Privacy Policy

1. Changes and updates to this Policy

We may revise this Policy from time to time to reflect changes to our services, new developments in legislation and the broader data protection landscape, so please check this page to make sure that you are comfortable with any changes. If we make any changes, we will publish the updated Policy at https://askwatch.ai/privacy and change the date at the top of this page.

2. Your data controller and data processors; third parties and disclosure of the data

The first thing you should know is who your data controller and processors are. The data controller is the entity that determines the purposes and means of the processing of the data. The data processor is an entity that processes the data on behalf of the controller.

The data controller of the data described in section 4 of this Policy is ESTERSON LIMITED, registered address: 75 Prodromou Avenue, Oneworld Parkview House, 4th floor, Nicosia 2063, Cyprus ("we", "us", "our").

Where a Client submits content to the Platform that contains personal data of other people (for example, names that appear in prompts, brands or competitors, or data of the Client's authorised users), and where we process such data for the Client, we act as a processor on behalf of that Client. All processing on this basis is carried out lawfully and securely under the AskWatch Data Processing Agreement. If you send us a request relating to such personal data, we will promptly redirect the request to the relevant Client.

Where necessary, we engage third-party service providers and share the data with them. They help us operate, provide, secure, support and improve the Website and the Platform, for the purposes indicated in section 5 of this Policy. When they process the data on our behalf, these providers act as our data processors. We currently use the following providers:

• Supabase: database, authentication and background job queue (United States, AWS us-east-1);
• Vercel: hosting of the Website and the Platform (United States and a global edge network);
• Railway: background processing of scans (United States);
• Cloudflare: DNS, content delivery and object storage (United States and a global network);
• Apify: collection of AI engine answers and reading of public website content (company in the Czech Republic; infrastructure in the United States);
• OpenAI: AI analysis of website content and answers, and generation of prompts (United States);
• Resend: delivery of transactional email (United States);
• Sentry: error monitoring (United States);
• Google (Google Analytics): measurement of how the Website and the Platform are used (United States);
• Google (Google Workspace): email correspondence (United States);
• our third-party payment provider: payments, invoicing and tax, when you purchase a paid plan.

In addition, when you use the Platform or read our blog, your browser requests website icons (favicons) of the domains shown from Google's favicon service, and videos embedded in blog posts load from youtube-nocookie.com only when you press play. These requests disclose your IP address and browser information to Google, which processes them under its own privacy policy.

We may also use and disclose the data to enforce the Terms, to protect our rights, privacy, safety or property, and/or that of you or others, to respond to requests from courts, law enforcement agencies, regulatory agencies and other public and government authorities, or in other cases provided for by law.

If we transfer personal data originating from the European Economic Area (EEA) to countries that do not provide an adequate level of data protection, we use the Standard Contractual Clauses approved by the European Commission on 4 June 2021 and/or rely on the EU-US Data Privacy Framework where the recipient is certified under it.

3. Note about children

You may not use the Website or the Platform if you are under 18 years of age or under the age of legal majority in your country. We do not knowingly process personal data of persons under 18 years of age.

If a minor submits personal data to us and we learn that the personal data belongs to a person under 18 years of age, we will delete it as soon as possible. If you believe that we may hold personal data of a person under 18 years of age, please contact us at hello@askwatch.ai.

4. Data that we process; data sources

Personal data is any information relating to you that, alone or together with other information, allows the person who collects and processes it to identify you. Processing of the data means any operation performed on your data, including, but not limited to, collecting, storing, transferring and deleting it. We, alone or with the help of the data processors listed in section 2 of this Policy, may process the following personal data:

4.1 Data you provide to us

• account data: your email address, which you use to sign in with a one-time code sent by email (we do not use passwords), and your name if you provide it;
• project data: the website domains, brand, competitors, prompts, language, market or location and AI engines you enter or select, including when you start a first check without an account;
• the email addresses of people to whom you send a report by email from the Platform. We use them once to send that email and do not store them;
• your correspondence with us, including support requests sent to our email address, and any other information you voluntarily provide to us;
• billing data, when you purchase a paid plan, which is processed by our payment provider.

4.2 Data generated when you use the Platform

• scan results: the answers collected from AI search engines (ChatGPT, Perplexity, Google Gemini, Google AI Overviews, Google AI Mode and Microsoft Copilot) for your prompts, and our analysis of them (visibility, position, sentiment, competitors and cited sources), as well as the reports built from them;
• report share settings, including the public link to a report;
• records of emails we send you: sign-in codes, report-ready notifications, report shares and access requests.

4.3 Data we collect automatically

• technical data: IP address, browser type and version, device and operating system information, timestamps, server logs and error reports;
• records we keep to limit abuse (rate limits), which include IP addresses and email addresses;
• cookie identifiers, as described in our Cookie Policy.

4.4 Data about other people

• if you ask for access to a report someone has shared with you, the email address you enter. We forward it to the owner of the report in an email, so the owner can reply to you, and do not store it;
• if someone sends you a report by email from the Platform, your email address, which is used once to send that email and is not stored. The email names the sender and lets you reply to them;
• the answers AI search engines give are public outputs about brands and may incidentally name individuals, for example founders or authors. Such names are processed only as part of the scan results.

4.5 Public report links

A report can be shared through a public link. Anyone who has the link can view the report without signing in: the domain, brand, competitors, prompts and results it contains, and the email address of the report's owner in a partially masked form. Please share the link only with people you want to see the report.

4.6 Data sources

We receive the data described above directly from you, from the Client who invites you or shares a report with you, automatically from your use of the Website and the Platform, and from third parties: the AI search engines whose answers we collect through our data collection provider, and the public content of the websites you ask us to analyse.

5. Purposes and legal bases of data processing

We process the data for the following purposes:

• to make the Website and the Platform available to you, sign you in, run your checks and scans, and provide you with reports;
• to send reports and access requests on your instruction;
• to communicate with you regarding your use of the Website and the Platform and to provide you with support;
• to notify you of any important information or changes within the Website and the Platform that may affect you;
• to monitor errors and to develop and improve the Website and the Platform;
• to keep the Website and the Platform safe and secure, enforce the Terms, and prevent and combat fraud and abuse;
• to send you marketing communications, where you have agreed to receive them;
• to comply with our legal obligations.

We process the data under the following legal bases:

• performance of the contract (the Terms) with you: a) to make the Website and the Platform available to you and sign you in; b) to run your checks and scans and provide you with reports, including sending reports on your instruction; c) to provide you with technical support; d) to communicate with you regarding your use of the Website and the Platform; e) to notify you of any important information or changes within the Website and the Platform that may affect you; f) to process payments for paid plans;
• our legitimate interests: a) to monitor errors and to develop and improve the Website and the Platform; b) to keep the Website and the Platform safe and secure, enforce the Terms, limit abuse and prevent and combat fraud; c) to forward access requests to the owner of a shared report and to deliver reports to the recipients a user chooses; d) to process names of individuals that incidentally appear in AI answers as part of the scan results; e) to establish, exercise or defend legal claims;
• compliance with a legal obligation: to keep accounting and tax records and to respond to lawful requests from public authorities;
• your consent: to send you marketing email where the law requires consent.

Where we rely on your consent, you may withdraw it at any time free of charge by clicking the unsubscribe link in any marketing email or by writing to us at hello@askwatch.ai. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

6. Duration and location of processing

We retain personal data for a period of time consistent with the purposes for which it was collected. We will retain your data:

• for as long as we have an ongoing relationship with you and as needed to provide you with the services;
• as necessary to comply with our legal obligations;
• as necessary to resolve disputes or to protect ourselves from potential future disputes; or
• as necessary to enforce our agreements.

Retention periods are determined considering the amount, nature and sensitivity of the data and the purposes for which it was collected. After the retention period ends, we delete the personal data. Where we are unable to do so, we ensure that appropriate measures are put in place to prevent any further use of it.

You may ask us to stop processing your data by sending us a data erasure request or an objection to processing. Please note that such a request may prevent us from providing you with the services and, if we delete your data, you will lose access to the Platform.

Our servers and most of our service providers are located in the United States, so your data will generally be processed and hosted outside the EEA, subject to the safeguards described in section 2 of this Policy.

7. Your data subject rights

As a data subject, you have the following rights. To exercise any of them, please contact us at hello@askwatch.ai:

• a right of access to your data: you can ask us whether and what personal data of yours we process, and for clarifications on the information described in this Policy, such as the purposes of processing, the retention period and the third parties that have access to the data;
• a right to rectification: you can ask us to correct inaccurate personal data concerning you and to complete incomplete personal data;
• a right to erasure: you can ask us to erase your data if its processing is no longer necessary for the purposes for which it was collected, or if there is no legal ground for the processing. We will erase it unless the law requires us to keep it;
• a right to restriction of processing: for example, if you contest the accuracy of your data, or if we no longer need your data but you need it to establish, exercise or defend a legal claim, the data will be restricted rather than erased;
• a right to object to processing based on our legitimate interests, and to object at any time to processing for direct marketing;
• a right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• a right to data portability; and
• a right to lodge a complaint with a supervisory authority.

We will provide information on the action taken on your request within one month of its receipt. That period may be extended by two further months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay. To protect your data, we may take reasonable steps to verify your identity before acting on a request.

Our lead supervisory authority is the Commissioner for Personal Data Protection of the Republic of Cyprus. You may also lodge a complaint with the supervisory authority of the EU or EEA member state where you live, where you work or where the alleged infringement took place.

We provide notice to data subjects in the EEA as required by Articles 13 and 14 of the General Data Protection Regulation (GDPR) and honour the rights of data subjects provided in Articles 12 to 23 of the GDPR, including the right to be forgotten.

8. Protection of data

We take technical and organisational measures to ensure the data is processed in a manner that ensures its appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage. For example, we only use the service providers specified in section 2 of this Policy, with which the relevant data processing terms are in place.

9. We do not sell personal data

We do not sell, rent or otherwise make available your personal data to other companies for monetary or other valuable consideration, and we do not share it for cross-context behavioural advertising.

10. Contact us

We will be glad to hear from you. If you have any questions regarding this Policy or your personal data, please contact us at hello@askwatch.ai.