Privacy Policy

We collect data only when you use one of the features below:

• Free diagnostic: the email address you enter, the brand to be diagnosed, the questions you submit (up to 5), the optional “how did you hear about us” note, and where you arrived from (a source parameter on one of our own links, or the domain of the referring website — never the full address).
• Login: your email address. We send an email with a one-time link that is valid for 30 minutes; once you log in, your browser keeps a login session that is valid for 90 days.
• Buying a certificate: payment takes place on Stripe's checkout page, and the email, name, billing and payment details you enter there are collected and processed by Stripe. On our side we store only Stripe's order and payment identifiers, the amount, the payment status, timestamps, and which measurement and brand the certificate is for.
• Email: the content and address of messages you send to hello@ask10ais.com.
• MCP server (/api/mcp, a read-only query interface for AI agents that needs no account): for each call, the client name and version the client reports, the product part of its client identifier (User-Agent), the tool called and its arguments (for example the brand name searched, a ranking number or a certificate number, truncated), how many results matched, whether the call succeeded and how long it took. We receive only the arguments your AI assistant sends to perform the query; we do not receive your conversation with it. This call log contains no IP addresses and is not linked to any account; to prevent abuse we count requests per source IP per minute in memory, without writing them to the log. Please enter only brand or company names in queries, not personal information.
• Access logs: like most websites, our server logs the IP address, browser information, page requested and time of each request, for security and troubleshooting.

• We use no third-party analytics, advertising or behavioural tracking scripts, and set no advertising cookies.
• We never see or store full card details.
• We do not sell personal data or use it for purposes unrelated to the site's services.

• To run the diagnostic you submitted, produce the report and email you about it (confirming your address, telling you the report is ready).
• To let you log in and see the diagnostics and reports you have submitted.
• To process orders, deliver certificates, handle refunds and disputes, and keep transaction records as the law requires.
• To reply to your messages.
• To see whether the MCP server is used, which tools are called and where errors occur, so we can improve it; and to count which brands and categories people look up (including ones we have not measured yet), so we can decide what to measure and publish next.
• To understand which channels bring visitors to the site (using only the source parameter and referring domain described above), so we can improve it.
• To keep the site secure and fix problems.

Public rankings, verification pages and certificates show brand names, raw model responses and measurement data. They contain no personal data about purchasers or people who submit diagnostics.

Diagnostic reports are not listed anywhere on the site and are excluded from search engines. Each report link carries a randomly generated access key and is sent only to the email address you used, or shown in the workbench after you log in; anyone who has the link can open the report, so please do not forward it to people who should not see it. The questions you submit are stored as part of the diagnostic, so please do not put personal data in them.

To provide the service, the following providers process the relevant data on our instructions:

• Vultr: the cloud host for the site's server and database (servers located in Japan).
• Stripe: payments, refunds and dispute handling.
• Resend: sending confirmation and notification emails (receives your email address and the email content).
• Alibaba Cloud Enterprise Mail: sending and receiving mail for hello@ask10ais.com.
• OpenRouter and the large-language-model providers it connects to: when a diagnostic runs, the questions and brand name you submitted are sent to these models as prompts. Only the question text is sent — never your email address.
• Lark: our internal operations records and alerts, which include the email address, brand name and time of each diagnostic submission.
• Google Fonts: the site's Chinese typeface is loaded from Google's font servers, so your browser sends Google your IP address and other standard request information when it loads the font.

Some of these providers' servers are outside Singapore (for example in Japan and the United States). We use only providers with safeguards for personal data and, as the PDPA requires, ensure that personal data transferred abroad receives protection comparable to the PDPA.

• ask10ais_session: your login session. Set only after you log in, valid for 90 days, and not readable by page scripts.
• NEXT_LOCALE: remembers the language you chose. Set only when you switch language, valid for one year.
• The site sets no other cookies and stores nothing else in your browser. Both cookies above are needed for the site to work and are not used for tracking.

• Diagnostic submissions and reports: kept so that you can log in and read them, until you ask us to delete them.
• Login records: login links expire after 30 minutes and sessions after 90 days; the records themselves are kept until you ask us to delete them.
• Order and payment records: kept as Singapore law requires for business and accounting records (currently at least five years), then deleted or anonymised.
• Email: kept as long as needed to deal with it; you can ask us to delete it.
• MCP call log: individual records are deleted after 90 days. After that we keep only daily counts (tool, normalised search term, whether it matched, client name), without times, client identifiers or anything that could be linked to a person, for 24 months. Search terms that were looked up only once and are not a registered brand name are left out of the counts.
• Server access logs: kept for 14 days for troubleshooting and security, then deleted.
• Database backups: one a day, at most 14 kept before they are overwritten; data in them disappears on the schedule above.

You can ask to access the personal data we hold about you, correct inaccurate data, withdraw your consent, or have your data deleted. Write to hello@ask10ais.com with your request and the email address you used. We will first confirm that the request comes from the owner of that address, and we will reply within 30 days.

Because the MCP call log is not linked to accounts, we cannot look it up by person. If you believe a query contained your personal data, tell us roughly when and what was searched, and we will find and delete it.

Transaction records that the law requires us to keep cannot be deleted during the retention period. If you withdraw consent, services that depend on the data (such as logging in to read your reports) can no longer be provided.

For any question or request about personal data, contact our data protection contact at hello@ask10ais.com. If you are not satisfied with our response, you may also contact Singapore's Personal Data Protection Commission (PDPC).

We may update this policy; when we do, the revision date at the top of this page changes. If the way we use data changes materially, we will say so prominently on this page.