WyAsk Privacy Policy

Effective date: 9 August 2026 · Applies to the WyAsk platform, including WYASK Plus, Pro, Pro Teams, and Reports

WyAsk Technologies LTD ("WyAsk", "we", "us"), a company registered in Abu Dhabi Global Market (ADGM), United Arab Emirates, provides a platform that lets Account Holders create governed AI conversations ("Envelopes") from their own content, and share them with Receivers. This Policy explains what personal data we collect, why, and what rights you have. It applies to Account Holders and to Receivers who chat with an Envelope.

1. Who This Policy Covers

• Account Holders — individuals or organisations who register for a WyAsk account.
• Receivers — anyone who chats with an Envelope, whether or not they hold a WyAsk account.

For most personal data relating to Receivers, the Account Holder who created the Envelope is the data controller, and WyAsk acts as a data processor on their behalf. For Account Holder account and billing data, WyAsk is the data controller. Where this distinction matters, it is noted below.

2. What We Collect

2.1 Account Holder Data

• Account and contact information you provide (name, email, organisation, role).
• Billing information, processed by our payment processor, Stripe (WyAsk does not store full card numbers).
• Content you upload into Envelopes.
• Usage data — envelopes created, queries made, storage used, feature activity.

2.2 Receiver Data

• Chat Content — the messages and questions a Receiver submits when chatting with an Envelope.
• Contact information a Receiver voluntarily provides (for example, via an email gate).
• Engagement signals — topics asked about (from a fixed category list), time spent, number of questions, return visits, and similar measured statistics.

Lead Intelligence Reports are built from categorized topic tags and measured engagement statistics, not from a word-for-word transcript of a Receiver's messages. See Section 4.

3. Why We Use It

• To provide the Service — generate answers within an Envelope, enforce access controls, and process payments.
• To generate Optimization Reports, from aggregated, anonymized engagement patterns across an Envelope's Receivers (only once an Envelope has reached a minimum number of sessions, to preserve meaningful anonymity).
• To generate Lead Intelligence Reports, when an Account Holder purchases one for a specific Receiver, using categorized topics and engagement statistics as described in Section 4.
• To maintain security, prevent abuse, and meet legal obligations.
• To improve WyAsk's products, using aggregated, anonymized data that does not identify any individual (see Section 9).

Our legal basis for processing is: performance of our contract with the Account Holder; the Account Holder's own legitimate interest in responding to Receiver inquiries, balanced against Receiver privacy; and, for the AI-analysis features described below, the notice provided to Receivers before they begin chatting.

4. AI Analysis of Conversations

If an Account Holder purchases a Lead Intelligence Report, WyAsk analyzes the relevant Receiver's engagement using AI to identify categorized topics (from a fixed list, not free text), measured statistics, and general follow-up suggestions. This analysis does not reproduce the Receiver's exact words and does not include psychological or personality profiling. Receivers are shown a notice before chatting begins — the WyAsk Receiver Notice — describing this in plain language. Optimization Reports use aggregated data across multiple Receivers and do not identify or single out any individual.

Chat Content and uploaded Content are never used to train AI models.

5. Sub-processors

We use the following categories of third-party sub-processors to provide the Service:

• Cloud hosting infrastructure: Amazon Web Services (AWS), AWS me-central-1 (UAE).
• AI / foundation model providers: OpenAI and Google (Gemini), for answer generation, embeddings, and document processing.
• Payment processing: Stripe.

Sub-processors are contractually required to protect personal data consistent with this Policy and do not use it to train their own models where we have obtained that commitment. We will update this list as our sub-processors change; material changes will be notified to Account Holders.

6. Data Retention and Deletion

Envelope content and associated Chat Content are deleted or anonymized when an Envelope expires, consistent with the expiry the Account Holder set. Account data is deleted or anonymized within a reasonable period after account termination, except where retention is required for legal, security, audit, or accounting purposes. Purchased Reports are retained by the Account Holder once delivered; WyAsk's retention of a copy is described in the Reports Addendum.

7. Cross-Border Transfers

WyAsk Technologies LTD is registered in the ADGM. We host the Service in AWS me-central-1 (UAE). Depending on where our infrastructure and sub-processors are located, personal data may be processed outside the jurisdiction where you or a Receiver are located, including in other UAE regions. Because ADGM's data protection framework treats transfers to mainland UAE (which is not on ADGM's adequacy list) as a cross-border transfer, we apply appropriate safeguards to such transfers consistent with ADGM's requirements.

8. Your Rights

Depending on your location and applicable law (including the UAE PDPL, ADGM and DIFC data protection regulations, or GDPR where applicable), you may have rights to access, correct, delete, or object to processing of your personal data, and to receive a copy of it in a portable format. Receivers should direct requests to the Account Holder who operates the relevant Envelope in the first instance, as they are typically the data controller; Account Holders should contact us using the details in Section 12.

9. Aggregate and Anonymized Data

We use aggregated, anonymized data that does not identify any individual — for example, overall usage trends and benchmark metrics — to improve WyAsk's products. This is separate from, and does not include, any Account Holder's Content or any Receiver's Chat Content.

10. Security

We use technical and organizational measures appropriate to the sensitivity of the data we process, including encryption, access controls, and audit logging. No system is completely secure; see the Limitation of Liability provisions in our Terms of Service.

11. Children's Privacy

WyAsk is not directed at children, and Receivers should not be children. If you believe a child has provided us with personal data, contact us using the details below and we will take appropriate steps to delete it.

12. Changes to This Policy; Contact

We may update this Policy from time to time; material changes will be notified as described in our Terms of Service. Questions about this Policy can be sent to privacy@wyask.com.