

Publisher accounts

If you create an AskThis account, we process the data needed to run it:

• Your email address, and your name and profile image if you sign in with Google, GitHub or Microsoft.
• A password, if you use one. Passwords are stored only as a cryptographic hash — we never hold your password itself and cannot recover it.
• Session records, which include the IP address and browser user-agent of the device you signed in from. This is the one place we retain IP addresses, and it exists so you can review and revoke your own sessions. It is never combined with widget event data.
• Two-factor authentication secrets and backup codes, if you enable them.
• Your organisation, team memberships, role, and an audit log of significant actions taken in your account.
• Billing records: your plan, invoices, and — for cards — the brand and last four digits only. Full card numbers go directly to our payment gateway and never reach our servers.
• The websites you register, the pages we scan for you, and the prompts generated for them.

We use this to provide the service, authenticate you, bill you, respond to support requests, and meet our legal obligations. Our lawful basis is performance of our contract with you, and our legitimate interest in securing and improving the service.

This website

On our own websites — askthis.io and askthis.dev — we use Google Analytics 4 and Microsoft Clarity to understand how visitors navigate the site. Each site is treated separately, with its own cookie banner and its own consent choice.

These are strictly opt-in. No analytics script loads and no analytics cookie is set until you choose "Accept" in our cookie banner. Choosing "Decline" loads nothing. If your browser sends a Global Privacy Control signal we do not show the banner at all and load nothing. You can change your mind at any time via "Cookie preferences" in the footer. Full detail is in our Cookie & Tracking Notice.

Data collected on this website is never mixed with widget event data and is never sold.

AI features

AskThis uses large language models to generate the sharing prompts and summaries that appear in the widget. Two commitments govern this:

• No visitor data ever reaches a language model. Generation happens when we scan a publisher's page, not when you interact with the widget. Your clicks, session, and country are never sent to an AI provider.
• What we do send is the publisher's own page content — the text of the page being scanned, capped at 6,000 characters — to Anthropic, or to OpenRouter where a publisher has configured it. Results are cached so a given page is processed once per change.

The prompts our widget produces are generated text. They can be imperfect, and the answers an AI service gives are produced by that service, not by us. When you click through to ChatGPT, Claude, Perplexity, Copilot or Gemini, you leave our widget and that service's own terms and privacy policy govern what happens next — including the question you type.

Who we share data with

We do not sell or rent data that identifies you. We share data only with the sub-processors that make the service work, each under contract and each limited to what its job requires. We publish the full list — who they are, what they do, what they can touch and where they are — in our Data Processing Agreement rather than making you ask for it.

We also disclose data where we are legally required to, and to protect our rights or the safety of others. If a publisher configures event forwarding to their own analytics tools, their events go to those tools under the publisher's own privacy notice, not ours.

How long we keep data

Your plan's advertised history window controls how far back the dashboard will show you data. It is a view limit, not a longer retention promise: raw events are deleted at 13 months on every plan, and longer history windows are served from aggregated statistics.

Your rights

Everyone

Whatever law applies to you, you can ask us to access, correct or delete your data, and you can complain to us directly at privacy@askthis.io. We answer within 30 days. We never charge for this and we never require you to create an account to ask.

India (DPDP Act, 2023)

You have the right to access a summary of your personal data and our processing of it, to correction and erasure, to nominate another person to exercise your rights if you die or become incapacitated, and to an accessible grievance redressal mechanism. Contact our Grievance Officer, Rajesh Dalsaniya, at grievance@askthis.io. We acknowledge grievances within 24 hours and resolve them within 15 days, as the IT Rules require. If you are unsatisfied with our response, you may escalate to the Data Protection Board of India.

EEA and UK (GDPR)

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting processing already carried out. You may lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner's Office.

California (CCPA/CPRA)

You may request disclosure of the categories and specific pieces of personal information we have collected, request deletion, correct inaccurate information, and opt out of the sale or sharing of your personal information. We do not offer financial incentives and we will not discriminate against you for exercising any of these rights.

To opt out of sale or sharing, use the "Do Not Sell or Share My Personal Information" control in the consent banner on the site you are visiting, or send a Global Privacy Control signal — we honour it automatically and treat it as a valid opt-out.

A limit worth being honest about

Widget data is pseudonymous: we hold no name or email against it. If you ask us to delete your widget data, we usually cannot identify which records are yours, because we deliberately never built the link that would let us. Where you can supply the identifier, we add it to our suppression list, which removes it from every commercial dataset. Otherwise, the honest answer is that the records expire on the schedule above, and no one can tie them to you in the meantime.

International transfers

We operate from India and use sub-processors in the United States and on global edge networks, so your data may be processed outside your country. Where personal data is transferred out of the EEA or UK we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, together with the technical measures described in this policy. The complete list of sub-processors and their locations is in our Data Processing Agreement.

Children

AskThis is a business tool. It is not directed at children, and we do not knowingly create accounts for anyone under 18.

The widget cannot tell how old a visitor is. India's DPDP Act prohibits tracking and behavioural monitoring of children under 18, and the US Children's Online Privacy Protection Act imposes obligations for children under 13. If your website is directed at children, or you know a section of it is, you must not enable the sale-consent mode on it and should consider whether to run the widget there at all. That decision is yours as the publisher; we cannot make it from our side.

If you believe we hold data from a child in circumstances the law does not permit, write to privacy@askthis.io and we will delete it.

Security

We protect data with TLS in transit, encryption at rest, least-privilege access, strict origin checks and edge rate limiting. Passwords are hashed, never stored. Our Trust, Security & Accessibility page describes our practices and how to report a vulnerability.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant regulators within the timeframes our law requires — 72 hours to a supervisory authority under the GDPR, and without delay under the DPDP Act.

Changes to this policy

We update this policy as the product changes. If a change materially affects your rights — particularly anything touching the commercial datasets described above — we will announce it in the dashboard or by email before it takes effect, and update the date at the top of this page.