Privacy Policy

Last updated: 27 July 2026

This Privacy Policy explains how AskMyWebsite AI (the "Service", "we", "us") collects, uses and protects personal data. The Service is operated by:

Radu Coman, self-employed professional (trabajador autónomo) registered in Spain
Tax ID (NIE): Z0079428Z
Address: Calle Avellano 24, 38206 San Cristóbal de La Laguna, Santa Cruz de Tenerife, Spain
Contact: support@askmywebsiteai.com

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD).

1. Scope and our role

This policy covers three situations:

Visitors of our own websites (askmywebsiteai.com and subdomains) — we are the data controller.
Customers who create an account and install the Service on their websites — we are the data controller for your account and billing data.
End users (visitors of our customers' websites) who interact with the AskMyWebsite AI widget — here the customer is the data controller and we act as a data processor on their behalf, under our Data Processing Agreement. If you asked a question through an AI assistant on someone else's website, please refer to that website's privacy policy first.

2. Data we collect

2.1 Customer account data (we are controller)

Account and business details. Because the Service is sold to businesses, opening an account requires your email address, a password, and your business details: your legal or business name, country, billing address and tax ID (such as a VAT, NIF or CIF number).
Plan and billing data: your subscription plan, prepaid credit balance and usage-based charges, in EUR. Payments are processed by Stripe: card details are entered directly on Stripe's payment pages and never reach our servers — we store only a Stripe customer reference and payment metadata (card brand, last four digits, expiry date), together with your invoice history. The business details above are shared with Stripe to issue your invoices. If you cancel your subscription through the Billing Portal, we also store the cancellation reason you select and any comment you provide.
Configuration content: the websites you register, the content you provide during onboarding (pages of your site, your chat with the setup assistant) and the resulting assistant configuration.
Usage records: per-request metadata such as timestamps, token counts, model used, latency and cost. These records are tied to your account, not to individual persons, and do not include IP addresses.
Security and audit records: for account actions that someone could later dispute — signing in, rotating a key, resetting a password, changing a plan — we record what happened, when, and the IP address and browser user-agent the action came from. This is about your account, not your website's visitors, and it is what lets us tell you whether a login was yours.
Support correspondence: emails you send to support@askmywebsiteai.com.
Marketing consent: if you opt in at sign-up or later in your account settings, we record the date of your consent and may occasionally send you newsletters or offers by email. We record whether that email was delivered, opened or clicked, so we know whether our messages are reaching you — this is an approximate signal, not exact accounting. You can withdraw consent at any time from your account settings or the unsubscribe link in any such email; without consent, we send nothing.

2.2 End-user data (we are processor)

Questions typed into the widget on a customer's website, together with the page URL path and page title where the question was asked, the AI-generated answer, and the time.
When an End User asks a question, the widget also captures the text content visible on the page they are viewing and a list of its interactive elements, and sends it with the question so the assistant can answer about what is on screen and point to elements of the page. Values typed into form fields are never captured.
To answer with the right context, the widget also keeps a short trail of the End User's most recent interactions on that website — up to the last 15 events, each consisting of the page path and, for clicks and form submissions, the visible label of the element or form involved; values typed into form fields are never captured — and sends it with each question. The trail is kept in the browser tab until the tab is closed; the copy sent with a question is stored together with that conversation and deleted with it (see section 7).
We also count how often the assistant was shown and how often it was opened, even if no question is asked. How often it was shown is counted as an anonymous daily total for the website, using no identifier of any kind — it cannot be traced back to a visitor. Whether the assistant was opened is recorded against the per-tab identifier described below, which only exists once you open it. Neither is linked to any profile, neither is combined across websites, and both are reported to the website's owner only as aggregate counts.
When the assistant highlights an element or points the End User to a page, we record how that guidance ended — whether the highlighted element was used, the guidance was dismissed or expired, or the target could not be found — together with the page path and the visible label of the highlighted element. Values typed into form fields are never captured.
A randomly generated identifier for the browser tab the question came from, so that the questions asked during one visit reach the website's owner as a single conversation rather than unrelated messages. It is created in your browser, lasts only until you close the tab, and means nothing outside that website. See the Cookie & Local Storage Notice.
We do not collect end users' names, email addresses or IP addresses through the widget, and we do not set tracking cookies or use advertising identifiers on customers' websites.

2.3 Our marketing website

Our landing pages use Google Analytics 4 to measure aggregate traffic, with your consent.
If you arrive through a link containing a discount code, we store that code in a first-party cookie so that the discount is still applied once you create an account (see the Cookie & Local Storage Notice).
See the Cookie & Local Storage Notice for the full details of both.

2.4 Our demonstration sites

We run the assistant on our own demonstration websites (demo1 and demo2.askmywebsiteai.com) so you can try it before adding it to your own site. On these sites we are the controller, not a processor. Trying the assistant there requires you to be signed in to your account; when you ask a question, we process the same data described in section 2.2 (your question, the page path and title, the assistant's answer, and a per-tab identifier) to generate and show you an answer, and we transmit your question to our AI provider (see section 4). These conversations are kept for the retention period in section 7, and we do not use them to build a profile of you.

We do not knowingly collect special categories of data (health, political opinions, etc.) and the Service is not designed to receive them. Please do not submit such data through the widget or during onboarding.

3. Purposes and legal bases

Purpose	Data	Legal basis (Art. 6 GDPR)
Providing and operating the Service (accounts, login, assistant answers)	Account data, configuration content, end-user questions	Performance of a contract (Art. 6(1)(b)); for end-user data, the customer's instructions under the DPA
Transactional email (email verification, password reset)	Email address	Performance of a contract (Art. 6(1)(b))
Creating and managing your business account and issuing invoices	Business details (legal/company name, billing address, country, tax ID)	Steps taken at your request before entering into a contract, and performance of that contract (Art. 6(1)(b)); compliance with our legal invoicing and tax obligations (Art. 6(1)(c))
Billing and accounting	Plan, credit, usage records	Contract and legal obligation (Art. 6(1)(b), (c))
Running our own demonstration sites (letting signed-in visitors try the assistant)	Demo questions, page path and title, per-tab identifier	Legitimate interest in demonstrating the Service to prospective customers (Art. 6(1)(f))
Measuring how often the assistant is seen, opened and used on a customer's website	Per-tab identifier, counts of assistant impressions and opens	Performance of a contract (Art. 6(1)(b)); for end-user data, the customer's instructions under the DPA
Producing insight reports for the customer (summaries of what visitors asked, where they needed help, and how the assistant guided them)	End-user conversations, interaction trail, guidance outcomes, aggregate per-page statistics	Performance of a contract (Art. 6(1)(b)); for end-user data, the customer's instructions under the DPA
Customer support	Support emails	Contract and legitimate interest (Art. 6(1)(b), (f))
Service security, abuse prevention, quota enforcement	Usage records, audit logs	Legitimate interest (Art. 6(1)(f))
Aggregate analytics on our marketing site	Device/browsing data via GA4	Consent (Art. 6(1)(a))
Applying discount codes at sign-up and to first payments	Discount code, account and billing data	Performance of a contract (Art. 6(1)(b))
Marketing communications (occasional newsletters and offers)	Email address	Consent (Art. 6(1)(a)), given at sign-up or in your account settings, withdrawable at any time

4. AI processing

The Service generates answers using large language models operated by Google (Gemini models). To generate an answer, the following is transmitted to the provider: the end user's question, the page path and title where it was asked, the text visible on that page and a list of its interactive elements, the short trail of the end user's most recent interactions on that website (both as described in section 2.2 — values typed into form fields are never captured), and the customer's assistant configuration (website content and business information the customer provided). During onboarding, extracts of the customer's website are also processed by the provider to build the configuration.

We do not use your content, or your end users' questions, to train AI models. Our agreements with AI providers are commercial API terms under which submitted content is not used for model training.

AI-generated answers are produced automatically, but the Service does not make automated decisions producing legal or similarly significant effects on individuals (Art. 22 GDPR).

5. Recipients and sub-processors

We share personal data only with the service providers needed to run the Service:

Provider	Purpose	Location / transfer safeguard
Clouding.io	Server and database hosting	Spain (Barcelona), EU
Google LLC	AI answer generation (Gemini); aggregate analytics (GA4)	USA — EU-U.S. Data Privacy Framework / SCCs
Resend, Inc.	Transactional email delivery; and, for account holders who opt in, marketing communications, including delivery, open and click engagement signals	USA — EU-U.S. Data Privacy Framework / SCCs
Stripe Payments Europe, Ltd.	Payment processing, subscription billing and invoicing	Ireland, EU — transfers to Stripe, LLC (USA) under the EU-U.S. Data Privacy Framework / SCCs
Zoho Corporation	Support mailbox (support@)	USA — Standard Contractual Clauses

We do not sell personal data and we do not share it with advertisers. We may disclose data where required by law or to protect our legal rights.

6. International transfers

Our servers and database are located in Spain (European Union). Where a provider processes data in the United States (see the table above), the transfer is protected by that provider's certification under the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

7. Retention

Data	Retention
Account and configuration data	While your account is active; deleted within 90 days of account closure
End-user conversations (questions and answers, including the interaction trail and guidance outcomes recorded with them)	90 days, to provide conversation history and analytics to the customer; deleted automatically afterward, or earlier on the customer's written request. AI-generated insight reports derived from them are deleted on the same 90-day schedule
Visit counts for the assistant (per-tab identifier, whether shown or opened)	90 days, then deleted automatically; aggregate totals without any identifier are kept to show trends
Security and audit records (including IP address and user-agent)	24 months, then deleted; records of a closed account are stripped of the IP address, user-agent and details when the account is purged
Email verification and password reset tokens	Short-lived; invalidated on first use or on expiry, whichever comes first
Billing and usage records	As required by Spanish tax and accounting law (generally up to 6 years)
Support emails	Up to 2 years after the ticket is resolved
Encrypted backups	Rotated automatically; deleted data leaves backups within the rotation window

8. Security

We use encryption in transit for all traffic, store passwords, API keys and single-use tokens only as cryptographic hashes, restrict the widget to the origins each customer has registered, and apply access controls on production infrastructure. No system is perfectly secure; if we become aware of a personal data breach affecting you, we will notify you and the competent authority as required by Art. 33–34 GDPR.

9. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time (where processing is based on consent). To exercise these rights, email support@askmywebsiteai.com. We will respond within one month.

If you are an end user of a customer's website, please direct your request to that website's operator (the controller); we will assist them as their processor.

You also have the right to lodge a complaint with a supervisory authority, in particular the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or the authority of your habitual residence.

10. Children

The Service is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.

11. Changes to this policy

We may update this policy from time to time. Material changes will be announced to account holders by email or in the dashboard. The "Last updated" date at the top reflects the latest version.