1. Controller
The controller for data processing on this website and within the askVela platform is:
askVela Limited, 56 Grange View, England, LS7 4ER, email: info@askvela.pro.
2. Overview & roles
askVela is a customer-support platform (live chat, AI assistant, team inbox, knowledge base). We process data in two roles:
As controller for the data of our own customers (workspace owners) — e.g. sign-up, billing and dashboard usage.
As processor for the data our customers collect from their own website visitors through the chat widget. For that content the respective workspace owner is the controller; we process it solely on their instructions to provide the service.
3. What data we process
Account/workspace data: name, email, password (hashed), workspace name, settings. When signing in with Google or Apple, additionally the provider identifier (see section 8).
Chat/support data: messages between visitors, AI and team, optionally a visitor's name/email, uploaded files, page/browser context (e.g. visited URL, basic technical info).
Billing data: plan, payment status (payments handled by Stripe or — for Shopify installs — by Shopify; we do not receive full card details).
Usage/log data: technical logs for security and troubleshooting.
4. Purposes & legal bases
We process data to perform the service contract (Art. 6(1)(b) GDPR), for legitimate interests in a secure, working service (lit. f) and to comply with legal obligations (lit. c). The AI feature processes chat content to generate replies and improve the knowledge base.
5. AI processing
To answer enquiries, chat content and relevant knowledge articles are sent to OpenAI. Processing takes place in OpenAI's EU region: both storage and processing happen within the EEA or Switzerland. OpenAI does not use content submitted via the API to train its models. The EU region uses stricter retention settings, so chat content is not written to abuse-monitoring logs. In addition, Zero Data Retention is enabled for our API access: OpenAI does not store submitted content, not even temporarily.
6. Recipients / processors
We use carefully selected providers under data processing agreements:
• OpenAI – AI replies and embeddings · processed in the EU region (EEA/Switzerland), Zero Data Retention
• Hostinger International Ltd. – hosting of the application and database · server location Frankfurt am Main, Germany
• Stripe – payment processing (direct customers)
• Shopify – installation, billing and shop data when used as a Shopify app
• Resend – system and notification emails
• Google Ireland Limited / Google LLC and Apple Distribution International Ltd. / Apple Inc. – only when you sign in with Google or Apple; independent controllers for the sign-in with the provider · see section 8
Transfers to third countries (e.g. the USA) only take place on the basis of appropriate safeguards (EU Standard Contractual Clauses).
7. Shopify app
Access to connected shop systems – Shopify, WooCommerce, JTL, Shopware or a product feed – is read-only. askVela does not create, modify or delete data there; order information is only requested for exactly one e-mail address named by the customer.
When askVela is installed from the Shopify App Store, we process the shop data required for the feature via the Shopify API — in particular product data and, if the merchant enables it, order and customer data (name, email, order status) to display it in the support chat.
On uninstall, access tokens are revoked immediately. We honour Shopify's mandatory deletion webhooks (shop/redact, customers/redact) by blocking or deleting the affected data.
8. Signing in with Google or Apple
Instead of email and password, you can sign up and sign in to askVela with your Google account (“Continue with Google”) or your Apple ID (“Continue with Apple”). This is optional; signing in with email and password is always available. After you click, we redirect you to the provider, where you sign in and confirm which data is shared with askVela. We never learn your password with the provider.
Data we receive: From Google, an identifier of your Google account that is unique to askVela, your email address and whether Google verified it, your name and the URL of your profile picture. We only request the “openid”, “email” and “profile” permissions – no access to contacts, calendar, mail or files. From Apple, an identifier of your Apple ID that is unique to askVela, your email address – your real address or, if you choose “Hide My Email”, an anonymous Apple relay address (…@privaterelay.appleid.com) –, on the first sign-in your name if you share it, and a so-called refresh token.
What we store: the provider identifier, the most recently shared email address, whether it is an Apple relay address, when the connection was created and last used and – for Apple only – the refresh token (encrypted). We use the name only to pre-fill the sign-up form; we store the name you confirm there. We do not store the profile picture.
Purposes and legal bases: sign-up, sign-in and matching to your askVela account (Art. 6(1)(b) GDPR) and protection against account takeover and abuse (Art. 6(1)(f) GDPR). For this we ask for your password or a confirmation via a link sent to your askVela account address when connecting to an existing account, send a security email whenever your sign-in methods change, and a password reset removes all connected sign-ins. We use the Apple refresh token only to revoke the connection with Apple when you delete your account.
Recipients and transfers: For users in the EEA we exchange the data needed for sign-in with Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) or Apple Distribution International Ltd. (Hollyhill Industrial Estate, Hollyhill, Cork, Ireland). The providers process the sign-in as independent controllers; data may also reach their parent companies Google LLC or Apple Inc. in the USA – based on the EU-US Data Privacy Framework adequacy decision where the companies are certified, otherwise on EU Standard Contractual Clauses. The provider learns that and when you sign in to askVela. More: Google Privacy Policy, Apple Privacy Policy and Sign in with Apple & Privacy.
Retention and your choices: We keep the connection as long as your account exists or until you disconnect it under Account → Security (as long as another sign-in method remains). When you delete your account we delete the connection and revoke it with Apple. You can also end the connection with the provider: in your Google account under “Third-party apps & services”, on Apple devices under Settings → Apple ID → “Sign in with Apple”.
10. Retention
We store a workspace's conversations, contacts and content for as long as the workspace exists. Workspace owners can delete conversations and contacts at any time. After the contract ends, workspace data is deleted within 30 days unless a statutory retention obligation applies; backups expire on their regular cycle. AI providers do not store submitted content (see section 5).
11. Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection, as well as to lodge a complaint with a supervisory authority. Contact info@askvela.pro. If the request concerns data a askVela customer collected via their widget, we forward it to the respective controller.
12. Changes
We update this privacy policy when features or the legal situation change. The version published here applies.