Privacy Policy

This Privacy Policy explains what information Ask & Chart collects, why, how we protect it, the legal bases we rely on, the cookies we use, and the rights you have. It applies to the people who hold an account and to visitors of this website. It works together with our Terms of Service and our Legal page, which describes how we process the business data you pour into your workspace.

1. Who we are

Ask & Chart is operated by Athanix OÜ ("Ask & Chart", "we", "us"), which is the controller of the account data described in this Policy. Our registered details are in the Legal Notice. For privacy questions or to exercise any of the rights in section 8, email privacy@askandchart.com; that is the fastest route and we answer it ourselves.

2. The two roles, and who controls what

For the account data we hold about you (your email, billing details, and how you use the Service), Ask & Chart is the controller, and this Policy governs that processing.

For the business data you pour into your workspace (spreadsheets, exports, connected databases), you are the controller and Ask & Chart is the processor acting on your instructions. That data may contain personal data, for example payroll rows or assignee records in the mobility pack. That processing is governed by the data processing commitments on our Legal page, not by this Policy. If you are a data subject in someone else's poured-in data, contact the organization that processes it; we will refer your request to them.

3. Information we collect

Account information: your email address and the name you provide when you sign in, and your billing details when you subscribe to a paid plan (payment card data is collected by Stripe, not stored by us).

Content you create: the files you pour in, the sources you connect, the joins you confirm, and the queries and dashboards you build.

Usage data: events such as page views and feature use, and basic technical data such as device type and approximate region (derived from IP), used to operate, secure and improve the Service.

Support and communications: messages you send us and our replies.

4. How we use information, and our legal bases

Where the GDPR applies we rely on the following legal bases for account data:

To provide the Service, authenticate you, and operate your account: performance of our contract with you (Art. 6(1)(b)).

To process payments and manage subscriptions: performance of our contract, and compliance with tax and accounting obligations (Art. 6(1)(b) and (c)).

To secure the Service, prevent fraud and abuse, debug, and improve the product: our legitimate interests in running a safe and reliable service (Art. 6(1)(f)), balanced against your rights.

To send service and security communications: performance of our contract and our legitimate interests. Where we send optional marketing, we rely on your consent or our legitimate interest as permitted, and you can opt out at any time.

To comply with the law and respond to lawful requests: compliance with a legal obligation (Art. 6(1)(c)).

5. How information is shared

We share information with a limited set of vetted subprocessors who process it on our behalf under contracts that restrict their use to providing their service: Vercel for application hosting, Neon for our database, Cloudflare for object storage, Stripe for payments, Brevo for email delivery, Anthropic for the AI that proposes queries and connections, Hetzner for the durable processing infrastructure, and Sentry for error monitoring. The complete list, with each provider's role, processing location, and transfer safeguard, is on our Legal page.

We do not sell personal information, and we do not use the data in a workspace to train third-party models.

We may disclose information where required by law, to respond to lawful requests, or to protect the rights, property, or safety of Ask & Chart, our users, or the public. If we are ever involved in a merger, acquisition, or asset sale, we will require the recipient to honor this Policy and will notify you of any change in control of your data.

6. Where we process your data, and international transfers

Ask & Chart hosts your workspace data in the European Union by default: the application runs on Vercel in the EU and the database is Neon in the EU. When you configure an AI endpoint for your workspace, raw rows never reach a model endpoint outside the configured region.

Some processing necessarily happens in the United States, in particular Stripe for payments and, depending on the region configured for your workspace, Anthropic for AI proposals. Every provider processes data on our behalf under a written contract that restricts its use to providing its service, and we do not sell personal information.

7. How long we keep information

We keep account information for as long as your account is active, and after closure for the period needed to meet legal, tax, and accounting obligations and to resolve disputes, after which we delete or anonymize it.

For the data you pour in, you decide retention: you can delete sources, datasets and dashboards from your workspace at any time, and on termination you have a reasonable period to export before deletion. Deleted data is removed from active systems within a reasonable time and from backups in the ordinary course of backup rotation. We keep security and audit logs for a limited period to operate and protect the Service.

8. Your rights

Where the GDPR or similar laws apply, you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to certain processing, to data portability, and, where we rely on consent, to withdraw that consent at any time without affecting prior processing.

You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon); you may also contact the authority in your country of residence.

To exercise any of these rights over the data Ask & Chart controls, email privacy@askandchart.com. We will respond within the time the law allows.

9. Children

The Service is not directed to children. You must be at least 16, or the age of digital consent in your jurisdiction, to hold an account.

10. Automated decisions

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Inside the product, the AI only proposes: joins and figures require human confirmation and every figure is computed deterministically with provenance attached.

11. Cookies and similar technologies

We use a small set of cookies to keep the Service working, and we run no advertising and no cross-site tracking. Strictly necessary cookies keep you signed in and secure your account; functional cookies remember choices you make, such as your interface language. We do not set advertising cookies, retargeting pixels, or third-party cross-site trackers.

The cookies we use:

You can manage or delete cookies in your browser settings. Blocking the strictly necessary session cookie will prevent you from signing in and using the Service.

12. Changes to this Policy

We may update this Policy as the Service evolves. We will announce material changes through the Service or by email and update the date above. Continued use after changes take effect means you accept the updated Policy.

13. Contact

Privacy questions and rights requests: privacy@askandchart.com. Security issues: security@askandchart.com. General help: support@askandchart.com. Our postal address and registered details are in the Legal Notice.