Privacy Policy

1. Who is responsible

LIU WEI DONG, an individual developer based in Shanghai, China, operates askuser.ai at https://askuser.ai and is responsible for the personal information described in this policy. Contact [email protected] for privacy, security or data-rights requests.

For account, billing and platform operations, we determine the purposes of processing. When you upload contacts or connect a mailbox on behalf of your organization, you remain responsible for your own notices, permissions and lawful instructions. Recipients of outreach and people appearing in business leads can contact us without creating an account.

2. Information we process

Account information: email, name, account identifier, plan, usage counters and authentication records. Email registration stores a password hash rather than a readable password. Google sign-in supplies the Google account identifier and authorized basic profile information.

Research content: product descriptions, submitted websites and business context, generated reports and personas, simulated interview questions and answers, saved matches and related feature inputs.

Contact and lead information: imported or discovered names, business email addresses, job titles, employers, business descriptions, industry, location, social or website links and other business fields supplied by you or the available source. Search and verification results and semantic vectors may also be stored.

Outreach information: connected mail server settings and encrypted credentials, sender and recipient details, drafts and sent messages, message identifiers, matched replies and their analysis, suppression records, and tracked link clicks and timestamps. When IMAP reply detection is configured, the Service checks the connected mailbox for replies to tracked sent messages.

Payment and support information: checkout and order identifiers, subscription status, billing periods, payment or refund amounts and status, and information you send to support. Full card numbers and card security codes are handled by Waffo Pancake and its payment providers, not stored by askuser.ai.

Operational information: request and error logs, usage and abuse-prevention counters, and network information such as IP addresses that hosting or security providers receive when you connect. We use this information to operate, troubleshoot and secure the Service. We do not need precise device location to provide it.

3. Purposes and legal bases

We process account, research, matching, email and payment data to provide the features you request and perform our contract with you. Customer support, service reliability and proportionate abuse prevention may rely on legitimate interests, subject to your rights. Tax, accounting and lawful authority requirements may require processing under legal obligations.

Where consent is required for optional processing, it must be obtained separately and may be withdrawn without affecting earlier lawful processing. This policy is an explanation of processing, not blanket consent to all processing. You are responsible for identifying a lawful basis and providing required notices when you upload other people’s information or send outreach.

4. Browser storage and tracking

The application uses localStorage for the login token, cached profile, language preference and cached reports. sessionStorage holds report, simulated interview and outreach context for the current browser session. Logging out clears the login token and cached profile; it does not automatically clear every cached report. You can remove these items using browser site-data settings, which may sign you out or remove local drafts.

Outreach emails can include links redirected through the Service to record a click associated with the sent message. These events support engagement and persona analysis. Senders must provide any required notice and honor recipient objections; a link click does not establish consent or purchase intent.

Google sign-in and Google Fonts, and Cloudflare Turnstile when enabled, involve requests to those providers and may use their own storage or security mechanisms. We do not use Google Analytics or advertising pixels in the application. Third-party and hosting services may collect information under their own policies.

5. Providers and disclosures

OpenRouter and the selected downstream model providers receive the content needed for generation, simulated interviews, matching or reply analysis. This can include product information, relevant business contact fields and reply text when you use those features. Jina receives contact profile text and search queries to generate embeddings for semantic matching.

Serper receives search queries for business and lead discovery. Optional email verification sends the address to the configured verification provider: MillionVerifier, Reoon, Bouncer or Hunter. Only the enabled provider receives that verification request; contact us to identify the provider used for a particular request. Your connected SMTP and IMAP providers process messages and credentials necessary for your authorized email functions.

Google supports sign-in and font delivery. Cloudflare supports abuse prevention when enabled. Render provides application hosting. The platform’s hosting and database infrastructure store the information needed to operate your account. Waffo Pancake handles payment, tax and related compliance as Merchant of Record and processes payment information under its own applicable terms and privacy policy.

We may disclose information where necessary to comply with law, protect legal rights or investigate abuse, and in a lawful business transfer subject to applicable protections. Only the information needed for the relevant purpose should be disclosed.

6. Contacts, sharing and your choices

Your account’s private contact records are scoped to your account in the application. The Service also supports platform-provided business leads that can be returned to other authorized users through matching. This is a separate source of lead information and should not be confused with private imports. Reports opened through a shareable link may be accessible to people who have that link; avoid sharing confidential report links.

We do not sell your account details, private research content or privately imported contact lists to advertisers or other customers. Platform-provided business lead results are a separate feature and may constitute a sale or sharing of personal information under some laws. You can ask us to stop disclosing your lead record by emailing [email protected] with the subject “Privacy opt-out”; no account or purchase is required. We do not use advertising pixels for cross-context behavioral advertising.

If you appear in a business lead record or receive outreach, you may contact support about its source, correction, objection or removal. An email recipient’s rights do not depend on having an askuser.ai account. Users sending messages remain responsible for their own controller obligations.

7. AI data use

We use AI for inference and embedding generation and do not use your content to train foundation models. OpenRouter, its downstream models and Jina have their own data-use and retention practices, which can vary by provider and route. Some downstream providers may retain content or use it for model improvement under their terms. We do not promise universal third-party zero retention or no training. See the linked provider policies or contact us before submitting material that requires specific processing restrictions.

Do not submit secrets, sensitive personal information or materials you cannot lawfully disclose to these providers. AI personas and scores are research aids, not verified identities, and should not be the sole basis for decisions with legal or similarly significant effects on individuals.

8. Security and incidents

We use password hashing, authenticated access controls, encryption at rest for saved mail credentials and HTTPS for the public service. These measures reduce risk but cannot guarantee absolute security. We do not claim independent security certification.

If a breach occurs, we will investigate, take appropriate containment measures and notify affected people and regulators as required by applicable law, including the GDPR supervisory-authority deadline of 72 hours after awareness where applicable. Never send passwords, full card details or mailbox credentials in a support request.

9. Retention and deletion

askuser.ai-specific account settings and private workspace data, including reports, personas, conversations, contacts, derived embeddings, matches, outreach and mailbox settings, are retained while your account is open and the data is needed for the requested features. Subscription cancellation leaves your Free account open and does not trigger deletion. Use available record-deletion controls or email [email protected] from your account email to request closure or deletion. We may proportionately verify your identity. We close askuser.ai access and remove the corresponding business data from active systems within 30 calendar days of receiving your request, unless a lawful exception applies. Cleanup can finish sooner; this is not a recovery period.

Account closure removes askuser.ai private business data. Shared sign-in identity information used by the legacy application is retained separately and is not erased by closing askuser.ai alone. Contact support for a coordinated request if you also want that identity or data held by the other application deleted. No per-customer JSON archive is created as part of closure.

Limited order, subscription and refund reconciliation records may remain after closure where needed for accounting, billing disputes or another applicable legal obligation. Waffo independently retains its payment records under its own policy. This does not authorize retaining unrelated reports, conversations or contacts. Support correspondence, operational logs and security records are separate from workspace data and are retained only for their support, operational, security or legally required purposes; contact support for the applicable retention information or to request deletion.

We do not create an offline archive of your business data when you close your account. Disaster-recovery copies, if maintained by us or our infrastructure providers, are restricted to recovery and expire under the applicable backup lifecycle. A single fixed backup expiry has not been verified for all infrastructure, so this policy does not promise a universal 90-day period. Where immediate physical deletion is not possible, further use is restricted; completed deletion requests must be reapplied before restored data is used for normal operations. Contact support for the backup arrangement relevant to your data.

A minimal suppression record may be retained as long as necessary to honor a request not to be contacted or listed; it is not used for lead matching or marketing. A legal hold may extend only the records needed for a dispute or legal obligation, after which normal deletion resumes. We will explain an applicable exception when responding to a deletion request.

These periods cover records under our control. Waffo and other independently responsible providers apply their own legal retention duties. We pass applicable deletion instructions to processors we engage. Browser localStorage remains until you or the application clear it; sessionStorage normally ends with the browsing session. Clear browser site data to remove local copies; account closure cannot remotely erase copies you exported or third parties lawfully retained.

10. Your rights and choices

Depending on your location, you may request access, a copy or portability, correction, deletion, restriction, objection, withdrawal of consent, and opt-out of applicable sale or sharing. You may complain to the competent data protection authority and exercise rights without unlawful discrimination.

Email [email protected] with the nature of your request and sufficient information to identify the relevant account or record. We aim to acknowledge it within 5 business days and respond within 30 calendar days of receipt, or a shorter period required by law. We may verify identity proportionately. Where a lawful extension or exception applies, we will notify you within the original response period and explain the reason and expected timing.

Clearing browser storage controls local copies. Disconnecting mail settings stops future authorized mailbox use once processed; deleting data already stored is a separate request. You can object to platform marketing by contacting support. Necessary service, billing and security notices continue while relevant. If we send optional platform marketing, we provide a way to unsubscribe.

11. International processing

The operator is based in China. Our hosting, AI, search, email and payment providers operate internationally, and your information may be processed outside China or your country of residence, including by US-based providers. Provider locations and processing routes can differ by feature; this is not a promise of storage in a particular country. Contact support for information about the recipients and locations relevant to your use.

Where applicable law requires a particular cross-border transfer mechanism, separate notice or consent, or other safeguards, those requirements must be met before the relevant transfer. Depending on the transfer, safeguards may include legally recognized contractual protections or another permitted mechanism. This policy does not itself obtain separate consent, establish a data processing agreement or claim a security assessment or certification.

12. Children

The Service is intended for people aged 18 or older and is not directed to children. Do not submit children’s personal information. If you believe a child has provided information, contact support so that the operator can investigate and arrange any required removal.

13. Third-party policies and changes

Third-party sites and providers have their own privacy practices. Review the provider policies linked below when using their services. We will notify you of material changes through the Service or your registered email at least 14 days before they take effect, unless a shorter period is required for legal or urgent security reasons. We update the version and effective date and obtain fresh consent where required by law.

14. Contact

Operator and privacy contact: LIU WEI DONG, individual developer, Shanghai, China. Email [email protected] for privacy, security and data-rights requests, including correction, deletion and opting out of lead disclosure. Please provide only the information needed to locate your account or record.

Provider privacy and data policies

• OpenRouter · Data use and logging
• Jina
• Google
• Cloudflare
• Render
• Waffo Pancake