Privacy Policy

Who we are

Askvo provides AI chatbots that website owners train on their own content and embed on their sites. Askvo is operated from France and processes personal data in accordance with the EU General Data Protection Regulation (GDPR). This policy covers both our customers (site owners with a Askvo account) and visitors who chat with a Askvo-powered widget on a customer's website.

Controller or processor?

For customer account data (your email, name, billing and usage records), we are the data controller. For visitor data — conversations with an embedded chatbot and any lead details a visitor submits — the website owner who deployed the bot is the controller, and we act as their processor: we store and process that data only on their behalf and on their instructions. Site owners are responsible for informing their visitors about the chatbot's data processing and for having a legal basis for it. A data processing addendum (Art. 28 GDPR) is available to customers on request.

What we collect

• Account data: your email address, name and password (stored as a salted hash — we never store plain-text passwords).
• Training content: the website pages, files, text and Q&A pairs you provide to train your chatbot.
• Conversations: messages exchanged between visitors and chatbots, processed on behalf of the site owner.
• Leads: if a site owner enables lead capture, the name, email and phone number a visitor chooses to submit.
• Usage data: message and token counts per chatbot, used for plan limits, abuse prevention and analytics.
• Billing data: subscription status and invoices via Stripe. We never see or store your card details.

How and why we use it

We process account data to provide the service you signed up for (performance of a contract), to bill you and keep required accounting records (legal obligation), and to secure and improve the service, enforce plan limits and prevent abuse (legitimate interest). Your training content is used solely to generate answers for your own chatbot — it is never used to train shared AI models, sold, or shared with other customers. Conversations are stored so site owners can review them, take over live chats, and see analytics such as unanswered questions. We do not sell personal data and we do not use it for advertising.

Service providers and transfers

We rely on a small set of processors to run the service:

• OpenAI — generates chatbot answers from your content and visitor questions.
• Stripe — payment processing.
• Resend — transactional email (verification, notifications, alerts).
• Hetzner — hosting; application data is stored on servers in the European Union (Germany).

Where a provider processes data outside the EU (for example OpenAI, Stripe or Resend in the United States), transfers rely on recognized safeguards such as the EU–US Data Privacy Framework or Standard Contractual Clauses. We may update this list of providers as the service evolves; this page always reflects the current one.

Data retention

Resolved conversations are automatically deleted 12 months after they close. Operational usage telemetry (daily token counts) is kept for 90 days. Account data and training content are kept while your account is active and deleted when you delete your account; billing records are retained for as long as French tax and accounting law requires.

Security

Data is encrypted in transit, passwords are stored as salted hashes, access to production systems is restricted, and backups are taken regularly. No system is perfectly secure, but we design for least privilege and defense in depth.

Your rights

Under the GDPR you can ask for access, rectification, erasure, portability, restriction of processing, or object to processing based on legitimate interest. From your account settings you can already, at any time and without contacting us: export a complete copy of your data (profile, chatbots, content sources, conversations and leads) as JSON, or permanently delete your account and everything attached to it. For anything else, email us at the address below. You also have the right to lodge a complaint with a supervisory authority — in France, the CNIL (cnil.fr).

If you are a visitor who chatted with a bot on someone else's website, contact that website's owner — they are the controller of your conversation, and we process it on their behalf. We'll assist them in responding to your request as their processor.

Cookies and local storage

The dashboard stores an authentication token in your browser's local storage so you stay logged in. The embedded widget stores a random visitor identifier so a returning visitor keeps their conversation history. Both are strictly necessary for the service to work; we do not use advertising trackers, so no cookie consent banner is required.

Changes and contact

We'll update this page when our practices change, and note the date above. Questions or privacy requests? Email support@askvo.io.