Privacy Policy

1. Changes and updates to this Policy

We may revise this Policy from time to time to reflect changes to our services, new developments in legislation and the broader data protection landscape, so please check this page to make sure that you are comfortable with any changes. If we make any changes, we will publish the updated Policy at https://askwatch.ai/privacy and change the date at the top of this page.

2. Your data controller and data processors; third parties and disclosure of the data

The first thing you should know is who your data controller and processors are. The data controller is the entity that determines the purposes and means of the processing of the data. The data processor is an entity that processes the data on behalf of the controller.

The data controller of the data described in section 4 of this Policy is ESTERSON LIMITED, registered address: 75 Prodromou Avenue, Oneworld Parkview House, 4th floor, Nicosia 2063, Cyprus ("we", "us", "our").

Where a Client submits content to the Platform that contains personal data of other people (for example, names that appear in prompts, brands or competitors, or data of the Client's authorised users), and where we process such data for the Client, we act as a processor on behalf of that Client. All processing on this basis is carried out lawfully and securely under the AskWatch Data Processing Agreement. If you send us a request relating to such personal data, we will promptly redirect the request to the relevant Client.

Where necessary, we engage third-party service providers and share the data with them. They help us operate, provide, secure, support and improve the Website and the Platform, for the purposes indicated in section 5 of this Policy. When they process the data on our behalf, these providers act as our data processors. We currently use the following providers:

• Supabase: database, authentication and background job queue (United States, AWS us-east-1);
• Vercel: hosting of the Website and the Platform (United States and a global edge network);
• Railway: background processing of scans and scheduled tracking (United States);
• Cloudflare: DNS, content delivery and object storage (United States and a global network);
• Apify: collection of AI engine answers and reading of public website content (company in the Czech Republic; infrastructure in the United States);
• DataForSEO: collection of AI engine answers (company in Estonia);
• OpenAI: AI analysis of website content and answers, and generation of prompts (United States);
• Resend: delivery of transactional email (United States);
• Sentry: error monitoring (United States);
• Google (Google Analytics): measurement of how the Website and the Platform are used (United States);
• Google (Google Workspace): email correspondence (United States);
• Stripe: payments, storage of payment card details, invoicing and tax calculation, when you purchase a paid plan or top up your balance (Stripe Payments Europe, Ireland; data may also be processed in the United States).

Where you connect a Google Search Console account to the Platform, we call Google's Search Console API on your behalf with the access you granted. In that exchange Google is not our processor: it is the provider of your own account and the data in it. We send the authorisation you gave us and the parameters of your question, and Google returns the data your account can read.

AskWatch's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, we do not use it for advertising, and we do not use it to train models.

In addition, when you use the Platform or read our blog, your browser requests website icons (favicons) of the domains shown from Google's favicon service, and videos embedded in blog posts load from youtube-nocookie.com only when you press play. These requests disclose your IP address and browser information to Google, which processes them under its own privacy policy.

We may also use and disclose the data to enforce the Terms, to protect our rights, privacy, safety or property, and/or that of you or others, to respond to requests from courts, law enforcement agencies, regulatory agencies and other public and government authorities, or in other cases provided for by law.

If we transfer personal data originating from the European Economic Area (EEA) to countries that do not provide an adequate level of data protection, we use the Standard Contractual Clauses approved by the European Commission on 4 June 2021 and/or rely on the EU-US Data Privacy Framework where the recipient is certified under it.

3. Note about children

You may not use the Website or the Platform if you are under 18 years of age or under the age of legal majority in your country. We do not knowingly process personal data of persons under 18 years of age.

If a minor submits personal data to us and we learn that the personal data belongs to a person under 18 years of age, we will delete it as soon as possible. If you believe that we may hold personal data of a person under 18 years of age, please contact us at hello@askwatch.ai.

4. Data that we process; data sources

Personal data is any information relating to you that, alone or together with other information, allows the person who collects and processes it to identify you. Processing of the data means any operation performed on your data, including, but not limited to, collecting, storing, transferring and deleting it. We, alone or with the help of the data processors listed in section 2 of this Policy, may process the following personal data:

4.1 Data you provide to us

• account data: your email address, which you use to sign in with a one-time code sent by email (we do not use passwords), and your name if you provide it;
• project data: the website domains, brand, competitors, prompts, language, market or location and AI engines you enter or select, including when you start a first check without an account;
• the email addresses of people to whom you send a report by email from the Platform. We use them once to send that email and do not store them;
• your correspondence with us, including support requests sent to our email address, and any other information you voluntarily provide to us;
• billing data, when you purchase a paid plan or top up your balance: the billing name and address and tax identification number you enter at checkout, which our payment provider Stripe collects together with your payment card details. We receive and keep the billing details, the identifiers of your Stripe customer and subscription, your plan, invoices, payments, refunds and the history of your balance. We do not receive or store full payment card numbers.

4.2 Data generated when you use the Platform

• scan and tracking results: the answers collected from AI search engines (ChatGPT, Perplexity, Google Gemini, Google AI Overviews, Google AI Mode and Microsoft Copilot) for your prompts, once for a first check and then on the schedule you set for your projects, and our analysis of them (visibility, position, sentiment, competitors and cited sources), as well as the reports built from them;
• report share settings, including the public link to a report;
• records of emails we send you: sign-in codes, report-ready notifications, report shares and access requests.

4.3 Data from a connected Google Search Console account

If you connect Google Search Console, whether in the Platform or through our free Search Console MCP server, we process:

• the identifier and email address of the Google account you connect, and the access you granted to it (the webmasters.readonly scope, which is read-only);
• the access and refresh tokens Google issues, which we store encrypted;
• the list of Search Console properties that account can read, with the permission level and the property type;
• the personal link issued to you, stored as a cryptographic hash together with an encrypted copy so that your account can display it again, and the time of the last call made with it;
• the answers Google returns to your questions, cached between 30 minutes and 30 days depending on how old the underlying data is, so that the same question does not spend your Google quota twice;
• a count of calls per tool per day, which is how the limits are applied.

Search Console data describes your website rather than you, but it includes the search queries people typed before reaching it. We use it only to answer your own questions through the tool. It is not shared with other users, sold, used for advertising or used to train models.

4.4 Data we collect automatically

• technical data: IP address, browser type and version, device and operating system information, timestamps, server logs and error reports;
• records we keep to limit abuse (rate limits), which include IP addresses and email addresses;
• cookie identifiers, as described in our Cookie Policy.

4.5 Data about other people

• if you ask for access to a report someone has shared with you, the email address you enter. We forward it to the owner of the report in an email, so the owner can reply to you, and do not store it;
• if someone sends you a report by email from the Platform, your email address, which is used once to send that email and is not stored. The email names the sender and lets you reply to them;
• the answers AI search engines give are public outputs about brands and may incidentally name individuals, for example founders or authors. Such names are processed only as part of the scan results.

4.6 Public report links

A report can be shared through a public link. Anyone who has the link can view the report without signing in: the domain, brand, competitors, prompts and results it contains, and the email address of the report's owner in a partially masked form. Please share the link only with people you want to see the report.

4.7 Data sources

We receive the data described above directly from you, from the Client who invites you or shares a report with you, automatically from your use of the Website and the Platform, and from third parties: the AI search engines whose answers we collect through our data collection provider, and the public content of the websites you ask us to analyse.

5. Purposes and legal bases of data processing

We process the data for the following purposes:

• to make the Website and the Platform available to you, sign you in, run your checks and scans, and provide you with reports;
• to send reports and access requests on your instruction;
• to connect the accounts you choose to connect, such as Google Search Console, and to answer your questions about the data they hold;
• to communicate with you regarding your use of the Website and the Platform and to provide you with support;
• to notify you of any important information or changes within the Website and the Platform that may affect you;
• to monitor errors and to develop and improve the Website and the Platform;
• to keep the Website and the Platform safe and secure, enforce the Terms, and prevent and combat fraud and abuse;
• to send you marketing communications, where you have agreed to receive them;
• to comply with our legal obligations.

We process the data under the following legal bases:

• performance of the contract (the Terms) with you: a) to make the Website and the Platform available to you and sign you in; b) to run your checks and scans and provide you with reports, including sending reports on your instruction; c) to provide you with technical support; d) to communicate with you regarding your use of the Website and the Platform; e) to notify you of any important information or changes within the Website and the Platform that may affect you; f) to process payments for paid plans; g) to operate the free tools you choose to use, including the Search Console MCP server, and to keep a connected Google account working;
• our legitimate interests: a) to monitor errors and to develop and improve the Website and the Platform; b) to keep the Website and the Platform safe and secure, enforce the Terms, limit abuse and prevent and combat fraud; c) to forward access requests to the owner of a shared report and to deliver reports to the recipients a user chooses; d) to process names of individuals that incidentally appear in AI answers as part of the scan results; e) to establish, exercise or defend legal claims;
• compliance with a legal obligation: to keep accounting and tax records and to respond to lawful requests from public authorities;
• your consent: to send you marketing email where the law requires consent.

Where we rely on your consent, you may withdraw it at any time free of charge by clicking the unsubscribe link in any marketing email or by writing to us at hello@askwatch.ai. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

6. Duration and location of processing

We retain personal data for a period of time consistent with the purposes for which it was collected. We will retain your data:

• for as long as we have an ongoing relationship with you and as needed to provide you with the services;
• as necessary to comply with our legal obligations;
• as necessary to resolve disputes or to protect ourselves from potential future disputes; or
• as necessary to enforce our agreements.

When a paid subscription ends, the tracking history collected under it (the AI answers, the brands and sources found in them, and the daily metrics built from them) is kept for 60 days and then deleted; your account, projects and prompts remain until you delete them. Billing records, such as invoices and payments, are kept for as long as accounting and tax law requires.

A connected Google Search Console account is kept until you disconnect it or Google withdraws the access. Disconnecting hands the access back to Google and deletes it here, together with the property list and the cached answers; the personal link is kept, so that reconnecting later does not mean reconfiguring every client you pasted it into. Cached answers expire on their own within 30 days at the latest.

Retention periods are determined considering the amount, nature and sensitivity of the data and the purposes for which it was collected. After the retention period ends, we delete the personal data. Where we are unable to do so, we ensure that appropriate measures are put in place to prevent any further use of it.

You may ask us to stop processing your data by sending us a data erasure request or an objection to processing. Please note that such a request may prevent us from providing you with the services and, if we delete your data, you will lose access to the Platform.

Our servers and most of our service providers are located in the United States, so your data will generally be processed and hosted outside the EEA, subject to the safeguards described in section 2 of this Policy.

7. Your data subject rights

As a data subject, you have the following rights. To exercise any of them, please contact us at hello@askwatch.ai:

• a right of access to your data: you can ask us whether and what personal data of yours we process, and for clarifications on the information described in this Policy, such as the purposes of processing, the retention period and the third parties that have access to the data;
• a right to rectification: you can ask us to correct inaccurate personal data concerning you and to complete incomplete personal data;
• a right to erasure: you can ask us to erase your data if its processing is no longer necessary for the purposes for which it was collected, or if there is no legal ground for the processing. We will erase it unless the law requires us to keep it;
• a right to restriction of processing: for example, if you contest the accuracy of your data, or if we no longer need your data but you need it to establish, exercise or defend a legal claim, the data will be restricted rather than erased;
• a right to object to processing based on our legitimate interests, and to object at any time to processing for direct marketing;
• a right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• a right to data portability; and
• a right to lodge a complaint with a supervisory authority.

We will provide information on the action taken on your request within one month of its receipt. That period may be extended by two further months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay. To protect your data, we may take reasonable steps to verify your identity before acting on a request.

Our lead supervisory authority is the Commissioner for Personal Data Protection of the Republic of Cyprus. You may also lodge a complaint with the supervisory authority of the EU or EEA member state where you live, where you work or where the alleged infringement took place.

We provide notice to data subjects in the EEA as required by Articles 13 and 14 of the General Data Protection Regulation (GDPR) and honour the rights of data subjects provided in Articles 12 to 23 of the GDPR, including the right to be forgotten.

8. Protection of data

We take technical and organisational measures to ensure the data is processed in a manner that ensures its appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage. For example, we only use the service providers specified in section 2 of this Policy, with which the relevant data processing terms are in place.

9. We do not sell personal data

We do not sell, rent or otherwise make available your personal data to other companies for monetary or other valuable consideration, and we do not share it for cross-context behavioural advertising.

10. Contact us

We will be glad to hear from you. If you have any questions regarding this Policy or your personal data, please contact us at hello@askwatch.ai.