Privacy Policy

This Privacy Policy explains how Christian Becker ("Askbar", "we", "us") collects, processes, and protects your personal data when you use the Askbar desktop application and the website askbarapp.com. It applies in accordance with the EU General Data Protection Regulation (GDPR / DSGVO) and the German Federal Data Protection Act (BDSG).

1. Data Controller

2. Data We Collect and Why

2.1 Account data

When you sign in with Google OAuth, we receive your name, email address, and Google profile ID. This is used solely to identify your account and link your license. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

2.2 License and subscription data

When you purchase a plan, Paddle (our payment processor) handles all payment transactions and shares your email address and subscription status with us. We store this in our Supabase database to verify your license. We never see or store your card number. Legal basis: Art. 6(1)(b) GDPR.

2.3 Usage data (SaaS plans only)

For Base and Pro subscribers, AI requests are proxied through our Vercel Edge Functions to inject the API key and track usage against your plan's limits. We record the amount of usage per request — not the content of your prompts or responses. Usage figures are stored in Supabase for limit enforcement and reset monthly. Legal basis: Art. 6(1)(b) GDPR.

2.4 BYOK users

If you use the BYOK (Bring Your Own Key) plan, your API keys are stored locally on your device only, inside the Windows Credential Store or app storage. They are never transmitted to our servers. AI requests go directly from your device to your chosen provider. We receive no data about your usage.

2.5 Analytics

We use Plausible Analytics (plausible.io) for website visitor statistics. Plausible is a privacy-first analytics tool: it sets no cookies, collects no personal identifiers, and is GDPR-compliant by design. Only aggregate page-view counts and referrers are recorded. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding website traffic).

3. AI Providers and Data Processing

Askbar connects to third-party AI providers to process your prompts. Depending on your plan and configuration:

• BYOK users:requests go directly from your device to the provider you configured (Groq, OpenAI, Gemini, DeepSeek, Anthropic, or OpenRouter). Your data is subject to that provider's privacy policy.
• Base / Pro users:requests are routed through our Vercel Edge Function, which injects the API key and forwards your prompt to OpenAI. The Edge Function does not log or store prompt content. Your data is subject to OpenAI's privacy policy (openai.com/privacy).

We recommend reviewing the privacy policy of your chosen AI provider. We have no control over how those providers handle data once it is transmitted to them.

4. Third-Party Services

• Supabase (supabase.com) — Database and authentication. Hosted in Frankfurt, EU (eu-central-1). Supabase is a GDPR-compliant processor. Data: account records, license data, usage counts.
• Paddle (paddle.com) — Payment processing. Acts as Merchant of Record; collects payment and billing data under their own privacy policy. We receive only subscription status and email.
• Vercel (vercel.com) — Hosting and edge functions. May process request metadata (IP, headers) in transit. Vercel is GDPR-compliant.
• Google OAuth — Sign-in provider. Google may process data per their privacy policy (policies.google.com/privacy).
• Plausible Analytics — Cookie-free, no personal data collected. Hosted in the EU.

Cookies and Local Storage

This website uses only technically necessary cookies and local storage. No consent is required under §25 TTDSG.

4a. User Account and Authentication

• When creating an account and signing in via Google OAuth, we collect: email address, name, and profile picture.
• Legal basis: Art. 6(1)(b) GDPR (performance of contract).
• Data processor: Supabase Inc. (data stored on servers in Frankfurt, EU). Supabase privacy: https://supabase.com/privacy
• Identity provider: Google LLC, USA. Data transfer is based on EU Standard Contractual Clauses. Google privacy: https://policies.google.com/privacy
• Data is stored until account deletion.
• To delete your account: contact@askbarapp.com

The transfer of personal data to Google LLC (USA) is based on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

4b. Paddle as Merchant of Record

All purchases of Askbar are processed by Paddle.com Market Ltd("Paddle"), who acts as the Merchant of Record for our products. This means your contractual payment relationship is with Paddle, not directly with Christian Becker. Paddle is responsible for collecting payment, issuing invoices, handling chargebacks, and remitting taxes in the applicable jurisdictions.

When you make a purchase, Paddle collects and processes the following data under their own privacy policy and as an independent data controller: your name, email address, billing address, payment method details, and transaction history. We receive from Paddle only what is necessary to provision your license: your email address and subscription status.

Paddle's privacy policy governs how Paddle handles your payment data: www.paddle.com/legal/privacy. Paddle's terms of service apply to your purchase transaction: www.paddle.com/legal/terms.

4c. Data Processing Agreements

We have Data Processing Agreements (DPA) in place with all service providers that process personal data on our behalf as data processors under Art. 28 GDPR:

• Supabase — DPA available at supabase.com/privacy. Data processed: account records, license data, usage counts. Location: Frankfurt, EU (eu-central-1).
• Vercel — DPA available at vercel.com/legal/dpa. Data processed: request metadata in transit (IP addresses, headers). Location: Multiple regions (edge functions may run globally).

Paddle acts as an independent data controller for payment data, not as our data processor — no DPA applies to that relationship. Google OAuth also acts as an independent controller for authentication data.

5. Local Data Storage

The Askbar desktop application stores the following data locally on your device:

• Conversation history (SQLite database in your app data folder)
• API keys for BYOK users (Windows Credential Store or local app storage)
• Application preferences and settings
• Voice transcription model file (~150 MB, downloaded once to app data)

This data never leaves your device except as part of explicit AI requests you initiate. You can delete it at any time by uninstalling the application.

6. Data Retention

Account and license records are retained for as long as your account exists and for up to 3 years after account deletion for legal and tax compliance reasons. Usage records are retained for 13 months. You may request earlier deletion at any time (see Section 7).

7. Your Rights (GDPR Art. 15–22)

You have the right to:

• Access — request a copy of all personal data we hold about you (Art. 15)
• Rectification — correct inaccurate data (Art. 16)
• Erasure — request deletion of your account and data ("right to be forgotten", Art. 17)
• Portability — receive your data in a machine-readable format (Art. 20)
• Objection — object to processing based on legitimate interests (Art. 21)
• Restriction — request restriction of processing in certain circumstances (Art. 18)
• Withdraw consent — where processing is based on consent, withdraw it at any time with future effect (Art. 7(3))

To exercise any of these rights, email contact@askbarapp.com. We will respond within 30 days. You also have the right to lodge a complaint with your national supervisory authority. In Germany: Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (LfDI RLP).

8. Security

We apply standard security measures including TLS encryption in transit, access controls on our Supabase database (Row Level Security enabled), and minimal data collection. No system is 100% secure; we cannot guarantee absolute security of data transmitted over the internet.

9. Children

Askbar is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

10. Is Provision of Data Required?

The provision of account and payment-related data is necessary to enter into and perform the contract for a paid plan. Without it, we cannot provide the managed (Base/Pro) service or verify your license. For BYOK users, no account data is required to use the application with your own key.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be announced via email to registered users and noted on this page with a revised date. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Contact

Questions about this privacy policy or data subject requests: contact@askbarapp.com