Privacy Policy
Last updated October 12, 2026
This policy explains how Asklet ("we", "us") handles personal data in connection with Asklet. It covers two groups of people: customers who sign up and use the Asklet dashboard, and readers who answer a survey in the Asklet widget on a customer's website.
1. Who is responsible
- For customer accounts, billing and our own website, Asklet is the controller.
- For feedback collected through the widget, the website owner who embedded it is the controller and Asklet is their processor. If you answered a survey on someone else's website, please contact that website owner first about your data; we will help them respond.
2. Data we collect about customers
- Account data: your name, email address and password (stored as a secure hash by our identity provider), or your Google profile name and email if you sign in with Google.
- Workspace data: workspace names, members and their roles, invitations, websites and domains you add, article paths, surveys and questions.
- Billing data: your plan and subscription status. Payment details are collected and stored by Paddle, our Merchant of Record; we never see your full card number.
- Technical data: session identifiers and standard server logs (such as IP address, browser and time of request) used for security and troubleshooting.
- Correspondence: messages you send to our support team.
3. Data we collect through the widget
The widget is designed to collect anonymous feedback. For each response we store:
- the website and page path where the survey was shown;
- the survey and question answered, and the answer given;
- when the survey was started and submitted.
We do not store the reader's IP address, browser details, name or email with a response, and we do not use cookies or tracking identifiers in the widget. Email addresses and phone numbers typed into free-text answers are automatically removed before the answer is saved. The widget keeps a short-lived "already answered" note in the reader's browser storage; see our Cookie Policy.
To protect surveys from automated abuse, such as a script flooding a survey with fake answers, we limit how many surveys can be started from one network in an hour. For this we use the reader's IP address when an answer is submitted, but we only keep a one-way, keyed hash of it (for IPv6, of its network prefix). The hash changes every hour, so it cannot be used to follow a reader over time. It is never stored with a response and is deleted shortly after the hour ends. We rely on our legitimate interest in keeping the Service secure.
4. How we use data and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account and workspaces | Performance of a contract |
| Process subscriptions and enforce plan limits | Performance of a contract |
| Collect and show feedback on behalf of customers | Customer's instructions (processor) |
| Keep the Service secure, prevent abuse, debug issues | Legitimate interests |
| Send service emails (verification, invites, billing notices) | Performance of a contract |
| Meet tax, accounting and legal obligations | Legal obligation |
We do not sell personal data, use it for advertising, or use widget responses to build profiles of readers.
5. Who we share data with
We use a small number of service providers who process data on our behalf:
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, database, user authentication (Cognito) | EU |
| Paddle.com | Merchant of Record: checkout, payments, invoicing, tax | UK / EU |
| Optional "Sign in with Google" | Global |
We may also disclose data where required by law, to protect our rights or users, or as part of a merger or acquisition, in which case this policy continues to apply.
6. International transfers
Where data is transferred outside the European Economic Area, we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed.
7. How long we keep data
- Account and workspace data: for as long as your account is active, and deleted within 30 days after you close it.
- Widget responses: for as long as the customer keeps the survey or website, or until they delete it.
- Widget abuse-prevention counters (a keyed hash of the reader's IP address or network): deleted shortly after the hour they cover.
- Sessions: signed-in sessions expire after 30 days.
- Server logs: up to 30 days, unless needed to investigate an incident.
- Billing records: as long as tax law requires (typically up to 10 years), held by Paddle and us.
8. Security
We encrypt data in transit (HTTPS) and at rest, keep sessions server-side with httpOnly cookies, restrict access by role, and limit staff access to what is needed to operate the Service. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as the law requires.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to restrict or object to processing, and to withdraw consent where we rely on it. You can update most account details yourself in Settings.
To exercise your rights, email hello@asklet.io. We will reply within one month. You also have the right to complain to your local data protection authority.
10. Children
The Asklet dashboard is not intended for anyone under 16. Customers must not use the widget to knowingly collect data from children where that requires parental consent.
11. Changes to this policy
We will post any changes on this page and update the date above. If the changes are significant, we will also notify customers by email or in the app.
12. Contact
Asklet, Portugal. Privacy enquiries: hello@asklet.io.