Effective date: [COMPLETE: date/version].
Operator and scope
[COMPLETE: legal operator and address], trading as AskEngineAI, is responsible for the processing described in this notice. Privacy contact: [COMPLETE: monitored email]. [COMPLETE: representative or data protection officer details only if required or appointed.]
This notice covers our website, account administration, billing, support and operation of the service. When we process customer personal data solely on a business customer’s instructions, the customer determines the purposes and we act as its processor under the applicable DPA. Individuals whose data is managed by a customer should ordinarily contact that customer; we assist as required.
Information and sources
Depending on the features you use, we receive:
- Account and organization information, such as names, email addresses, memberships, authentication identifiers and subscription status, from you, your organization or an authorized sign-in provider.
- Billing and transaction information from you and the payment processor. [VERIFY: exact fields retained and confirm that full payment-card details are not stored in application systems or logs.]
- Brand details, domains, prompts, keywords, competitor information, website content, scan answers, citations, audits, recommendations, drafts and publication records supplied by you or generated for your requests.
- Authorized integration credentials, selected property/store identifiers, Search Console reports, Analytics reports and SEO provider results, where those features are enabled.
- Support correspondence and technical information needed to operate and secure the service. [VERIFY: actual log fields, IP handling, diagnostics and analytics enabled in production.]
Public website content and AI responses may contain personal data. We do not assume that information is non-personal merely because it came from a public website or AI model.
Purposes and legal grounds
Where UK/EU data protection law applies, the proposed mapping is:
| Purpose | Applicable basis, subject to actual circumstances |
|---|---|
| Deliver an individual's contracted service and manage their subscription | Performance of that contract |
| Administer a business customer's account and communicate with its representatives | Legitimate interests in providing and administering the business service |
| Prevent abuse, investigate faults and secure the service | Legitimate interests in security and reliable operation; legal obligation where applicable |
| Keep required accounting records and respond to legal requirements | Legal obligation |
| Optional tracking and marketing requiring consent | Consent, obtained separately and withdrawable |
| Process customer-controlled personal data | Customer instructions and DPA; the customer determines its lawful basis |
[VERIFY: document legitimate-interest assessments, actual marketing practices and any additional purposes before publication.] Required account and payment information is needed to provide the relevant service; without it we may be unable to create an account or fulfill an order.
Google and other integrations
Google sign-in, Search Console and Google Analytics are separate permissions and features. Sign-in is not permission to read analytics. We use authorized Google data to provide the connected reporting features and related support, as disclosed when you connect. The Analytics connector reads existing reports; it does not install a tracking tag on your site.
Disconnecting stops use of the removed connection within AskEngineAI. Previously saved reports can remain until deleted under our retention process. You can also revoke access through the provider. [VERIFY: disconnection, provider revocation and report deletion for each connector before publication.]
[VERIFY BEFORE ADOPTION: AskEngineAI's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements where applicable. Review every Google-data flow, including AI processing, support access and downstream providers, before making this commitment.]
When you request content generation or an AI scan, relevant prompts and content are sent to the provider used for that feature. [COMPLETE: provider-specific retention and model-training settings; do not claim all providers have zero retention or never train on data without confirmation.]
Recipients and transfers
We disclose relevant data to service providers supporting hosting, authentication, database services, AI processing, payments, email and any enabled diagnostics; to integrations you authorize; to authorized users according to workspace permissions; and where legally required. [VERIFY: sharing behavior of public reports and workspace roles.]
The provider register below must be completed with actual contracting entities, roles and locations. Some providers may act as independent controllers for specific activities. [COMPLETE: actual sale, sharing, targeted advertising and profiling practices and any applicable regional opt-out disclosures.]
Data may be processed outside your country. [COMPLETE: actual processing locations and applicable transfer mechanisms, such as adequacy decisions or appropriate contractual safeguards, and how to obtain relevant information.] We do not claim Data Privacy Framework certification.
Retention and security
We retain data according to its purpose, the customer agreement and applicable law. [COMPLETE: specific periods or meaningful criteria for accounts, reports, drafts, credentials, support, logs, billing records and backups. Confirm working deletion procedures.] Disconnecting, cancelling billing and deleting an account are different actions.
We apply appropriate technical and organizational safeguards. [VERIFY: deployed access controls, credential protection, backup/restore arrangements, access review and incident procedures before describing them publicly.] No security certification or service-level guarantee is claimed here.
Your choices and rights
Depending on applicable law, you may request access, correction, deletion or portability, restrict or object to certain processing, and withdraw consent without affecting earlier lawful processing. You may complain to the relevant supervisory authority; for the UK this is the Information Commissioner's Office. Contact [COMPLETE: monitored privacy channel]. We may proportionately verify identity and will handle requests within the applicable legal time limits. [COMPLETE: applicable regional rights, appeal procedures, authorized-agent arrangements and contact details after jurisdiction review.]
The Cookie Policy explains device storage. Marketing choices must be separate from essential service communications. [VERIFY: functioning unsubscribe and consent withdrawal controls.]
The service is intended for business users. [COMPLETE: consistent age eligibility and procedure for inadvertently received children's data.] Material privacy changes will be communicated through [COMPLETE: operating notification channel]. New consent will be sought where required.