Last Updated: October 8, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Askalytics, a business based in the United Kingdom ("Askalytics" or "Processor"), and the customer ("Controller") and establishes obligations regarding the processing of personal data in compliance with the UK General Data Protection Regulation and the EU General Data Protection Regulation (together, "GDPR").
This DPA applies when Askalytics processes personal information to deliver analytics services, including managing user accounts, processing AI queries, and generating insights from connected data sources.
Data Subjects: Controller's employees and authorized users, website visitors and search-engine users (as represented in aggregated analytics data).
Personal Data: Account information (name, email, company), usage data (queries, feature access, session metrics), AI queries and responses.
Connected-Property Analytics Data: Daily-aggregated metrics and dimensions retrieved from Google Analytics 4, Google Search Console, and Google Ads via the Controller's authorized read-only access (OAuth, or a service account for older properties), together with the Controller's Google Analytics property configuration settings and their change history, and, where the Controller connects them, daily roll-ups from Microsoft Clarity, HubSpot, and Mailchimp (HubSpot and Mailchimp in beta). Examples: sessions per acquisition channel per day, search-query × landing-page click counts per day, campaign-level spend and conversion totals per day. Selected aggregated tables are stored in a private analytics warehouse for as long as the subscription is active, to enable insight generation, AI Sentinel, Ask AI, and the weekly AI Insights email. This is not a full copy of the Controller's raw analytics data. Raw event-level streams are not stored.
Askalytics shall process personal data only on documented instructions, ensure staff confidentiality, implement appropriate security measures, assist with data subject requests, notify the Controller of impact assessments where required, and delete or return all personal data upon termination.
To deliver and support the service, the Controller authorizes Askalytics to permit a limited number of authorized Askalytics personnel to access the Controller's account data (including connected Google Analytics, Search Console, or Google Ads data, AI queries, and AI responses) for the purposes of customer support, troubleshooting, security investigations, and service quality assurance. Such access:
The Controller may request a record of administrator access to its account by contacting [email protected].
Askalytics may collect anonymized aggregate usage statistics across all customers (for example, total tokens consumed, total queries run, feature adoption rates) for product analytics, capacity planning, and billing reconciliation with sub-processors. These aggregate statistics do not identify individual data subjects, do not expose individual customer data, and are not shared with third parties except in anonymized form.
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud Platform | Cloud hosting and compute; encrypted nightly backups (kept 90 days) and uploaded images | EU (Belgium, europe-west1; uploaded images EU multi-region) |
| Neon | PostgreSQL database hosting (application database and analytics warehouse), running on Amazon Web Services | UK (London, eu-west-2) |
| OpenAI | Checks the AI answers and insights that Claude writes, as a second AI from a different provider. Receives the user's question, the property name and website address, the daily-aggregated figures needed to answer, and for AI Lift screenshots of the Controller's public web pages. Not used to train models; deleted by OpenAI within 30 days under its standard API terms. | US |
| Anthropic | Writes AI answers and insights for every property. Receives the user's question, the property name and website address, the daily-aggregated figures needed to answer, and for AI Lift screenshots of the Controller's public web pages. Not used to train models; deleted by Anthropic within 30 days under its standard API terms (longer if flagged for a usage policy violation). | US |
| Amazon Web Services | Transactional email delivery (SES) | EU (Stockholm, eu-north-1) |
| Stripe | Subscription billing and payment processing | EU / US |
| Slack Technologies (Salesforce) | Slack chat integration; delivers requested answers to the Controller's own Slack workspace | US |
| Microsoft | Microsoft Teams chat integration; delivers requested answers to the Controller's own Teams workspace | EU / US |
| Microsoft Clarity | Session and behavior analytics on the Controller's own website, where the Controller has connected it. Also session recording on the Askalytics website and application where the user allows analytics cookies; a one-way hashed email identifier is passed so a recording can be matched to an account | EU / US |
| Mailchimp (Intuit) | Email marketing data, where the Controller has connected their Mailchimp account; also holds the Askalytics mailing list (name, email address, and product-update preference of each sign-up) | US |
| HubSpot | CRM and marketing data, where the Controller has connected their HubSpot account | EU / US |
| Cloudflare | Bot protection on sign-up and sign-in (Turnstile), page rendering and screenshots for AI Lift (Browser Rendering), and serving the Askalytics marketing website | Global edge network |
| Sentry | Application error monitoring; may incidentally capture a user identifier present in an error report | EU (Germany) |
| CookieYes | Cookie consent management on the Askalytics website | EU / US |
| Google Tag Manager, Google Analytics and Google Ads | Usage analytics and advertising conversion tracking on the Askalytics application itself. This is separate from the Controller's own Google accounts that Askalytics reads on their behalf: here Google receives the IP address and page context of visitors to our app, including signed-in users | EU / US |
The Controller will be given 30 days' notice before any new sub-processor is engaged.
Where personal data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs), supplementary technical measures including encryption, and contractual obligations with all sub-processors.
In the event of a breach, Askalytics will notify the Controller within 72 hours, provide details of the nature and scope, and cooperate fully with investigation and regulatory notification obligations.
Askalytics will assist the Controller in fulfilling data subject requests including access, rectification, erasure, portability, restriction, and objection to processing.
The Controller has the right to audit Askalytics's compliance with this DPA, subject to reasonable notice and scope limitations.
This DPA remains in effect for the duration of the service agreement. Upon termination, all personal data will be deleted from live systems within 30 days (in practice at once), with confirmation provided upon request. Encrypted backups containing that data age out within 90 days and are not used to restore deleted accounts. Access tokens and any service-account credentials are deleted immediately.
Earlier versions of this DPA described an optional, per-property Data Improvement Program ("DIP"). The DIP has not been launched: there is no in-product consent flow, no property has been enrolled, and no processing takes place under it. If Askalytics launches the DIP, this DPA will be updated first, and the program will apply only to properties the Controller expressly opts in.
Data protection inquiries: [email protected]