Draft. This document is not final — the bracketed fields are still to be filled in.
Privacy Policy
Version 1.0. Last revised: [DATE]
[LEGAL ENTITY NAME], trading as Asterisk ("Asterisk", "we", "us", "our"), operates the website at joinasterisk.com and the related services described in our Terms of Use (together, the "Service").
This Privacy Policy explains what personal information we collect, why, who we share it with, and what rights you have over it. It applies to everyone who uses the Service, wherever you are.
Notice to users in the UK and EEA: Section 12 contains additional information required by UK and EU data protection law, including our legal bases for processing and your rights.
Notice to users in the United States: Section 11 contains additional information for residents of California and Nevada.
In this policy, "personal information" has the same meaning as "personal data" under UK and EU law.
1. Information you give us
- Account information. When you sign in with Google we receive, and store, your email address, your name, your profile picture URL, and Google's stable account identifier for you. We do not receive your Google password.
- Expert selections. Which experts you have chosen to have searched.
- Access token records. A label you give each access token, the date it was created, the date it was last used, and the date it was revoked. We store only a one-way cryptographic hash of the token itself, never the token, so we cannot recover or display a token after it is first shown to you.
- Connected client information. The name of the AI assistant you connect through a token, and when it was last active.
- Waitlist information. If you join the waitlist, your email address.
- Correspondence. Anything you send us by email, including its content.
- Your Inputs. The queries and prompts you submit to the Service.
2. Information collected automatically
When you visit the Service, our hosting provider records standard technical information, including your IP address, approximate location derived from it (typically city or region, not a precise position), the pages you requested, your browser and device type, and the date and time of the request. This is used for security, abuse prevention, and keeping the Service running.
We do not use analytics or advertising services, and we do not track you across other websites.
3. Information from third parties
The only third party that provides us with personal information about you is Google, and only the account information listed in Section 1, and only because you chose to sign in with it. Google's handling of your data is governed by its own privacy policy.
4. How we use your information
We use personal information to:
- create and maintain your account and sign you in
- authenticate access tokens and return results for your queries
- remember your expert selections and other preferences
- keep the Service secure, detect and prevent abuse, and enforce our Terms
- respond to your questions and support requests
- send you Service-related messages, such as changes to these policies
- contact you about launch if you joined the waitlist
- comply with legal obligations and establish, exercise, or defend legal claims
What we do not do. We do not use Your Inputs, or any other personal information, to train or fine-tune AI models, our own or anyone else's. We do not sell or share personal information for money or for cross-context behavioral advertising. We do not carry out profiling or automated decision-making that produces legal or similarly significant effects.
5. Who we share it with
We share personal information only with the following categories of recipient, and only as far as needed:
| Recipient | Purpose |
|---|---|
| Sign-in. Google confirms your identity and returns your account information. | |
| Cloudflare | Hosting, content delivery, security, and the database holding your account records. |
| Neon | The search index that makes corpus queries possible. |
| Professional advisers | Lawyers, accountants, insurers, and auditors, where necessary. |
| Authorities | Where we are legally required to disclose, or where disclosure is necessary to establish, exercise, or defend legal claims, or to protect the rights or safety of any person. |
| A buyer or successor | If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. |
We require our service providers to protect personal information appropriately and prohibit them from using it for their own purposes, including any form of generalized AI model training.
6. Where your information is held
We are based in the United Kingdom. Our service providers are located in the United Kingdom, the European Economic Area, and the United States, so your personal information may be transferred outside the country you live in.
Where personal information is transferred out of the UK or EEA to a country without an adequacy decision, we rely on appropriate safeguards, normally the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, designed to give it substantially the same protection it has at home. You can ask us for details of the mechanism used for a particular transfer by contacting us at [CONTACT EMAIL].
7. Cookies
Cookies are small files a website stores on your device. Asterisk uses four cookies, all set by us, all strictly necessary for the Service to work. We use no analytics, advertising, or tracking cookies, and no third party sets a cookie through our site.
| Name | Purpose | How long it lasts |
|---|---|---|
sid | Keeps you signed in between pages. | 7 days |
oauth_state | A one-time security check during Google sign-in, protecting against a forged sign-in request. | 10 minutes |
new_token | Displays a newly created access token to you once, then disappears. | 2 minutes |
nav | Remembers whether to show signed-in navigation, so pages do not flicker on load. | 7 days |
Because these cookies are strictly necessary, we do not ask for consent to set them, and there is no cookie banner. You can block or delete cookies in your browser settings, but doing so will stop you being able to sign in.
If we ever introduce analytics or other non-essential cookies, we will update this section and ask for your consent before setting them.
8. How long we keep it
We keep personal information only as long as we need it.
- Account data is kept while your account is open. If you close your account, or ask us to delete it, we permanently delete it within 30 days, other than anything we must keep for legal or accounting reasons.
- Access token records are deleted with the account. Revoked tokens are retained for up to 30 days for security investigation, then deleted.
- Waitlist emails are kept until you unsubscribe or ask us to remove you, or until it is clear the waitlist has served its purpose.
- Technical logs are kept for a short period for security and reliability, in line with our hosting provider's standard retention.
Where we cannot fully delete information, for example because it sits in a backup, we isolate it and delete it when that backup expires.
9. Security
We protect personal information with measures appropriate to the risk, including encryption of data in transit, storing access tokens only as one-way hashes, scoping every database query to the signed-in account, and limiting internal access. No system is perfectly secure, and we cannot guarantee absolute security. Tell us at [CONTACT EMAIL] if you believe your account has been compromised.
10. Your choices
Whatever country you are in, you can:
- Revoke an access token at any time from your dashboard
- Change your expert selections at any time
- Close your account by contacting us at [CONTACT EMAIL]
- Leave the waitlist by contacting us at [CONTACT EMAIL]
- Control cookies through your browser settings, subject to Section 7
Please do not send us sensitive personal information, such as government identification numbers, health information, or information about your racial or ethnic origin, political opinions, religious beliefs, sex life, or sexual orientation. We do not ask for it and do not need it.
11. Additional information for United States residents
California. California residents have the right to know what personal information we collect and why, to request a copy of it, to correct it, to delete it, and to be free from discrimination for exercising those rights.
We collect the categories of personal information described in Sections 1 and 2: identifiers, internet and network activity information, approximate geolocation, and the contents of your correspondence and queries. We collect them from you, from Google, and automatically as described above, and we use and disclose them for the purposes in Sections 4 and 5. We keep them for the periods in Section 8.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months. We do not knowingly collect the personal information of anyone under 18.
To exercise a California right, email [CONTACT EMAIL] or write to us at the address in Section 14. We will verify your identity, normally by confirming control of the email address on your account, before acting on a request. You may use an authorized agent, in which case we may ask for proof of their authority.
Nevada. Nevada residents may direct us not to sell certain personal information. We do not sell personal information. To submit a request anyway, email [CONTACT EMAIL].
12. Additional information for UK and EEA users
This Section applies if you are in the United Kingdom or the European Economic Area ("Europe").
Controller. [LEGAL ENTITY NAME] is the controller of the personal information described in this policy. Our contact details are in Section 14.
Our legal bases. UK and EU law require a legal basis for each use of personal information. Ours are:
| What we use it for | Legal basis |
|---|---|
| Creating your account, signing you in, and providing the Service | Performance of a contract with you |
| Remembering your expert selections and preferences | Performance of a contract with you |
| Strictly necessary cookies | Performance of a contract with you |
| Security, abuse prevention, and enforcing our Terms | Our legitimate interests in running a secure service |
| Responding to your questions | Our legitimate interests in supporting our users |
| Waitlist emails about launch | Your consent, which you may withdraw at any time |
| Meeting legal obligations and handling legal claims | Compliance with a legal obligation, and our legitimate interests in defending claims |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your interests and rights, and concluded they are not. You can ask us for more detail.
Your rights. You may ask us to:
- give you access to the personal information we hold about you
- correct inaccurate or incomplete information
- delete information where there is no good reason for us to keep processing it
- restrict how we process it, for example while you contest its accuracy
- transfer a machine-readable copy to you or to another provider
- object to processing based on our legitimate interests
- withdraw consent where we rely on it, without affecting processing already carried out
No automated decision-making. We do not make decisions about you by automated means that produce legal or similarly significant effects.
Exercising your rights. Email [CONTACT EMAIL] or write to the address in Section 14. We may ask for information to verify your identity. We will respond within one month, or tell you if we need longer.
Complaints. If you are unhappy with how we have handled your personal information you may complain to your data protection regulator. In the UK that is the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk
If you are in the EEA, your national supervisory authority's details are at https://edpb.europa.eu/about-edpb/about-edpb/members_en. We would appreciate the chance to address your concern first.
13. Children
The Service is for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us at [CONTACT EMAIL] and we will delete it.
14. Changes and contact
Changes. We may update this Privacy Policy. If we make material changes we will notify you by email at the address on file or by a prominent notice on the Service, and we will update the revision date at the top.
Contact us.
[LEGAL ENTITY NAME]
[POSTAL ADDRESS]
Email: [CONTACT EMAIL]