Privacy policy

The short version: we only use the data we need to run Asklane. We deliver an inquiry only to the one vendor you chose, and only when you send it. We don't sell data, we don't use it for advertising, and we don't use it to train AI models. The website sets no cookies.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

Alexander Klimin, trading as Asklane Roedernstr. 6B 12623 Berlin Germany Email: alex@asklane.io Contact form: asklane.io/support

We have not appointed a data protection officer because the law does not require one for us. For all data protection questions, write to alex@asklane.io.

2. What this policy covers

• the website asklane.io, including its forms (section 3 and 4);
• the registration for the Asklane pilot for vendors (section 5);
• the Asklane app in ChatGPT and Claude (section 6);
• inquiry pages on asklane.io that AI assistants can pre-fill for you (section 7);
• the Asklane widget on vendor websites, and our pages for AI assistants at asklane.io/v/ (section 7a);
• emails you send us (section 8);
• businesses we contact about Asklane (section 9);
• AI assistance with our business correspondence (section 9a).

3. The website asklane.io

3.1 Hosting

Our website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you open a page, your browser sends technical data that Vercel's servers process to deliver the page and keep it secure: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. Vercel keeps these server logs only for a short time. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in delivering a secure, working website).

3.2 Web analytics without cookies

We use Vercel Web Analytics to count page views. It uses no cookies and stores nothing in your browser. It records which pages are viewed, the referring page, your browser, operating system and device type, and your country. Visitors are told apart only by a hash of the request, which is discarded after 24 hours. We only see totals, never individual visitors. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in knowing which pages are useful). You can object at any time (section 11).

3.3 Cookies and browser storage

The website sets no cookies. It stores only two things in your browser, and only because you asked for what they do (§ 25(2) no. 2 TDDDG):

• Free-audit window. When you close the free-audit window or send the free-audit form, your browser stores the time you did so (in local storage), so the window doesn't open again for 14 days. The note contains nothing else and never leaves your browser.
• Pilot sign-up in progress. While you fill in the pilot sign-up (section 5), your browser keeps your answers so far, the step you're on and the website you typed (in session storage). That way a reload, or a look at the terms in another tab, doesn't lose your progress. It's deleted when you send the sign-up, and in any case when you close the tab.

You can delete both at any time in your browser settings.

Fonts and images are delivered from our own website. We don't embed content from other providers.

3.4 Spam protection on forms (Cloudflare Turnstile)

Our forms and the page that confirms a pilot registration use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile only loads when a form or that page is shown. It checks that a person, not a bot, is sending the form or opening the confirmation link. When the check passes, the confirmation page confirms your registration by itself; otherwise you confirm with a button. To do this, it processes technical signals such as your IP address, browser information and the address of the website. It uses no cookies. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in protecting our forms from spam and misuse). Cloudflare also uses these signals, as a controller in its own right, to improve Turnstile's bot detection. Details are in Cloudflare's Turnstile Privacy Addendum at cloudflare.com/turnstile-privacy-policy.

4. Forms: free audit and contact

When you send one of these forms (the free audit, or the contact form on our support page), we receive what you enter: your email address, your website, and anything you add (for example a message, your name or the plan you're interested in). We also record the page you sent the form from, the page you came from, and your country, which is derived from your IP address. We don't store your IP address with the form.

• Purpose: to reply to you and, for the free audit, to prepare and send your audit.
• Legal basis: Art. 6(1)(b) GDPR (steps you asked for before a possible contract), and Art. 6(1)(f) GDPR (our legitimate interest in answering business inquiries).
• Where it goes: the form is stored in our database with Cloudflare (Cloudflare D1). We receive an email notification, which is sent by Resend and delivered to our mailbox with Google Workspace (section 10).
• How long: we delete a form 12 months after you sent it, unless it led to a pilot agreement or another contract. In that case, section 5 applies.

5. Pilot registration for vendors

5.1 Registration and proof of agreement

When you register your company for the Asklane pilot, we process:

• your name, your role, your work email address;
• your company's name, website and, if you give it, country;
• your answers to our short questions about your company: your role, what your company sells, whether it gets visitors from AI assistants, whether it works on visibility in AI answers (GEO), how inquiries reach it today, and the package we suggest from your answers;
• the plan you choose (Starter or Pro) and its prices;
• your confirmations (that you accept the Pilot Terms, and that you are allowed to sign up your company);
• the version of the Pilot Terms you accepted and its fingerprint (hash);
• the time of your registration and of your email confirmation, and how you confirmed (automatically when you opened the link, or with the button);
• your IP address and your browser's user agent at both steps;
• the emails we sent you (confirmation link, copy of the terms).

Purposes and legal basis:

• To conclude and carry out the pilot agreement: Art. 6(1)(b) GDPR.
• To set up your pilot, prepare your profile and pages, and alert us internally about your registration, we use your answers to our questions: Art. 6(1)(b) GDPR.
• To be able to prove who agreed to which terms and when: Art. 6(1)(f) GDPR. Our legitimate interest is in proving the agreement and defending legal claims.

How long:

• If you don't confirm your email address, we delete the registration, including IP address and user agent, after 7 days.
• If you confirm, we keep the record while the pilot runs and afterwards until the end of the third calendar year after the pilot ends. This matches the regular limitation period under §§ 195 and 199 BGB.

5.2 Your vendor profile

To prepare your profile, we may use information from your company's public website. That is mostly business information; it may include the names and roles of people shown there. We also process the contact details of the people who manage your pilot and receive your inquiries. Your profile stays private until you have approved it.

• Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for preparing the draft profile (our legitimate interest in offering you a ready-made profile to review).
• How long: we delete the profile after the pilot ends.

We name your company outside your listing (for example as a founding partner) only with your consent (Art. 6(1)(a) GDPR). You can withdraw that consent at any time with effect for the future.

5.3 Paid plans and invoices

After the 30-day pilot, your paid plan starts unless you cancel (Pilot Terms, section 10). For this, we process:

• your plan and its prices;

• the dates of each step;

• the reminders and confirmations we email you, and any cancellation;

• your company's billing details (name, address, VAT ID if you have one);

• your invoices and payments.

• Legal basis: Art. 6(1)(b) GDPR (carrying out the agreement); for keeping invoices and payment records, Art. 6(1)(c) GDPR (our duties under tax and commercial law).

• How long: for as long as the agreement runs and the proof periods in section 5.1 apply. Invoices and payment records are kept for as long as tax and commercial law require.

5.4 Statistics about the sign-up page

To see where people stop during the pilot sign-up and to improve the page, we record each step of a visit:

• what happened (for example "question 2 answered", "form shown", "plan selected", "send clicked", "security check failed", "registration sent");
• the answer you chose at that step, as a short code (for example "founder"), and the plan you selected;
• the page, the time, and your country, which is derived from your IP address. We don't store the IP address.

A random visit number ties the steps of one visit together. It exists only while the page is open, is never stored in your browser, and is new on every visit. We don't record your name, email address, IP address or browser details here, and we use no cookies.

• Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a sign-up page that works and is easy to complete).
• How long: 12 months.
• Right to object: you can object at any time (section 11).

6. The Asklane app in ChatGPT and Claude

6.1 Connecting Asklane

You use ChatGPT or Claude under the terms and privacy policy of OpenAI or Anthropic. They process your conversation, not us. ChatGPT and Claude ask for your permission before they connect Asklane. When they call Asklane, they send us the information the call needs. Depending on the platform, this can include technical details such as your language setting or approximate location. We only use what we receive in these calls, and only for the purposes below. We have no access to your chat history.

6.2 Questions about a vendor

If you ask about a participating vendor, your assistant sends us the question, and we answer from information the vendor has approved. We don't store these questions with your identity.

6.3 Sending an inquiry

Before anything is sent, your assistant shows you the inquiry and asks for your OK. The inquiry is a summary your assistant prepares from your conversation. It can contain:

• your email address (required, for the confirmation link and the vendor's reply);
• the vendor you chose;
• if you give them: your company name and website, team size, what you need, who you sell to, your current setup, your timeline and your open questions;
• your choice whether the vendor may see your contact details straight away.

Please don't include sensitive data (for example health data) or payment details.

We then email you a confirmation link. Your inquiry is only delivered to the vendor after you click it. If you chose to keep your contact details private for now, the vendor receives your inquiry without your name and email address until you decide to share them.

Purposes and legal basis:

• Preparing, confirming and delivering your inquiry, and telling you its status: Art. 6(1)(b) GDPR (the service you asked us for).
• Checking your email address, to stop spam and misuse of other people's addresses: Art. 6(1)(f) GDPR (our and the vendors' legitimate interest in genuine inquiries).

Recipients: the one vendor you chose, after you have confirmed. From delivery onwards, the vendor is responsible for its own copy. We also use the service providers in section 10.

How long:

• Unconfirmed inquiries are deleted after 7 days.
• Confirmed inquiries are deleted 12 months after delivery. We keep them so that we can pass on replies and answer questions about them.

6.4 Server logs

Our servers run on Cloudflare. They write short technical logs (for example the time of a request, errors, and in some cases the IP address) to keep the service working and secure. These logs are deleted automatically after 3 to 7 days, depending on our plan. Legal basis: Art. 6(1)(f) GDPR (a secure, working service).

7. Inquiry pages on asklane.io

Each participating vendor has an inquiry page on our website at asklane.io/to/[vendor]. Your AI assistant (for example ChatGPT) can give you a link to this page with your inquiry already filled in. You check the inquiry, change or remove anything you like, and click Send. The inquiry then goes to that one vendor.

7.1 When you open the page

The pre-filled details are in the part of the link after the "#". Your browser does not send this part to any server when the page loads. The details only leave your browser when you click Send.

When the page loads, we record a page view with:

• the vendor;
• which fields were pre-filled (only the names of the fields, never what is in them);
• the campaign code in the link (for example "chatgpt.com") and the website you came from (only its address, for example chatgpt.com, not the full page);
• your country, which is derived from your IP address. We don't store your IP address;
• if the link came from the Asklane widget, the widget code (section 7a.2). We also store it with your inquiry if you send one.

The page sets no cookies and stores nothing in your browser. Our general website hosting and analytics (section 3) and our spam protection (section 3.4) also apply to this page.

7.2 When you click Send

We receive and store what the form contains when you click Send:

• your name and email address;
• your company;
• what you need;
• your budget and timing, and the summary of your AI chat, unless you ticked "Leave this out". If you tick it, these details are neither sent nor stored.

Please don't include sensitive data (for example health data) or payment details.

We also store how the form was used: which pre-filled fields you changed, how long it took until you clicked Send, the reason if a send was rejected (for example a missing email address), and whether the email to the vendor was delivered. With your inquiry we also store your country and where you came from (the campaign code in the link and the website you came from, as in section 7.1). We don't store your IP address.

7.3 Delivery to the vendor

Right after you click Send, we email your inquiry to that one vendor. The email comes from "[your name] via Asklane" and is set up so that the vendor's reply goes straight to your email address. Besides what you sent (section 7.2), the email tells the vendor:

• your country, which is derived from your IP address (we don't store or pass on the IP address);
• where you came from, for example "ChatGPT", based on the link your AI assistant gave you;
• that Asklane doesn't verify the sender's name or email address.

We don't check your email address before delivery, so please enter one you use. From delivery onwards, the vendor is responsible for its own copy, under its own privacy policy.

7.4 Purposes and legal basis

• Delivering your inquiry to the vendor you chose: Art. 6(1)(b) GDPR (the service you ask us for when you click Send).
• Page views and how the form was used, to see whether the page works and to improve it: Art. 6(1)(f) GDPR (our legitimate interest in a working, easy-to-use inquiry page). These records contain no field contents and no IP address.
• Protecting the page against spam and misuse: Art. 6(1)(f) GDPR.

7.5 How long we keep it

• Your inquiry (name, email address and everything you sent) is deleted 90 days after delivery. We keep it so that we can deal with delivery problems and questions about the inquiry. The vendor replies to you directly, so we don't need it for longer.
• The records of how the form was used and whether the email was delivered are kept for 12 months, without your name, email address or the content of your inquiry.
• Page views are kept for 12 months.

7a. The Asklane widget on vendor websites, and our pages for AI assistants

7a.1 What the widget does

Some vendors add the Asklane widget to their website. When you visit such a website, your browser loads the widget from asklane.io together with the vendor's widget settings. The widget checks, inside your browser, whether you came from an AI assistant (ChatGPT, Claude, Perplexity, Gemini or Copilot). It does this by looking at the link you arrived with and the page you came from. Only if you did, it shows you a short message with a line you can copy back into your chat. This check happens in your browser: the widget doesn't send us the result unless the conditions in 7a.2 are met. The widget sets no cookies, stores nothing in your browser, and doesn't read the content of the vendor's page or anything you type there. When you click the copy button, the line is copied to your clipboard because you asked for it.

7a.2 What we receive

• Loading the widget. To deliver the widget, our server necessarily receives your IP address and the address of the vendor's website. We use your IP address only in passing, for protection against misuse: we turn it into a code that is changed every day (a hash) and delete that code after 24 hours. We don't store your IP address. We count how often the widget is loaded for each vendor.
• Widget statistics. The widget can also send us events: that it was loaded, which AI assistant you came from, that the message was shown, copied or closed, the vendor, and the path of the page (for example /pricing). These events contain no IP address and no content from the page. They carry a random code that the widget creates anew for each page view and never stores in your browser. The same code is part of the line you copy. If you paste the line into your chat and later open the vendor's page for AI assistants or its inquiry page on asklane.io, we can see that the widget led there. If you then send an inquiry, the code links these events to your inquiry (section 7). Where the law requires consent for this, in particular for visitors in the EU, the European Economic Area, the United Kingdom and Switzerland, the widget sends these events only if you have agreed in the vendor's consent tool. Otherwise it sends none.

7a.3 Who is responsible

For loading the widget and sending the data to us, the vendor and we are joint controllers (Art. 26 GDPR): the vendor decides to add the widget to its website, and we provide it. The vendor informs you about the widget in its own privacy policy and, where needed, asks for your consent. We are responsible for everything that happens with the data after it reaches us, and we handle all requests about it. You can use your rights (section 11) with us or with the vendor.

7a.4 Purposes, legal basis, retention

• Showing you the widget, and protecting it against misuse: Art. 6(1)(f) GDPR. Our and the vendor's legitimate interest is in helping visitors who come from an AI assistant to reach the vendor, and in a secure service.
• Widget statistics, to show the vendor how the widget performs and to improve it: your consent where the law requires it (§ 25(1) TDDDG and Art. 6(1)(a) GDPR), otherwise Art. 6(1)(f) GDPR. You can withdraw your consent at any time in the vendor's consent tool, with effect for the future.
• Copying the line to your clipboard: § 25(2) no. 2 TDDDG (you asked for it).
• How long: the daily codes used for misuse protection are deleted after 24 hours. Widget events and load counts are kept for 12 months. Once your inquiry has been deleted (section 7.5), the random code no longer links the events to you.

7a.5 Our pages for AI assistants (asklane.io/v/)

For each participating vendor, we publish a page at asklane.io/v/[vendor] with facts the vendor approved and instructions for AI assistants on how to prepare an inquiry. These are ordinary pages of our website, so section 3 applies to them. When one of these pages is opened, we record the type of AI assistant or browser that fetched it (for example "ChatGPT-User", derived from the browser identification, which we don't store in full), the time, the page, and, if the link came from the widget, the widget code described in 7a.2. We don't store the IP address. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in knowing whether AI assistants use these pages).

8. Emails to us

When you email us (for example at alex@asklane.io), we process your email address, your message and any details you include, in order to reply.

• Legal basis: Art. 6(1)(b) GDPR where your email concerns a contract or a request for one, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering messages).
• Where it's kept: our mailbox is hosted by Google Workspace (section 10).
• AI assistance: we use an AI assistant to read, sort and draft our business correspondence (section 9a).
• How long: we delete emails when they are no longer needed for your request and any follow-up, unless tax or commercial law requires us to keep them for longer.

9. Businesses we contact

We contact businesses that we think could benefit from Asklane, usually by email. To do this, we process business contact details: name, role, business email address and company, and public information about the company's website and how AI assistants present it. We collect this information from the company's website, professional networks (for example LinkedIn) and providers of business contact data.

• Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in presenting our service to businesses; direct marketing, recital 47 GDPR).
• Recipients: our service providers for email and for our contact management system (section 10).
• How long:
  • If you tell us you're not interested, we stop contacting you and keep only your email address and that note, so that we don't contact you again.
  • Otherwise, we delete your details 12 months after our last contact.

You can object at any time (section 11).

9a. AI assistance with our business correspondence

We use Claude, an AI assistant, to read, sort and draft our business emails: emails to businesses we contact (section 9), replies we receive, and other correspondence (section 8). For this, we share the content of the email thread with Claude. That includes names, roles, email addresses, company details and the messages themselves. We share only what is needed to handle the correspondence. A person reads and approves every email before it is sent. We don't make decisions about you based solely on automated processing.

• Recipient: Anthropic Ireland, Limited (Ireland), the provider of Claude. We use Claude under Anthropic's consumer terms. Under those terms, Anthropic processes the content as a controller in its own right, under its own privacy policy (anthropic.com/legal/privacy), not on our instructions. Anthropic may also process data in the USA.
• No training: we have switched off the setting that allows Anthropic to use our chats to train its models.
• Purpose: drafting and handling our business correspondence efficiently.
• Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in handling our correspondence efficiently).
• How long: with training switched off, Anthropic deletes the content after 30 days, except in the cases its privacy policy describes (for example safety reviews). Our own copies follow sections 8 and 9.

We don't use the AI assistant built into our contact management system for this correspondence.

10. Service providers and transfers outside the EU

We use these service providers. They process data only on our instructions (Art. 28 GDPR), except where this policy says otherwise.

Provider	What for
Vercel Inc., USA	hosting of asklane.io and of our contact management system, web analytics
Cloudflare, Inc., USA	our servers and database, the Asklane app, spam protection, server logs
Plus Five Five, Inc. (Resend), USA	sending emails (inquiries to vendors, confirmation links, notifications). Emails are sent from Resend's EU region; Resend stores data in the USA.
Google Cloud EMEA Limited, Ireland (Google Workspace)	our email mailbox and its connection to our contact management system; Google may also process data in the USA
Supabase Pte. Ltd., Singapore	database of our contact management system (CRM) for business contacts (section 9). The data is stored in Frankfurt, Germany.
CyberPanda s. r. o. (Warmup Inbox), Slovakia	improving the delivery of our emails (email warm-up). The service connects to our mailbox and can therefore access emails in it.

Some of these providers process data in the USA. For the USA, the European Commission has adopted an adequacy decision for companies certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Vercel, Cloudflare, Resend and Google are certified. Their data processing terms also include the EU Standard Contractual Clauses (Art. 46 GDPR). Warmup Inbox is based in the EU. Where it uses sub-processors outside the EU, its data processing terms apply the EU Standard Contractual Clauses. Supabase stores our data in the EU, but it is based in Singapore, for which there is no adequacy decision. Any access from outside the EU is therefore covered by the EU Standard Contractual Clauses in its data processing terms. You can ask us for a copy of these safeguards.

11. Your rights

You have the right to:

• access the personal data we hold about you (Art. 15 GDPR);
• have it corrected (Art. 16) or deleted (Art. 17);
• restrict its processing (Art. 18);
• receive it in a portable format (Art. 20);
• withdraw a consent at any time, with effect for the future (Art. 7(3)).

Your right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. We then stop, unless we can show compelling legitimate grounds, or the processing serves to establish, exercise or defend legal claims. You can object to the use of your data for direct marketing at any time, without giving reasons. We will then stop using it for that purpose.

To use your rights, email alex@asklane.io, ideally from the email address you used with us.

You also have the right to complain to a data protection supervisory authority. The authority responsible for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany, mailbox@datenschutz-berlin.de.

12. Do you have to give us your data?

No law requires you to. We need your email address to deliver an inquiry (so the vendor can reply to you), to answer a form or an email, and to register you for the pilot. Without it, we can't provide these services. Everything else is optional.

13. No automated decisions

We don't make decisions about you based solely on automated processing, and we don't create profiles of you (Art. 22 GDPR).

14. Changes

We update this policy when our service or the law changes. The date at the top shows the current version.