AskBok

Privacy Notice

Last updated 11 November 2026

This notice explains how AskBok, [registered address — set LEGAL_ADDRESS] ("AskBok", "we") handles personal data. Privacy contact: support@askbok.com.

1. Two roles

  • Business owners and their teams (our customers): we are the controller of your account and billing data.
  • People who chat with or book a business through the AskBok widget: that business is the controller, and we process the data on its behalf as a processor. Please contact the business first about your data; we help them answer access and deletion requests, and you can also contact us.

2. What we collect, why, and our legal basis

  • Account data — name, email, password (stored hashed), business details. Purpose: to provide your account. Basis: contract.
  • Billing data — plan, subscription status, invoices. Card details are handled by Paddle, not by us. Purpose: subscriptions and accounting. Basis: contract and legal obligation.
  • Business content — services, prices, staff, schedules, connected calendar busy times. Purpose: to run the receptionist. Basis: contract.
  • Chat and booking data (processed for the business) — messages, name, email, phone, booking details and answers, a privacy consent time stamp, the website the chat came from, and a one-way hash of the IP address used for abuse protection. Purpose: answering enquiries and managing bookings for the business. Basis: the business's contract with the customer, or its legitimate interest in replying to enquiries.
  • Technical data — security and error logs. Purpose: keeping the Service secure and working. Basis: legitimate interest.

3. Who we share data with

We never sell personal data. We share it only with:

  • Paddle.com — our reseller and Merchant of Record, which processes payments, taxes and refunds.
  • Service providers who process data for us under contract: Supabase (database and login), Vercel (hosting), OpenAI (AI replies to chat messages), Resend (sending emails), Google (only if a business connects Google Calendar) and Sentry (error reports, if enabled).
  • Professional advisers (such as accountants and lawyers) where needed.
  • Authorities, where the law requires it.

Some providers are outside your country (for example in the USA or EU). Where data protection law requires it, transfers are covered by adequacy decisions or standard contractual clauses.

4. How long we keep data

  • Account and business data: while your account is active, deleted within 30 days of closure.
  • Website chats: as long as the business chooses (it can set chats to be deleted automatically after 1–24 months), and they are deleted when the business account closes.
  • Billing records: as long as tax law requires (usually up to 10 years).
  • Security logs: up to 90 days.

5. Your rights

Depending on where you live, you can ask to access, correct, delete, restrict or object to the use of your data, to receive it in a portable format, and to withdraw consent at any time. You can complain to your data protection authority. We reply within one month. Businesses can download or erase a customer's data directly from their dashboard.

6. Security

Data is encrypted in transit (HTTPS) and at rest. Each business's data is separated at the database level, calendar access tokens are encrypted, access is limited to people who need it, and we test our security regularly.

7. Cookies

We use only essential cookies: to keep you logged in and to remember which business you are working in. The chat widget remembers the visitor's current conversation in their browser's local storage. We don't use advertising or tracking cookies.

8. Changes

We will post updates here and tell account holders about important changes. See also our terms.