Privacy Policy

This policy explains what personal data we process when you use askan.ai, on what legal basis, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

The controller responsible for data processing on this website is:

Controller's postal address (shown as an image)

Email: contact @ askan.ai

2. Data we process

Your questions. The text of your question is transmitted to the OpenAI API (OpenAI, USA) to generate an answer and is stored by us. Please do not enter any personal data, and in particular no special categories of personal data within the meaning of Art. 9 GDPR (e.g. health, religious or sexual-life data). Inputs containing email addresses or phone numbers are rejected automatically. OpenAI states it may retain API inputs for up to 30 days for abuse monitoring. High-quality answers may be published as public pages.
IP addresses. We do not store your IP address in clear text. For abuse prevention (rate limiting) we process only a keyed cryptographic hash (HMAC) from which the IP cannot be reconstructed.
Cookies. We set a strictly necessary cookie (CSRF protection). We do not set any analytics or advertising cookies.
Bot protection. To protect the question form we use Cloudflare Turnstile (Cloudflare, Inc., USA). Technical data may be processed for abuse detection.
Analytics. We use Cloudflare Web Analytics (Cloudflare, Inc.), a privacy-first measurement tool: it sets no cookies, does not store IP addresses, and does not fingerprint or track you across sites. We only see aggregate metrics such as page views, referrers and page performance.
Server & CDN. The site is delivered via the Cloudflare CDN (reverse proxy). Technical server logs (requested page, timestamp, status code, request ID) are stored briefly for error analysis and security.

3. Legal bases

Art. 6(1)(b) GDPR (performance of the service you request) and Art. 6(1)(f) GDPR (legitimate interest in the security, abuse-prevention and aggregate usage analysis of the service).

4. International data transfers

To provide the service, data is transferred to service providers in the USA (OpenAI, Cloudflare). These transfers are based on the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework. Details: OpenAI, Cloudflare.

5. Retention

Question logs that do not become published content are deleted after at most 90 days. Published articles remain until they are editorially removed. Technical logs are kept only for a short period.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing (Art. 15–21 GDPR), and the right to lodge a complaint with a supervisory authority. To exercise these rights, contact us at the address above.

7. Encryption

This site uses SSL/TLS encryption for all connections.

8. Changes

We may update this policy to reflect changes to the service or legal requirements. The current version always applies.