My AskAI

GDPR overview

GDPR implementation is unusually concrete for a company this size. My AskAI publishes a dedicated GDPR page, declares itself a data controller (and a processor when embedded in a customer's service), names a DPO reachable through chat, and lists every subprocessor with a link to its DPA. Data subject rights under Articles 12 to 23 are exercised by emailing team@myaskai.com and are answered within 30 days. Transfers to the United States rely on Standard Contractual Clauses and the EU-US Data Privacy Framework. A Data Processing Agreement is published and signed copies are available to paying customers; a DPIA is available on the Enterprise plan. The company is registered with the UK ICO under reference ZB608683. No Article 27 EU representative is named anywhere.

Who owns the data?

The customer keeps ownership of everything uploaded. My AskAI states that the content and data you upload are yours and yours alone, used for no purpose other than running your AI support agent and answering your own support queries. You also retain copyright over any output your agent produces from your proprietary content. Deleting an item in the interface deletes it from the servers. My AskAI acts as data controller for its own customers, and can become a data processor when a customer embeds it in their own service, for instance through the API. Data is never sold or passed to third parties for marketing purposes.

Reuse rights

Customers may reuse the answers and content their agent produces without asking permission: copyright in output generated from proprietary content stays with the customer, and uploaded material can be exported or deleted at will from the dashboard. On the vendor side the permitted uses are deliberately narrow. My AskAI says data is used only to run your agent and improve the product, never sold or shared with third parties for marketing, and never used to train OpenAI models. Uploaded files are deleted automatically once indexed unless you explicitly ask to keep them. The self-learning feature does reuse your resolved tickets and agent replies, but only to improve your own agent. Note the vendor's own caution: you are asked not to upload personal data to an AskAI.

Data retention & training

Hosting summary

Uploaded content is turned into vectors and stored encrypted on Qdrant, which runs on Google Cloud Platform in The Dalles, Oregon, in the United States (region us-west1). The older privacy policy still names Pinecone on the same GCP region, an inconsistency the vendor has not resolved. All data is encrypted at rest with AES-256 and in transit with TLS 1.2+, and each customer's uploaded content sits in isolated containers. Files are deleted automatically once they have been indexed into the agent, unless you explicitly ask to keep them. My AskAI says it processes personal data in the EU where it can, but eighteen named subprocessors are located in the United States, including OpenAI, Bubble, Cloudflare, Render, AWS, Stripe and Qdrant itself. Those transfers rely on Standard Contractual Clauses and the EU-US Data Privacy Framework, and each subprocessor is listed with a link to its own data processing agreement. No EU-only data residency option is documented.