Privacy Policy

---

Introduction

Simply Asking LLC ("Simply Asking," "we," "us," "our," or "the Service") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, disclose, and safeguard your information when you use our knowledge management and AI-powered assistant service.

Please read this privacy policy carefully. By using Simply Asking, you agree to the collection and use of information in accordance with this policy.

---

1. Information We Collect

1.1 Information You Provide

1.2 Information Collected Automatically

1.3 Information from Third-Party Integrations

When you connect third-party services (Google Drive, Notion, Dropbox, Trello, Slack, HubSpot CRM), we collect:

• OAuth tokens (encrypted) to maintain your connection
• Data you explicitly choose to import (documents, cards, etc.)
• Basic profile information from the connected service

We only access data you explicitly authorize and import.

---

2. How We Use Your Information

2.1 Service Provision

• Provide, maintain, and improve the Service
• Process your documents and generate AI-powered responses
• Manage your account and subscriptions
• Enable collaboration within your organization

2.2 Communication

• Send service-related notifications (security alerts, updates)
• Respond to your inquiries and support requests
• Send product updates and feature announcements (with opt-out)

2.3 Security & Compliance

• Detect, prevent, and address fraud and abuse
• Monitor for security threats
• Comply with legal obligations

2.4 Analytics & Improvement

• Understand how users interact with the Service
• Identify areas for improvement
• Develop new features

---

3. AI Processing & Your Content

3.1 How AI Processes Your Data

When you use Lumen (our AI assistant):

• Your questions and relevant document excerpts are sent to AI providers
• AI generates responses based on your content
• No customer data is used to train AI models

3.2 AI Providers & Data Handling

3.3 Document Embeddings

We create mathematical representations (embeddings) of your documents to enable semantic search. These embeddings:

• Are stored in our database (not with AI providers)
• Cannot be reverse-engineered to reconstruct your documents
• Are deleted when you delete the associated document

---

4. Information Sharing & Disclosure

4.1 We Do NOT Sell Your Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4.2 Service Providers (Sub-processors)

We share data with trusted service providers who assist in operating our Service. Examples include Supabase (database and authentication), Vercel (application hosting), Stripe (payment processing), Sentry (error monitoring), and our AI providers.

The complete, authoritative list is the Subprocessor Registry, which names every subprocessor with its purpose, the data it processes, its location, and its certifications. That registry is the list our Data Processing Agreement commits us to keep current, with 30 days advance notice of changes. This section is deliberately a pointer rather than a second copy, so the two can never disagree.

All sub-processors are bound by data processing agreements.

4.3 Legal Requirements

We may disclose your information if required by law, such as:

• Responding to valid legal processes (subpoenas, court orders)
• Protecting our rights, privacy, safety, or property
• Preventing fraud or security threats

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your data becomes subject to a different privacy policy.

---

5. Data Retention

5.1 Retention Periods

Retention windows are set by the Data Retention Policy, which is the source of truth for every period below.

5.2 Deletion Process

When you delete data:

1. Soft Delete: Data marked as deleted, inaccessible to users
2. Hard Delete: Data permanently removed within 30 days
3. Backup Removal: Removed as backups naturally expire (up to 90 days)

---

6. Your Rights & Choices

6.1 Your Data Rights

Depending on your location, you may have the right to:

6.2 Exercising Your Rights

To exercise any of these rights:

• Self-Service: Most actions available in Account Center > Data Management
• Email: legal@simplyasking.io
• Response Time: Within 30 days of verified request

6.3 Account Deletion

You can delete your account at any time:

1. Go to Settings > Account > Delete Account
2. Confirm deletion via email
3. All personal data deleted within 30 days

---

7. Cookies & Tracking

7.1 Cookies We Use

We do not currently use analytics cookies. Application monitoring is handled server-side without browser-side analytics cookies. See the Cookie Policy for the full inventory.

7.2 Cookie Management

• Browser Settings: You can configure your browser to block cookies
• In-App Settings: Manage preferences in Account Center > Data Management
• Impact: Some features may not work without essential cookies

7.3 Do Not Track

We respect Do Not Track (DNT) browser signals. When DNT is enabled, we limit analytics collection.

---

8. Data Security

We implement comprehensive security measures to protect your data:

• Encryption: All data encrypted at rest (AES-256) and in transit (TLS 1.3)
• Access Controls: Role-based access with 480+ Row-Level Security policies enforcing tenant isolation
• File Validation: Uploaded files are validated for type and size before processing. Executable files disguised as documents are blocked.
• Content Security Policy: CSP headers are configured to restrict unauthorized script sources.
• Self-Hosted Fonts: All fonts are served from our own infrastructure; no external font CDN requests are made
• Monitoring: Security monitoring via Sentry (error tracking) and infrastructure provider tools
• Auditing: Security assessments including Google CASA Tier 2 (certified) and OWASP ASVS Level 1

For full details, see our Security Policy.

---

9. Browser Extension

The Simply Asking browser extension extends our service into your browser. It runs only on tabs and contexts where it is actively used (the side panel and the Gmail compose toolbar) and does not monitor your general browsing.

9.1 What the Extension Stores Locally

The extension stores no personal data of yours that we do not already store on our servers. Local storage is scoped to the extension and is not accessible to websites you visit.

9.2 What the Extension Reads

The extension does NOT read the body of your emails, your inbox, your contacts, or any Gmail data beyond the compose toolbar's structure. It does NOT read content from any other website.

9.3 What the Extension Sends to Simply Asking Servers

The extension calls the same Simply Asking APIs that the web app uses, with your authenticated credentials. Specifically:

• Search queries you type into the Search tab
• Questions you ask in the Ask tab
• Files and content you save via the Add tab
• Messages you send via the Chat tab
• File requests when you attach a knowledge file to an email
• Anonymized error reports (no PII) when the extension encounters an unexpected error, so we can detect breakages and ship a fix

We do not log additional data from the extension beyond what the web app already logs.

9.4 What We Do NOT Do With Extension Data

• We do NOT sell your data
• We do NOT use it for advertising
• We do NOT use it to train AI models (consistent with Section 3.1 above)
• We do NOT share it with third parties beyond what is required to deliver the service (Supabase as our data infrastructure provider, OpenAI, Anthropic, and Google for AI inference, with all bound by data processing agreements)

9.5 Data Retention

Extension-specific local data is cleared:

• When you sign out of Simply Asking, your authentication tokens, notification state, and pending conversation reference are cleared from chrome.storage.local
• When you uninstall the extension, all chrome.storage entries (including Gmail telemetry counters) are cleared by Chrome
• When you close your browser, chrome.storage.session entries are cleared (the per-action attach context)
• On Chrome's storage eviction policies (if you exceed your storage quota)

Server-side data follows our standard retention policy described in Section 5 above.

9.6 Encryption

• All data in transit between the extension and Simply Asking servers uses TLS 1.3
• All data at rest in Simply Asking infrastructure (Supabase Postgres + Storage) uses AES-256 encryption
• Authentication tokens stored in the extension are scoped to the extension origin (chrome-extension://<id>) and are not readable by other websites or extensions

9.7 Limited Use Compliance

The Simply Asking browser extension's use of information received from Google APIs (specifically Gmail compose interaction via mail.google.com host permission and Google OAuth via chrome.identity) adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

---

10. Data Location & Geographic Availability

10.1 Service Availability

The Service is currently available only to users located in the United States. We may expand availability to additional regions in the future.

10.2 Data Location

• Primary Storage: United States (AWS US-East-2 Ohio via Supabase)
• Application Hosting: United States via Vercel
• AI Processing: United States-based providers

---

11. Children's Privacy

Simply Asking is intended for users who are at least 18 years old. We do not knowingly collect personal information from anyone under the age of 18.

If we learn we have collected data from someone under 18, we will promptly delete it. If you believe we may have collected information from someone under 18, please contact us at legal@simplyasking.io.

---

12. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights:

12.1 Right to Know

You can request disclosure of:

• Categories of personal information collected
• Sources of personal information
• Business purposes for collection
• Categories of third parties with whom we share data

12.2 Right to Delete

You can request deletion of personal information we hold about you, subject to certain exceptions.

12.3 Right to Opt-Out

We do not sell personal information. If this changes, we will provide an opt-out mechanism.

12.4 Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

---

13. Changes to This Policy

13.1 Notification of Changes

We may update this privacy policy from time to time. When we make material changes:

• We will update the "Last Updated" date
• We will notify you via email or in-app notification
• Continued use after changes constitutes acceptance

13.2 Review History

---

14. Contact Us

Privacy Questions

For questions about this privacy policy or our data practices:

• Email: legal@simplyasking.io
• Address: 600 E Ohio Street Suite C, Indianapolis, IN 46202

Complaints

If you believe we have not addressed your concerns adequately, you may contact your local data protection authority.

---

15. Additional Information

15.1 United States Users

This Service is currently available only to users in the United States. Your data is stored and processed in the United States in accordance with U.S. law.

15.2 California Residents

California residents have additional rights under CCPA as described in Section 12 of this policy.

15.3 Future International Expansion

If we expand the Service to additional regions, we will update this policy to include applicable regional privacy requirements.

---

This privacy policy was last reviewed on August 30, 2026.