Privacy policy

Data controller

Flukx Studio, publisher of askwell (see the legal notice). Contact: contact@askwell.dev.

Data we collect

When you join the waitlist:

• your work email address;
• the language of the page (French or English);
• the sign-up date.

When you create an account:

• your email and your password, stored hashed, never in plain text;
• your display name and interface language, if you set them;
• your forms, their settings and their images (banner, logo);
• the responses you receive, the follow-ups asked by AI and the summary cards it writes after each response;
• your webhooks (URL, secret) and their delivery log;
• the number of AI calls in the month, to enforce quotas;
• your use of the app, counted per day: the days you open it and how many times you use a few features (create, publish, generate, import, export, open the Design panel…), never the content of your forms or responses.

When you visit the askwell website (home and legal pages), cookieless audience measurement:

• the page viewed, its language and the type of device, inferred from the window width (mobile, tablet, desktop);
• the site you came from, reduced to its domain name, and the utm_source, utm_medium and utm_campaign parameters of the address;
• how far you scroll the page (25, 50, 75 or 100%), the main sections shown and clicks on the main buttons and links (menu, pricing, FAQ, Blob, waitlist);
• the fact that someone joined the waitlist, without the email address;
• a visitor identifier valid for a single day, to count each day's unique visitors (see below).

Nothing is stored on or read from your device: no cookie, no local storage. Each visit gets a random identifier, kept in memory and forgotten when the page is reloaded. To count the day's unique visitors, our server computes, for each page view, a hash (SHA-256) of your truncated IP address (last two bytes removed), your browser's signature (User-Agent) and our site's name, mixed with a salt: a secret value drawn at random each day. Only this hash is recorded, never the IP address or the User-Agent. The salt is erased the next day (it exists for about thirty hours at most): after that, no one, including us, can find the address behind a hash, and the same visitor gets a new one every day. So we can neither recognise you from one day to the next nor link your visit to another site or to a person; a visitor who came back on two different days is counted twice. A hashed IP fingerprint is also used, for one day at most, to cap the number of events per hour. If your browser sends Do Not Track or Global Privacy Control, nothing is measured.

When someone fills in an askwell form:

• their answers, processed on behalf of the form's owner (see below);
• a hashed fingerprint of their IP address, to limit abuse;
• an anonymous measure of the visit (opened, started, last question reached), with no cookie and no IP address.

When you report a form:

• the reason, your explanation and the form's address;
• your name and email, if you give them;
• a hashed fingerprint of your IP address, to limit abuse.

Like any website, our host keeps technical logs (IP address, browser, requested pages) to keep the service secure and running.

Purpose and legal basis

Waitlist: your email is only used to tell you when the alpha opens and to invite you. The legal basis is your consent, given when you sign up (Article 6(1)(a) GDPR).

Account: your data is used to provide the service you use. The legal basis is the performance of the contract (Article 6(1)(b) GDPR).

Reporting a form: your details are only used to review it and to answer you; the form's owner receives neither your name nor your email. The legal basis is our legitimate interest in fighting abuse of the service (Article 6(1)(f) GDPR).

Technical logs, IP fingerprints and the anonymous visit measure rely on our legitimate interest in securing the service and providing your forms' statistics (Article 6(1)(f) GDPR).

Website audience measurement and counting how the app is used rely on our legitimate interest in understanding how askwell is read and used, to improve it (Article 6(1)(f) GDPR). The audience measurement follows the French data protection authority (CNIL)'s conditions for consent exemption: it serves us alone and only measures the website's audience, produces anonymous statistics, is not combined with any other processing (neither the waitlist nor accounts), is shared with no one, does not follow you across other websites (our site's name is part of the identifier's calculation), does not recognise you from one day to the next (the identifier lives for one day, well under the 13 months allowed), and its retention is limited. You can object at any time by turning on Do Not Track or Global Privacy Control in your browser.

Retention

• waitlist: until askwell opens publicly, and at most 2 years after you sign up;
• account, forms, responses, follow-ups and summary cards: as long as the account exists. Deleting the account from the settings erases everything at once;
• form submission attempts (abuse control): 2 days;
• follow-ups started but never submitted: 24 hours;
• IP fingerprints: 2 days;
• anonymous visit measure: 13 months;
• website audience measurement: 13 months; salt of the visitor hash: erased the next day (about thirty hours at most); hashed IP fingerprint capping its events: 1 day;
• app usage counted per day: 13 months, erased at once with the account;
• webhook delivery log: 30 days;
• form reports: one year after they are handled.

You can ask for your data to be deleted at any time.

Recipients and processors

Your data is never sold or shared for advertising. It is processed by:

• Supabase, for the database, sign-in and image storage, in the European Union;
• Anthropic, for the AI model (Claude) that writes follow-ups, forms built from a description and summary cards. Anthropic receives the text each task needs: the form title, the labels of its questions, the relevant question and answer for a follow-up, the full response for a summary card, your description for a generated form. Anthropic is a US company: this data is processed outside the European Union, under the European Commission's standard contractual clauses;
• Cloudflare, for hosting the website and the app. Cloudflare is a US company: transfers are covered by the Data Privacy Framework and the European Commission's standard contractual clauses.

Cookies

No analytics, advertising or social media cookies: the website's audience measurement uses no cookie and no other storage on your device. Once you sign in, strictly necessary session cookies keep you signed in; they are exempt from consent. Public forms set none on respondents' devices.

“Ask Blob” downloads a small model that your browser may keep in its cache. It holds nothing about you, and your questions stay on your device.

Your rights

You have the right to access, rectify, erase, object, restrict and port your data, and you can withdraw your consent at any time. Write to us at contact@askwell.dev. You can also export your responses as CSV and delete your account yourself, from the app.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (cnil.fr) or your local data protection authority.

Forms built with askwell

Answers submitted through our customers' forms are processed on their behalf: the customer is the controller and Flukx Studio is the processor. See the summary of the data processing agreement (DPA).