Our role
For account administration, billing, security, support, and service analytics, VHUG Technologies OÜ is the controller. For project prompts, monitored subjects, and other customer content processed on a business customer’s instructions, the customer is generally the controller and we act as processor.
Data and purposes
We process business contact and account data to provide access; billing identity, tax status, orders, and invoices to perform the contract and meet legal duties; project profiles, prompts, AI responses, scores, and reports to provide measurements; and security, audit, support, and delivery logs to protect and operate the service.
Legal bases
Processing is based on performance of the B2B contract, compliance with legal obligations, and legitimate interests in service security, support, fraud prevention, and privacy-friendly product analytics. Where consent is legally required, it will be requested separately.
Subprocessors and recipients
VHUG Technologies operates the application, database, transactional email, backups, support infrastructure, and privacy-friendly Matomo analytics. Rented infrastructure is supplied by Hetzner Online GmbH in the EU; Hetzner is listed as an infrastructure subprocessor even though it does not routinely access application data. Stripe processes billing, payment, and tax data. Depending on project configuration, prompts and responses are sent to Anthropic, OpenAI, Google Gemini, Perplexity, and—only when deliberately enabled—DeepSeek. When a report translation is requested, its report content may be sent to DeepL SE, Maarweg 165, 50825 Cologne, Germany. Bunny CDN is not currently used and will be added to this notice before activation.
AI-provider handling
Anthropic commercial/API, OpenAI API, paid Google Gemini API, and Perplexity API terms state that customer API content is not used for model training by default. Provider security or abuse-retention periods can still apply. DeepSeek’s published terms allow collection and analysis of inputs and outputs to improve its service; DeepSeek is therefore excluded from the default platform selection and displays a warning before an owner enables it. Do not submit special-category, confidential, or unnecessary personal data in project content.
International transfers
Some AI and payment providers may process data outside the EEA. AskAgain uses the provider’s applicable contractual transfer safeguards, including EU Standard Contractual Clauses where required. See the data-processing page for the official EU texts.
Retention
Project cancellation offers immediate operational deletion or 60 days of read-only retention. Account results remain read-only for 90 days after package end. Billing, entitlement, ownership, impersonation, and administrator-setting audit events are retained for 10 years; authentication and security audit events for 3 years; and lower-value operational audit events for 2 years. Signup attempts are retained for 30 days, login attempts and email delivery records for 90 days, closed support cases for one year, and rolling hosting backups for 30 days. Billing and tax records are retained for the applicable statutory period.
Your rights
Depending on the processing, individuals may request access, correction, deletion, restriction, portability, or objection. Contact us first; you may also complain to the competent data-protection authority. Requests concerning customer-controlled project content may be referred to the business customer.