Privacy policy

1. Who is responsible

You can reach us, also about data protection, through our contact form.

2. Our two roles

• We decide (controller) for this website, and for the contact and billing details of the companies that are our customers. Sections 3 to 5 cover this.
• Your company decides (we are its processor) for everything in its ASK workspace: the people, documents, messages and chats. We process it only on your company's behalf and instructions, under our data processing agreement. Your company tells you how it uses ASK in its own privacy notice, which you see when you first sign in. Section 6 describes what we do as its processor.

3. When you visit this website

Every request to our servers carries technical data: your network address, the page you asked for, the time and your browser's identification. We use it only to deliver the pages and to keep the service secure, and keep it no longer than that needs.

The website loads nothing from other companies: no analytics, no advertising, no tracking pixels, no external fonts or scripts. It sets no cookies of its own, so there is no cookie banner.

Looking up your company's sign-in

When you enter your work e-mail, we use the part after the @ to find your company's workspace and send you to its sign-in. We don't keep the address. Every address that doesn't lead to a sign-in gets the same answer, so the form doesn't reveal why. For a company that has set up sign-in for its e-mail domain, or whose short name you enter, the look-up shows the company's name and its sign-in options.

To stop misuse, we count look-ups for one minute per network address and per e-mail address, in a scrambled form. If someone reaches the limit, our security log records that it happened, with the scrambled network address only.

Your browser remembers the company short name you last used, so it can fill it in next time. It stays in your browser (not in a cookie) and you can clear it in your browser's settings.

Writing to us

The contact form sends us the e-mail address, subject and message you enter. We use them only to reply to you. Your message reaches our team by e-mail, and we never send anything to the address you typed except our reply.

To stop misuse, the form has a field that only automated programs fill in, and we count messages per hour per network address and per sender. With your message we keep your network address only in a scrambled, keyed form that can't be turned back into the address without our server key, so we can recognise repeated misuse. It is deleted together with the request. We delete contact requests 12 months after they arrive, or earlier if you ask us to.

4. When your company is our customer

• Contacts. The names and work e-mail addresses of the people who order ASK and run your workspace, so we can set it up, support you and send you notices about the service: for example payment reminders, price changes, changes to these documents and new sub-processors.
• Billing. Your company's name, address, country, VAT number and invoices. You pay by card through our payment provider, which handles the card details; we never see or store them. We keep invoices and billing records for as long as accounting law requires (in Switzerland, 10 years).
• Usage for billing. To charge correctly and to show you your usage, we count what each company uses: users, questions, AI use and storage. Where your administrators set spending limits per person or per Buddy, we count those too, for the company only. We see usage per company, and per person only in pseudonymised form.

5. Legal basis

Where the EU or UK General Data Protection Regulation applies: our contract with your company, and the steps you asked for before one (Art. 6(1)(b)); our legal duties, for example to keep accounting records (Art. 6(1)(c)); and our legitimate interest in delivering, protecting and improving the service and in answering you (Art. 6(1)(f)). In Switzerland, the Federal Act on Data Protection applies.

6. In the workspaces we run for companies

As your company's processor, we:

• process the workspace's data only to provide ASK as your company instructs, and never for our own purposes;
• never use it to train AI models, and use the AI we provide only under terms that don't allow training on it either;
• keep each company's data separate from every other company's, and show each person only what they may already see in the tools their company connected;
• don't look at your documents or chats: our staff see settings, usage and costs per company, not content;
• store the database and uploaded files in Switzerland, and run the application servers, including the search index, in the European Union;
• use outside companies only as listed on our sub-processors page, and tell your administrators by e-mail when we add one;
• delete data on the schedule your company sets: for example, chats are deleted after 90 days unless your company chooses another period, and you can delete your own chats at any time;
• when your company leaves, make an export available to its administrators, then delete the workspace for good 30 days later, including its encryption keys; backups expire within a further 35 days.

If you use ASK at work and want to see, correct or delete your data, ask your company. It decides, and we help it. You can also download your own data from your settings in ASK.

7. Cookies

This website sets no cookies. When you sign in to a workspace, ASK sets only the cookies that sign-in needs: a short-lived one that protects the sign-in from forgery, then your session in your company's workspace. There are no advertising or analytics cookies.

8. Who else gets the data

No one for their own purposes. The companies that run our servers, deliver our e-mail and process payments do so for us under data processing agreements, and are listed on our sub-processors page. We don't sell personal data and don't use it for advertising. We disclose data to authorities only where the law requires it.

Where data goes to a country outside Switzerland, the EU and the UK without an adequate level of protection, we use the safeguards the law provides, such as the standard contractual clauses.

9. Security

We protect data with technical and organisational measures to the current state of the art: each company's data kept separate, encrypted connections and encrypted connection secrets, access rights checked on every request, a security log of administrative actions, and no data sent to analytics or tracking services.

10. Your rights

For the data we decide about (sections 3 and 4), you can ask us at any time to:

• tell you what data we hold about you, and give you a copy;
• correct it or delete it;
• restrict how we use it, or object to its use.

Write to us through the contact form. You can also complain to a data protection authority: in Switzerland the Federal Data Protection and Information Commissioner, in the EU the authority of your country, in the UK the Information Commissioner's Office.

11. Changes to this policy

We update this policy when what we do changes. The date below shows the latest version, and we tell our customers' administrators about important changes. Our terms of use describe the service itself.