Privacy Policy

1. Who we are

AskCatcher is operated by [LEGAL ENTITY NAME — placeholder, to be completed before launch], based in Portugal, with registered address [REGISTERED ADDRESS — placeholder] and VAT/NIF [NIF — placeholder]. For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for the processing described here. Contact: [PRIVACY CONTACT EMAIL — placeholder].

2. Data we process about you (our customer)

• Account data: your email address, sign-in tokens, and settings (Art. 6(1)(b) GDPR — contract).
• Product data you provide: product name, URL, description, and keywords (Art. 6(1)(b)).
• Billing data: handled by Stripe; we store only your Stripe customer/subscription identifiers and subscription status, never card numbers (Art. 6(1)(b)).
• Marketing: when you sign up we add your email to our mailing list (provider: Brevo) to send onboarding and product emails. You can unsubscribe at any time via the link in every email (Art. 6(1)(f), and consent where required by ePrivacy rules).
• Transactional email (sign-in links, digests) is sent via Brevo or Resend.

3. Public posts we process (third-party authors)

The service fetches publicly available posts from Hacker News (via the Algolia HN Search API) and X (via the official X API) that match our customers' keywords. Legal basis: legitimate interest (Art. 6(1)(f)) in enabling our customers to find publicly asked questions relevant to their products. We apply strict minimisation:

• Raw post text is retained for a maximum of 30 days; afterwards we keep only the post URL and our relevance score.
• We do not build profiles of post authors, do not infer sensitive characteristics, and do not provide contact details or DM capabilities.
• We never post, reply, or interact on any platform on anyone's behalf.
• If you are the author of a post and want it removed from our systems, email [PRIVACY CONTACT EMAIL — placeholder] and we will delete it.

4. Processors and transfers

We use the following processors: our hosting provider (Vercel), our database provider, Stripe (payments), Brevo (marketing and transactional email), Resend (transactional email, where configured), and an LLM API provider (to score posts and draft suggested replies). Some processors are located outside the EEA; where that is the case, transfers rely on adequacy decisions or Standard Contractual Clauses. A current list of subprocessors is available on request.

5. Retention

• Account data: for the life of your account and up to 30 days after deletion.
• Raw public post text: maximum 30 days (see above).
• Invoices and billing records: as required by Portuguese tax law (typically 10 years).

6. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time. Contact [PRIVACY CONTACT EMAIL — placeholder]. You may also lodge a complaint with your supervisory authority; in Portugal this is the CNPD (Comissão Nacional de Proteção de Dados, cnpd.pt).

7. Cookies

We use a single strictly necessary session cookie to keep you signed in. We do not use advertising or cross-site tracking cookies.

8. Changes

We will notify account holders by email of material changes to this policy before they take effect.