Privacy policy

The short version

• We are [TBD: legal entity name] ("ASDK", "we", "us"). This policy explains what personal data we handle, why, and what you can do about it.
• It covers three groups of people: visitors to asdk.com and people who contact us; people who use an ASDK account; and, in summary, people who chat with an ASDK agent on another company's website. For that last group, the company that runs the website decides how the data is used, and we process it on its behalf.
• We collect only what we need to run ASDK, keep it secure, bill for it and talk to you.
• We don't sell personal data, and we don't share it for cross-context behavioral advertising.
• We don't use our customers' content or their visitors' conversations to train foundation models. The AI model providers we use process data under terms that prohibit training on it.
• asdk.com doesn't use advertising or tracking cookies, and our website analytics work without cookies.
• Account data is deleted within 30 days after an account is closed. Conversations on customers' websites are kept for 12 months by default, and each customer can change that.
• You can ask us to access, correct, delete or export your data, and you can object to some uses. Email [TBD: privacy contact email].

1. Who we are and what this policy covers

1.1 We are the controller for:

• people who visit asdk.com, use our free tools, ask for early access or contact us;
• people who use an ASDK account: our customers' account owners, team members and billing contacts; and
• people who receive emails from us.

For these people, [TBD: legal entity name], [TBD: registered office address], decides how and why personal data is used. You can reach us about privacy at [TBD: privacy contact email].

1.2 We are a processor for visitors to our customers' websites. Our customers are businesses that add ASDK agents to their own websites. When you chat with one of those agents, the business that runs the website is the controller of your data and we process it on its behalf, under our Data processing addendum. The business's own privacy notice applies to you. Section 9 summarizes how ASDK handles that data, but the business is the one to contact first.

1.3 Representatives. If the law requires us to appoint a representative in the European Union or the United Kingdom, we will name the representative and their contact details in this section.

2. Personal data we collect

When you visit asdk.com

• Technical data. Your IP address, browser and device type, operating system, language, the page you came from, the pages you request and the time of each request. Our hosting and network providers process this to deliver pages and protect the site from attacks, and it appears in our server and security logs.
• Analytics. We use Vercel Web Analytics and Vercel Speed Insights to understand how the site is used and how fast it loads. They don't use cookies. According to Vercel, Web Analytics identifies a visit by a hash created from the request, which is discarded after 24 hours, and it records data points such as the page address, the referring page, approximate location, browser, operating system and device type. Speed Insights records loading-speed measurements with the page, browser, device type and country. We see only aggregated statistics.
• Forms. When you ask for early access or contact us, you give us your name, work email address, company, website and anything you write in your message.
• Free tools and demos. When you use a free tool, such as a website checker, or try a demo of an agent on your own website, we process the website address you enter, the public content we fetch from it and the result. If a tool offers to email you a report and you ask for it, we also process your email address.
• Chat on asdk.com. If you chat with the ASDK agent on our own website, we process your messages and anything you choose to tell us, in the same way as described in Section 9, but as the controller under this policy.

When you use an ASDK account

• Account data. Your name, email address, sign-in details (if you use a password, we store it only as a secure hash), company name, role, team membership, settings, time zone and language.
• Billing data. Billing name and address, tax number, plan, invoices and payment status. Our payment processor handles payment card details. We receive only limited details from it, such as the card brand, the last four digits and the expiry date.
• Usage data. Sign-ins, actions you take in the dashboard, the features you use, your browser and device, your IP address, and error reports.
• Communications. Support requests, feedback, survey answers and your email preferences.
• Integrations. If you connect another service, such as a calendar or a CRM, we store the access tokens (encrypted) and account identifiers needed to connect, and we receive from that service only the data the features you use need.

When you chat with an ASDK agent on a customer's website

We process the messages you send, contact details you choose to give, the page you are on, approximate location and browser details, on behalf of the business that runs the website. Section 9 explains this in more detail.

From other sources

We receive your name and email address from a customer who invites you to their ASDK account, payment status from our payment processor, and data from services you connect.

3. How we use personal data, and our legal bases

The EU and UK GDPR require a legal basis for each use of personal data. These are ours.

When we rely on legitimate interests, we have weighed them against your rights, and you can object (see Section 8). You need to give us account data to use ASDK. Everything else, such as survey answers, is optional.

Personal data we process on behalf of customers (Section 9) is not covered by this table. The customer, as controller, decides the legal basis, and we process the data only on the customer's documented instructions.

4. AI and your data

4.1 How the agents use data. When a visitor asks a customer's agent a question, ASDK finds the most relevant passages in that customer's knowledge base and sends them, with the question and the agent's instructions, to an AI model provider, which generates the answer. To build the knowledge base, ASDK sends the customer's content to an embedding model, which turns passages into numbers that can be searched. Each customer site has its own separate namespace in our vector database.

4.2 No training on customer data. We don't use customers' content or their visitors' conversations to train foundation models, and we never use one customer's content to answer another customer's visitors. We use AI model providers under terms that prohibit them from training their models on the data we send. For example, OpenAI states that data sent to its API has not been used to train its models since March 1, 2023, unless the customer opts in; Anthropic's commercial terms state that it may not train models on customer content; and Google's Gemini API terms state that prompts and responses on paid services are not used to improve its products. Providers may keep requests for a limited time to detect misuse. OpenAI, for example, states that it keeps abuse-monitoring logs for up to 30 days by default.

4.3 No decisions with legal effects. ASDK does not make decisions about people that produce legal or similarly significant effects based solely on automated processing. The Sales agent can help a customer understand whether a visitor's request fits the customer's offer, but the customer decides how to follow up.

4.4 You are told when you talk to an AI. The ASDK widget tells visitors that they are interacting with an AI system.

5. How we share personal data

• Service providers. Companies that host and run ASDK for us, such as our hosting, network, vector database, AI model, email and error-monitoring providers. They may use the data only to provide their services to us, under contracts that protect it. Our Subprocessors page lists them with their purpose and location.
• Our payment processor, to take payments and handle billing and taxes. Depending on the processor, it may act as the seller of record for your purchase and then handles the payment data as a controller under its own privacy policy.
• Within a customer's account. If you are a member of a customer's team, the account owner and admins can see your name, email address, role and activity in the account.
• Services you connect. When a customer connects a CRM, calendar, webhook or automation tool, we send it the data the customer has chosen to send.
• Authorities and legal process, when the law requires it, or when it is necessary to protect the rights, property or safety of ASDK, our customers or others. We review requests from authorities carefully and disclose only what the law requires.
• Business transfers. If we are involved in a merger, acquisition or sale of assets, personal data may be transferred to the new owner, who must continue to protect it in line with this policy. We will tell you before that happens.
• With your consent, in any other case.

We don't sell personal data, and we don't share it for cross-context behavioral advertising. We don't buy personal data from data brokers.

6. International transfers

We and our service providers process data in the European Union, the United States and other countries where providers operate. The Subprocessors page shows the location for each provider. When personal data moves out of the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we protect it with:

• the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework, where the provider is certified;
• the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), together with the UK International Data Transfer Addendum or International Data Transfer Agreement for UK data; and
• additional safeguards, such as encryption in transit and at rest.

You can ask for a copy of the relevant safeguards at [TBD: privacy contact email].

7. How long we keep personal data

We may keep data longer when the law requires it or while it is needed for a legal claim. When data is deleted from our live systems, copies in backups disappear when those backups expire.

8. Your rights

If you are in the EU, the EEA, the UK or Switzerland

You have the right to:

• access your personal data and get a copy of it;
• correct data that is inaccurate or incomplete;
• delete your data in certain cases;
• restrict how we use your data in certain cases;
• receive data you gave us in a portable format, or have it sent to another company;
• object to uses based on our legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, where we rely on consent, without affecting earlier use; and
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects. We don't make such decisions.

You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work or where you think the law was broken. In the UK, that is the Information Commissioner's Office. We would appreciate the chance to address your concern first.

We reply within one month. If a request is complex or we receive many, we may extend this by up to two more months and will tell you why. We may need to confirm your identity before acting on a request.

If you are in California or another US state with a privacy law

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act, gives California residents the right to:

• know what personal information we collect, use and disclose, and get a copy of specific pieces of it;
• delete personal information we collected from them;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information. We don't sell or share personal information, so there is nothing to opt out of, and we treat a Global Privacy Control signal from your browser as a valid opt-out request;
• limit the use of sensitive personal information. We use sensitive personal information (your account sign-in details) only to provide the Service and keep it secure, which the law allows; and
• not be discriminated against for using these rights.

You can use an authorized agent to make a request; we may ask for proof that the agent is authorized and confirm your identity with you directly. We verify requests by matching the details you give us with the details we hold, usually your email address. We confirm receipt within 10 business days and reply within 45 days, which we may extend by another 45 days if needed, after telling you.

Personal information we have collected about California residents since we started operating, by CCPA category:

We use these categories for the purposes in Section 3 and keep them for the periods in Section 7. We have not sold or shared any of them.

Residents of other US states with comprehensive privacy laws have similar rights. If we decline your request, you can appeal by replying to our decision. If we turn down the appeal, we will tell you how to contact your state attorney general.

Visitors to customers' websites

If you chatted with an ASDK agent on another company's website, contact that company to use your rights. It controls your data. If you contact us instead, we will pass your request to the company and help it respond.

How to make a request

Email [TBD: privacy contact email] from the address linked to your data, or write to us at [TBD: registered office address]. If you have an ASDK account, you can also view and correct much of your data in the dashboard.

9. Visitors to websites that use ASDK agents

This section is a summary for people who chat with an ASDK agent on a customer's website. The business that runs the website is the controller and its privacy notice applies; ASDK processes the data on its behalf.

What the widget collects:

• the messages you send and the agent's replies;
• the address of the page you are on and the page you came from;
• your approximate location (such as country and city), estimated from your IP address;
• browser and device information, such as browser type, operating system and language;
• the time of each message;
• a random visitor identifier stored in your browser's localStorage, so that a conversation can continue when you move between pages or come back later; once it exists, the widget's events on that website, such as pages viewed and opening the chat, carry it too; and
• contact details and other information you choose to give, such as your name, email address, phone number, company or a meeting time you pick.

In your browser: the widget sets no cookies. Besides the visitor identifier, it keeps a few small entries in your browser's storage for that website: the ID of your current conversation, whether you already sent your contact details, which meeting links you opened and contact forms you closed in that conversation (so they aren't offered again), a short-lived session token and whether the chat panel is open. They contain no name or contact details, and they aren't used for advertising or to follow you across websites. The session token and the panel entry are deleted when you close the tab; the others stay until you clear the site's data in your browser. Our Cookie policy lists each entry and how long it lasts.

Why: to answer your questions from the business's own content; to pass your request, contact details or meeting booking to the business and, if it chooses, to its tools such as a CRM or calendar; to show the business what visitors ask so it can improve its content; to keep the service secure and prevent abuse; and to count usage for billing.

AI processing: your message and relevant passages from the business's content are sent to an AI model provider to generate an answer, as described in Section 4. This data is not used to train foundation models. The widget tells you that you are interacting with an AI system. Please don't share sensitive information, such as health details or payment card numbers, in a chat.

How long: the business decides. By default, conversations are kept for 12 months. If the business closes its ASDK account, the data is deleted within 30 days.

Your rights: contact the business that runs the website. If you contact us at [TBD: privacy contact email], we will pass your request on and help the business respond.

10. Cookies and similar technologies

asdk.com uses strictly necessary cookies and one first-party referral cookie, asdk_ref, which remembers the referral or partner link that brought a visitor and holds nothing that identifies them; our analytics work without cookies. The ASDK widget on customers' websites sets no cookies: it keeps a random visitor identifier and a few technical entries (the current conversation, whether contact details were sent, offers the visitor already finished, a short-lived session token and whether the chat panel is open) in the browser's localStorage and sessionStorage, and doesn't use them to follow visitors across websites. Our Cookie policy gives the details.

11. Security

We protect personal data with encryption in transit and at rest, access controls based on least privilege, separate knowledge namespaces for each customer site, encrypted backups and monitoring. If a personal data breach affects data we process for a customer, we notify that customer without undue delay and in any case within 72 hours after becoming aware of it. If a breach affects your data and the law requires it, we also notify you and the competent authority. Our Security page explains more.

12. Children

ASDK is a service for businesses and is not directed at children. You must be at least 18 to create an account. We don't knowingly collect personal data from children under 16 in the EU or the UK, or from children under 13 in the United States. Our Acceptable use policy doesn't allow customers to use ASDK agents on websites directed at children. If you believe a child has given us personal data, contact [TBD: privacy contact email] and we will delete it.

13. Changes to this policy

We may update this policy. Each version is published on this page with its effective date and version number. If we make material changes, we will tell account owners by email and in the dashboard before the changes take effect.

14. Contact

[TBD: legal entity name], [TBD: registered office address]. Privacy questions and requests: [TBD: privacy contact email]. Security issues: security@asdk.com.