Privacy policy

Last updated: 29 September 2026

The short version: we only use the data we need to run Asklane. We deliver an inquiry only to the vendor you chose, and only after you have confirmed your email address. We don't sell data, we don't use it for advertising, and we don't use it to train AI models. The website sets no cookies.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

Alexander Klimin, trading as Asklane Roedernstr. 6B 12623 Berlin Germany Email: alex@asklane.io Contact form: asklane.io/support

We have not appointed a data protection officer because the law does not require one for us. For all data protection questions, write to alex@asklane.io.

2. What this policy covers

the website asklane.io, including its forms (section 3 and 4);
the registration for the Asklane pilot for vendors (section 5);
the Asklane app in ChatGPT and Claude (section 6);
inquiry pages that vendors publish on their own websites with Asklane (section 7);
emails you send us (section 8);
businesses we contact about Asklane (section 9);
AI assistance with our business correspondence (section 9a).

3. The website asklane.io

3.1 Hosting

Our website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you open a page, your browser sends technical data that Vercel's servers process to deliver the page and keep it secure: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. Vercel keeps these server logs only for a short time. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in delivering a secure, working website).

3.2 Web analytics without cookies

We use Vercel Web Analytics to count page views. It uses no cookies and stores nothing in your browser. It records which pages are viewed, the referring page, your browser, operating system and device type, and your country. Visitors are told apart only by a hash of the request, which is discarded after 24 hours. We only see totals, never individual visitors. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in knowing which pages are useful). You can object at any time (section 11).

3.3 Cookies and browser storage

The website sets no cookies. There is one small note in your browser's local storage: when you close our free-audit window, your browser stores the time you closed it, so the window doesn't open again for 14 days. The note contains nothing else and never leaves your browser. We store it only because you asked to close the window (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

Fonts and images are delivered from our own website. We don't embed content from other providers.

3.4 Spam protection on forms (Cloudflare Turnstile)

Our forms use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile only loads when a form is shown. It checks that a person, not a bot, is sending the form. To do this, it processes technical signals such as your IP address, browser information and the address of the website. It uses no cookies. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in protecting our forms from spam and misuse). Cloudflare also uses these signals, as a controller in its own right, to improve Turnstile's bot detection. Details are in Cloudflare's Turnstile Privacy Addendum at cloudflare.com/turnstile-privacy-policy.

4. Forms: free audit and contact

When you send one of these forms (the free audit, or the contact form on our support page), we receive what you enter: your email address, your website, and anything you add (for example a message, your name or the plan you're interested in). We also record the page you sent the form from, the page you came from, and your country, which is derived from your IP address. We don't store your IP address with the form.

Purpose: to reply to you and, for the free audit, to prepare and send your audit.
Legal basis: Art. 6(1)(b) GDPR (steps you asked for before a possible contract), and Art. 6(1)(f) GDPR (our legitimate interest in answering business inquiries).
Where it goes: the form is stored in our database with Cloudflare (Cloudflare D1). We receive an email notification, which is sent by Resend and delivered to our mailbox with Google Workspace (section 10).
How long: we delete a form 12 months after you sent it, unless it led to a pilot agreement or another contract. In that case, section 5 applies.

5. Pilot registration for vendors

5.1 Registration and proof of agreement

When you register your company for the Asklane pilot, we process:

your name, your role, your work email address;
your company's name, website and, if you give it, country;
your confirmations (that you accept the Pilot Terms, and that you are allowed to sign up your company);
the version of the Pilot Terms you accepted and its fingerprint (hash);
the time of your registration and of your email confirmation;
your IP address and your browser's user agent at both steps;
the emails we sent you (confirmation link, copy of the terms).

Purposes and legal basis:

To conclude and carry out the pilot agreement: Art. 6(1)(b) GDPR.
To be able to prove who agreed to which terms and when: Art. 6(1)(f) GDPR. Our legitimate interest is in proving the agreement and defending legal claims.

How long:

If you don't confirm your email address, we delete the registration, including IP address and user agent, after 7 days.
If you confirm, we keep the record while the pilot runs and afterwards until the end of the third calendar year after the pilot ends. This matches the regular limitation period under §§ 195 and 199 BGB.

5.2 Your vendor profile

To prepare your profile, we may use information from your company's public website. That is mostly business information; it may include the names and roles of people shown there. We also process the contact details of the people who manage your pilot and receive your inquiries. Your profile stays private until you have approved it.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for preparing the draft profile (our legitimate interest in offering you a ready-made profile to review).
How long: we delete the profile after the pilot ends.

We name your company outside your listing (for example as a founding partner) only with your consent (Art. 6(1)(a) GDPR). You can withdraw that consent at any time with effect for the future.

6. The Asklane app in ChatGPT and Claude

6.1 Connecting Asklane

You use ChatGPT or Claude under the terms and privacy policy of OpenAI or Anthropic. They process your conversation, not us. ChatGPT and Claude ask for your permission before they connect Asklane. When they call Asklane, they send us the information the call needs. Depending on the platform, this can include technical details such as your language setting or approximate location. We only use what we receive in these calls, and only for the purposes below. We have no access to your chat history.

6.2 Questions about a vendor

If you ask about a participating vendor, your assistant sends us the question, and we answer from information the vendor has approved. We don't store these questions with your identity.

6.3 Sending an inquiry

Before anything is sent, your assistant shows you the inquiry and asks for your OK. The inquiry is a summary your assistant prepares from your conversation. It can contain:

your email address (required, for the confirmation link and the vendor's reply);
the vendor you chose;
if you give them: your company name and website, team size, what you need, who you sell to, your current setup, your timeline and your open questions;
your choice whether the vendor may see your contact details straight away.

Please don't include sensitive data (for example health data) or payment details.

We then email you a confirmation link. Your inquiry is only delivered to the vendor after you click it. If you chose to keep your contact details private for now, the vendor receives your inquiry without your name and email address until you decide to share them.

Purposes and legal basis:

Preparing, confirming and delivering your inquiry, and telling you its status: Art. 6(1)(b) GDPR (the service you asked us for).
Checking your email address, to stop spam and misuse of other people's addresses: Art. 6(1)(f) GDPR (our and the vendors' legitimate interest in genuine inquiries).

Recipients: the one vendor you chose, after you have confirmed. From delivery onwards, the vendor is responsible for its own copy. We also use the service providers in section 10.

How long:

Unconfirmed inquiries are deleted after 7 days.
Confirmed inquiries are deleted 12 months after delivery. We keep them so that we can pass on replies and answer questions about them.

6.4 Server logs

Our servers run on Cloudflare. They write short technical logs (for example the time of a request, errors, and in some cases the IP address) to keep the service working and secure. These logs are deleted automatically after 3 to 7 days, depending on our plan. Legal basis: Art. 6(1)(f) GDPR (a secure, working service).

7. Inquiry pages on vendor websites

Some vendors publish an inquiry page on their own website that uses Asklane. Your AI assistant can give you a link to that page with your inquiry already filled in. The pre-filled details are in the part of the link after the "#". Your browser does not send this part to any server when the page loads. The details only leave your browser when you send the inquiry.

For these inquiries, the vendor is the controller. We process your inquiry on the vendor's behalf as its processor (Art. 28 GDPR): we send you the confirmation link, store the inquiry and deliver it to the vendor. The vendor's privacy policy explains its processing and your rights. If you contact us about such an inquiry, we forward your request to the vendor. We delete unconfirmed inquiries after 7 days and confirmed ones 12 months after delivery, unless the vendor tells us to delete them earlier.

8. Emails to us

When you email us (for example at alex@asklane.io), we process your email address, your message and any details you include, in order to reply.

Legal basis: Art. 6(1)(b) GDPR where your email concerns a contract or a request for one, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering messages).
Where it's kept: our mailbox is hosted by Google Workspace (section 10).
AI assistance: we use an AI assistant to read, sort and draft our business correspondence (section 9a).
How long: we delete emails when they are no longer needed for your request and any follow-up, unless tax or commercial law requires us to keep them for longer.

9. Businesses we contact

We contact businesses that we think could benefit from Asklane, usually by email. To do this, we process business contact details: name, role, business email address and company, and public information about the company's website and how AI assistants present it. We collect this information from the company's website, professional networks (for example LinkedIn) and providers of business contact data.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in presenting our service to businesses; direct marketing, recital 47 GDPR).
Recipients: our service providers for email and for our contact management system (section 10).
How long:
- If you tell us you're not interested, we stop contacting you and keep only your email address and that note, so that we don't contact you again.
- Otherwise, we delete your details 12 months after our last contact.

You can object at any time (section 11).

9a. AI assistance with our business correspondence

We use Claude, an AI assistant, to read, sort and draft our business emails: emails to businesses we contact (section 9), replies we receive, and other correspondence (section 8). For this, we share the content of the email thread with Claude. That includes names, roles, email addresses, company details and the messages themselves. We share only what is needed to handle the correspondence. A person reads and approves every email before it is sent. We don't make decisions about you based solely on automated processing.

Recipient: Anthropic Ireland, Limited (Ireland), the provider of Claude. We use Claude under Anthropic's consumer terms. Under those terms, Anthropic processes the content as a controller in its own right, under its own privacy policy (anthropic.com/legal/privacy), not on our instructions. Anthropic may also process data in the USA.
No training: we have switched off the setting that allows Anthropic to use our chats to train its models.
Purpose: drafting and handling our business correspondence efficiently.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in handling our correspondence efficiently).
How long: with training switched off, Anthropic deletes the content after 30 days, except in the cases its privacy policy describes (for example safety reviews). Our own copies follow sections 8 and 9.

We don't use the AI assistant built into our contact management system for this correspondence.

10. Service providers and transfers outside the EU

We use these service providers. They process data only on our instructions (Art. 28 GDPR), except where this policy says otherwise.

Provider	What for
Vercel Inc., USA	hosting of asklane.io and of our contact management system, web analytics
Cloudflare, Inc., USA	our servers and database, the Asklane app, spam protection, server logs
Plus Five Five, Inc. (Resend), USA	sending emails (confirmation links, notifications). Emails are sent from Resend's EU region; Resend stores data in the USA.
Google Cloud EMEA Limited, Ireland (Google Workspace)	our email mailbox and its connection to our contact management system; Google may also process data in the USA
Supabase Pte. Ltd., Singapore	database of our contact management system (CRM) for business contacts (section 9). The data is stored in Frankfurt, Germany.
CyberPanda s. r. o. (Warmup Inbox), Slovakia	improving the delivery of our emails (email warm-up). The service connects to our mailbox and can therefore access emails in it.

Some of these providers process data in the USA. For the USA, the European Commission has adopted an adequacy decision for companies certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Vercel, Cloudflare, Resend and Google are certified. Their data processing terms also include the EU Standard Contractual Clauses (Art. 46 GDPR). Warmup Inbox is based in the EU. Where it uses sub-processors outside the EU, its data processing terms apply the EU Standard Contractual Clauses. Supabase stores our data in the EU, but it is based in Singapore, for which there is no adequacy decision. Any access from outside the EU is therefore covered by the EU Standard Contractual Clauses in its data processing terms. You can ask us for a copy of these safeguards.

11. Your rights

You have the right to:

access the personal data we hold about you (Art. 15 GDPR);
have it corrected (Art. 16) or deleted (Art. 17);
restrict its processing (Art. 18);
receive it in a portable format (Art. 20);
withdraw a consent at any time, with effect for the future (Art. 7(3)).

Your right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. We then stop, unless we can show compelling legitimate grounds, or the processing serves to establish, exercise or defend legal claims. You can object to the use of your data for direct marketing at any time, without giving reasons. We will then stop using it for that purpose.

To use your rights, email alex@asklane.io, ideally from the email address you used with us.

You also have the right to complain to a data protection supervisory authority. The authority responsible for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany, mailbox@datenschutz-berlin.de.

12. Do you have to give us your data?

No law requires you to. We need your email address to confirm and deliver an inquiry, to answer a form or an email, and to register you for the pilot. Without it, we can't provide these services. Everything else is optional.

13. No automated decisions

We don't make decisions about you based solely on automated processing, and we don't create profiles of you (Art. 22 GDPR).

14. Changes

We update this policy when our service or the law changes. The date at the top shows the current version.