Privacy Policy

Who is responsible for your data

Advancer Limited, a company incorporated in New Zealand is the agency (under the New Zealand Privacy Act 2020) and the controller (under the UK and EU GDPR) for personal information handled through Askance, except where we act as a processor on your behalf — see the Data Processing Addendum.

Contact us about privacy at privacy@askance.app.

Both regimes apply to us. The New Zealand Privacy Act 2020 applies because we are a New Zealand agency. The GDPR applies because we knowingly offer the service to people in the EU and UK.

What Questions may contain — read this one

The most sensitive thing in Askance is not your email address. It is the content of a Question.

Questions are written by AI coding agents working on your codebase. They routinely contain source code, configuration, internal business rules, pricing logic, customer scenarios and commercial detail. Attachments may contain more. You should assume a Question contains whatever your agent thought was relevant context.

Because of that, three commitments govern this content specifically:

• It is encrypted in transit and at rest.
• It is visible only to the members of the project it belongs to — not to other customers, and not to our staff in the ordinary course. Access by our people happens only where you ask us for support, or where we must investigate abuse or a security incident, and it is logged.
• Question and Answer bodies are never written to our application logs. This is enforced in the code, not merely promised in this policy.

Please do not put credentials, API keys or secrets into a Question. They would be shared with every member of that project and retained in the record. See the Acceptable Use Policy.

What we collect

• Account information: your email address, display name, and the identity provider you signed in with (Microsoft, Google or GitHub) or a password we store only as a salted hash.
• Project content: Questions, Answers, Directions, Corrections, comments, attachments and the extracted text we index for search.
• Invited-expert email addresses. When you invite someone, we hold their email address before they have an account, so we can recognise them when they accept. If they never accept, that invitation and address are deleted with the project or on request.
• Usage records: which project, which user and when, for events such as a Question being asked, an Answer given, or a search performed. We use these to operate the service, to measure your plan usage, and to understand what is working. They do not contain Question or Answer text.
• An audit trail of security-relevant actions, kept append-only.
• Billing information if you are on a paid plan — handled by Stripe. We never see or store your full card number.

Why we are allowed to hold it

Under the GDPR our lawful bases are: performance of a contract (running your account and the service), legitimate interests (keeping the service secure, preventing abuse, and understanding usage — balanced against your interests), and legal obligation (tax and accounting records).

Under the New Zealand Privacy Act we collect this information directly from you or from the person who invited you, for the purposes described here, in line with the information privacy principles.

Where your data lives

Askance runs on Microsoft Azure in the Sweden Central region. Your project content, including Questions and Answers, is stored and processed in the European Economic Area.

We are a New Zealand company, and some administration of the service happens from New Zealand. New Zealand holds an adequacy decision from the European Commission, so personal data may move between the EEA and New Zealand without additional safeguards.

Who else touches it

We use a small number of suppliers to run the service. Each is bound by contract to handle your data only on our instructions. The current list, and how we notify you of changes, is in the Data Processing Addendum.

We do not sell your data, we do not share it with advertisers, and we do not use it for advertising.

What we will not do

We do not train machine-learning models on your content, and we do not permit our suppliers to. If we ever offer AI-generated Answers, the supplier providing that will be named as a sub-processor before any of your content reaches it, and using it will be your choice.

How long we keep it

Project content is kept while the project exists, because a permanent searchable record is what the product is for. Deleting a project deletes its content.

On account closure we keep your data for 30 days so an accidental closure can be reversed, then delete it — except records we must retain for tax or legal reasons, and the append-only audit trail, which is retained for security purposes.

Your rights

You can ask us to give you a copy of your personal information, correct it, delete it, or restrict or object to how we use it. In the EU/UK you also have the right to data portability and to complain to your supervisory authority. In New Zealand you may complain to the Office of the Privacy Commissioner.

You can export a project's record yourself at any time from within the app.

To make a request, email privacy@askance.app. We will respond within 20 working days (New Zealand) or one month (GDPR).

One limit worth stating plainly: if you are an expert who answered a Question, you can ask us to remove your personal information, but the Answer itself stays with the project it was given to. See the Terms of Service for why.

Cookies

Askance uses cookies and browser storage only to keep you signed in and to keep your session secure. These are strictly necessary for the service to work, so no consent banner is required, and we do not show one.

We do not use advertising cookies, tracking pixels, or third-party analytics that identify you. If that ever changes, we will ask for consent first.

Security incidents

If a breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Privacy Commissioner as required by the Privacy Act 2020, and any applicable EU/UK supervisory authority, without undue delay.

Changes

We will post any change here and update the version and date at the top. If a change materially affects how we handle your information, we will email the account owner before it takes effect.