Privacy Policy

Last Updated: October 8, 2026

1. Introduction

Askalytics ("Askalytics," "we," "us," or "our") is a business based in the United Kingdom. Askalytics operates the analytics platform at app.askalytics.io and the marketing website at www.askalytics.io. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our platform.

By creating an account or using our services, you accept the data handling practices described in this policy.

2. Information We Collect

Account Information

When you register, we collect:

  • Email address
  • Name (first and last)
  • Company name (optional)
  • Country
  • Industry (optional)
  • Role and analytics experience level (optional)

Authentication & Security Data

  • Passwords are hashed using industry-standard algorithms and never stored in plaintext
  • Session tokens for maintaining login state
  • If you turn on two-factor authentication, an encrypted authenticator secret and hashed single-use backup codes
  • IP addresses at time of registration and consent (for legal compliance)

Usage Data

We track:

  • Feature access and navigation patterns
  • AI queries submitted and responses generated
  • Session metrics (login frequency, time on platform)
  • Credit usage and API consumption

We keep the questions you ask and the answers you receive for as long as your account is open, so you can look back at them. They are deleted when you close your account (see Section 5).

Aggregate Usage Statistics

In addition to the per-account data above, we collect anonymized aggregate usage statistics across the entire platform, for example, total tokens consumed, total queries run, total credits used, and feature adoption rates. We use these aggregate statistics for product analytics, capacity planning, billing reconciliation with our AI providers, and to improve the service. Aggregate statistics do not identify individual users or expose individual customer data, and are not shared with third parties except in anonymized form.

Third-Party Integration Data

When you connect Google Analytics, Search Console, or Google Ads (and, where you choose to, Microsoft Clarity, HubSpot, or Mailchimp):

  • We use read-only API access that you authorize (OAuth, or a dedicated service account for older properties)
  • We synchronize daily-aggregated analytics data from these sources into a private warehouse so we can run detectors, generate insights, and answer your questions without going back to Google's APIs on every page load. We store daily aggregates (e.g. sessions per channel per day, clicks per query per day), not event-level or personal-identifier data.
  • The warehouse retains selected daily-aggregated tables for as long as your subscription is active. This is not a full copy of your raw analytics data.
  • We do NOT store the raw event-level stream from your Google accounts, only the daily aggregates needed to power our analytical features.
  • Access tokens and any service-account credentials are encrypted at rest using AES-256.
  • For Google Analytics we also capture your property's configuration settings each night (for example data streams, key events, custom dimension names, and data retention settings) and keep a history of changes, so we can explain your numbers. We cannot read your Google Analytics user list or change history.
  • For Microsoft Clarity, HubSpot, and Mailchimp, we store the credential you provide (an API token or OAuth grant), encrypted, and synchronize daily roll-ups only: Clarity session metrics by page, device, and source; HubSpot contact, deal, email, and form counts per day; Mailchimp campaign and audience activity per day. We only read from these sources.
  • The warehouse is hosted in the UK (Neon, London / eu-west-2 region), with application compute on Google Cloud in the EU (europe-west1). It is logically isolated per customer: every query and every detector run is scoped to your property's data only.

Shopify Data

Shopify is marked Coming Soon in Askalytics and cannot be connected yet. The following describes how Shopify data will be handled once the integration is available:

  • What we collect. We request read-only access to your store's orders, customers, products, inventory, locations, fulfillments, shipping, price rules, discounts, draft orders, returns, checkouts, analytics, reports, and marketing events. We never request write scopes: Askalytics cannot modify anything in your Shopify admin.
  • How we use it. We synchronize this data into the same private warehouse described above and aggregate it at the daily level (e.g. orders per day, revenue per channel per day, product-level performance per day). We use these aggregates to power Ask AI questions, AI Insights, AI Sentinel, and cross-source insights that combine Shopify with Google Analytics.
  • How we store it. Your Shopify access token is encrypted at rest using AES-256-GCM before it ever touches our database, and is never returned to the browser or written to logs in plaintext. The aggregated warehouse data is logically isolated per Shopify store: every query is scoped to your store only.
  • What we do not store. We do not store row-level customer PII at the warehouse level. We aggregate orders into daily metrics rather than retaining individual customer records, so we generally have no per-customer data on our side to expose.
  • Customer data export. If a customer of your Shopify store exercises their GDPR right to a copy of their data, Shopify forwards the request to us via the customers/data_request webhook. Because we do not retain row-level customer records, we have nothing to send back automatically. If a merchant escalates a specific export request, email [email protected] and we will respond manually within 30 days.
  • Customer data deletion. Shopify forwards customer deletion requests to us via the customers/redact webhook 10 days after the customer requests deletion. We process the deletion automatically (and idempotently) on receipt. To request deletion outside this flow, email [email protected].
  • Uninstall and shop-level deletion. When you uninstall Askalytics from your Shopify store, Shopify notifies us via the shop/redact webhook 48 hours later. On receipt we automatically delete the encrypted access token, the connection record, and all Shopify-derived warehouse data tied to that store. This deletion is irreversible and completes well within Shopify's 30-day mandate.
  • Subprocessors for Shopify data. Shopify-derived data is processed on Google Cloud Platform compute in the EU (europe-west1) and stored in the Neon Postgres warehouse in the UK (London, eu-west-2). Aggregated Shopify figures may be sent to Anthropic or OpenAI when you use AI features. Section 6 describes what we send to AI providers.
  • Retention. Active connections retain daily-aggregated Shopify data for as long as your subscription is active. On uninstall, all Shopify-derived data for that store is deleted within 48 hours of Shopify's shop/redact webhook firing.

3. Google User Data and Limited Use

When you connect Google Analytics, Google Search Console, or Google Ads, Askalytics requests access to the following Google API scopes:

  • https://www.googleapis.com/auth/analytics.readonly: read-only access to your Google Analytics 4 reporting data.
  • https://www.googleapis.com/auth/webmasters.readonly: read-only access to your Google Search Console performance data.
  • https://www.googleapis.com/auth/adwords: access to your Google Ads account data. Google offers one scope for Google Ads; we use it only to read reporting data and never change anything in your Google Ads account.

How we access this data. Access is granted through an authorization you explicitly approve (an OAuth grant, or a dedicated service account for older properties), and each of the three sources can use a different Google account. Askalytics only reads: it cannot create, edit, or delete anything in your Google Analytics or Search Console accounts, and it does not change anything in your Google Ads account. When you sign in with Google, we also receive your basic Google profile (name, email address, and profile picture).

How we use this data. We use your Google Analytics, Search Console, and Google Ads data solely to provide and improve user-facing features of Askalytics: generating dashboards, running deterministic detectors, producing AI insights, and answering the questions you ask in plain English.

How we store this data. We synchronize daily-aggregated metrics (not event-level or personal-identifier data) into a private, UK-hosted warehouse, logically isolated per property and encrypted at rest using AES-256, as described in the "Third-Party Integration Data" section above. We retain selected daily-aggregated tables per property for as long as your subscription is active. This is not a full copy of your raw analytics data.

How we share this data. We do not sell Google user data and we do not use it for advertising. We share it only with the limited service providers described in the "Data Sharing" section below (cloud infrastructure and AI service providers) strictly to operate the features you request. We do not transfer Google user data to others except as necessary to provide or improve the service, to comply with applicable law, or as part of a merger or acquisition. We do not use Google user data to develop, improve, or train generalized AI or machine-learning models.

Limited Use disclosure. Askalytics's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access. You can revoke Askalytics's access to your Google data at any time by disconnecting the property from within Askalytics, or directly through your Google Account at myaccount.google.com/permissions. When you disconnect a property, the daily-aggregated data derived from it is purged from our warehouse within 30 days.

4. How We Use Your Information

We use your information to:

  • Provide and maintain the Askalytics platform
  • Process AI queries against your connected analytics accounts
  • Send service communications (account updates, security alerts)
  • Improve platform features and AI accuracy
  • Provide customer support
  • Meet legal and regulatory obligations
  • Personalize AI responses based on your role and experience level

5. Data Retention

  • Active accounts: Data is retained for the duration of your account.
  • Account closure: Personal data and connected-property analytics data are deleted from our live systems when your account is closed, usually within minutes. Encrypted nightly backups are kept for 90 days, so a copy can remain in a backup for up to 90 days after deletion; we do not restore deleted accounts from backups. We keep a short record that the account was deleted, including its email address, so we can show the request was honored.
  • Warehouse analytics data: Selected daily-aggregated tables per property, retained for as long as your subscription is active.
  • Usage logs: Retained while your account is open and deleted with it. Our internal administrator audit log, security incident records, and sales invoices are kept after an account is closed, for accountability and for tax law, and are not used for any other purpose.
  • Legal compliance: Consent records retained as required by GDPR Article 7(1).

6. Data Sharing

We do not sell your personal information. We share data only with:

  • Cloud infrastructure providers (Google Cloud in Belgium runs the application and holds our encrypted backups; Neon in London hosts our databases)
  • AI providers (Anthropic and OpenAI, both in the United States). Anthropic (Claude) writes the answers and insights for every property, and OpenAI (ChatGPT) checks them as a second AI, so both may process data from any property. Their business API terms prohibit using customer data to train their models. What we send: your question, the property name and website address, and the daily figures from your warehouse needed to answer, which can include page URLs, search queries, and country or city; for AI Lift, screenshots of your public web pages. Known personal tracking codes are stripped from URLs before sending. Both providers delete what we send within 30 days under their standard API terms (Anthropic may keep content longer if it is flagged for a usage policy violation).
  • Email providers (Amazon Web Services in Sweden sends our transactional and notification emails; Hostinger hosts our @askalytics.io mailboxes, where your messages to us arrive)
  • Marketing email (Mailchimp, in the United States, holds our mailing list: your name, email address, and whether you opted in to product updates and news. Every sign-up is recorded there with its preference so we can honor it, and demo visitors who give us their email address are added the same way. You can unsubscribe from any marketing email or by writing to [email protected])
  • Website and app analytics (Google Tag Manager, Google Analytics, Google Ads conversion tracking, and Microsoft Clarity session recording on www.askalytics.io and app.askalytics.io, only where you allow analytics or advertising cookies; see our Cookie Policy)
  • Security, error, and consent tools (Cloudflare protects our sign-up and sign-in forms and serves our marketing website, and sees your IP address; CookieYes runs our cookie banner and records your consent choice; Sentry, in the EU, receives error reports that can include a user identifier)
  • Sources you connect (Microsoft Clarity, HubSpot, and Mailchimp receive your authorization and the read requests we make on your behalf)
  • Payment processor (Stripe, for subscription billing; Stripe handles your payment details, which we never store ourselves)
  • Chat platforms you connect (Slack and Microsoft Teams, only to deliver the answers you request into your own workspace)
  • Legal authorities (when required by law)
  • Business successors (in the event of a merger or acquisition, with prior notification)

7. Authorized Personnel Access

From time to time, authorized Askalytics personnel may access customer account data (including connected Google Analytics, Search Console, or Google Ads data, AI queries, and AI responses) for the purposes of:

  • Customer support and troubleshooting (e.g. investigating a reported issue)
  • Security investigations (e.g. responding to suspected misuse or a security incident)
  • Service quality assurance and product improvement
  • Compliance with legal obligations

Such access is:

  • Limited to authorized personnel acting within the scope of their role
  • Recorded in an internal administrator audit log capturing who accessed which account, what they did, and when
  • Conducted on a need-to-know basis: we do not browse customer data routinely

You may request a record of administrator access to your account by emailing [email protected]. By using the service you acknowledge that this access is part of providing and supporting Askalytics.

8. Data Improvement Program (Not Yet Available)

Earlier versions of this policy described an optional, per-property Data Improvement Program that would let us study aggregated patterns in connected data to design new detectors. That program has not been launched: there is no opt-in control in the product, no property has been enrolled, and no processing takes place under it. If we launch it, we will update this policy, our Terms of Service, and our Data Processing Agreement first, and it will stay off unless you choose to turn it on for a property.

9. International Data Transfers

Askalytics is based in the United Kingdom. Your account data and your analytics warehouse are stored in the United Kingdom (London), and our application and backups run in the European Union (Belgium). Some of the companies that help us run the service process data in the United States, including our AI providers (Anthropic and OpenAI), Mailchimp, and Stripe; our Data Processing Agreement lists each one. We protect international transfers using Standard Contractual Clauses (SCCs) approved by the European Commission, technical safeguards including encryption, and contractual obligations with all sub-processors.

10. Your Rights

EU/UK Residents (GDPR)

You have the right to: access your personal data, correct inaccurate data, request deletion, data portability, withdraw consent at any time, and lodge a complaint with a supervisory authority.

California Residents (CCPA)

You have the right to: know what personal information is collected, request deletion, opt out of the sale of personal information (we do not sell data), and non-discrimination for exercising your rights.

Contact: [email protected]

11. Cookies

We use essential cookies for authentication and session management, and, only with your consent, analytics and advertising cookies on our website and app. See our Cookie Policy for full details.

12. Security Measures

  • Encryption in transit (TLS/HTTPS)
  • Encryption at rest for sensitive data (AES-256)
  • Secure authentication with hashed passwords
  • Role-based access control
  • Regular security audits and monitoring
  • Optional two-factor authentication (authenticator app) for every account
  • Email address verification at sign-up and bot protection on our forms
  • Encrypted nightly backups, kept for 90 days
  • Read-only access per property (OAuth, or a dedicated service account for older properties)

13. Children's Privacy

Our services are not designed for users under 16. We do not intentionally collect personal information from children.

14. Changes to This Policy

We will notify you of material changes via email or platform notification. Your continued use after notification constitutes acceptance.

15. Contact Us

  • General privacy: [email protected]
  • Data protection contact: [email protected]
  • Postal address: Askalytics, Rushy Beck Court, Langford Lane, Ilkley, West Yorkshire LS29 7JQ, United Kingdom