Privacy Policy

Ask Anny is built on a privacy-first philosophy. The application itself does not require an account, does not persist your conversations in a database we control, and does not set tracking or analytics cookies. This page explains, in plain language, what data is processed when you use Ask Anny — including the parts that are handled by third-party providers and that we therefore cannot fully control.

Controller in the sense of Art. 4 (7) GDPR is Anja Völker (see the Legal Notice for full contact details).

1. What data is processed

• No user accounts. Ask Anny does not require registration. The application does not ask for your name, email address or a password in order to use the service.
• Onboarding answers (organization type, role, challenge category) are saved in your browser's local storage on your device. They are sent to the AI provider together with each message as context, but they are not written to a database operated by Ask Anny.
• Your conversation messages and the text extracted from any documents you upload (PDF, Word, plain text, Markdown) are processed in your browser and transmitted to the AI provider in order to generate a response. Ask Anny does not write this content to its own database. It is, however, processed in transit and may be temporarily held in operational logs by the infrastructure and AI providers listed in section 4.
• Email addresses are only processed if you choose to contact us by email. The email and its content are then processed by the relevant email provider in order to handle your request.
• Technical request data (e.g. IP address, user agent, timestamp) is processed by the hosting provider to deliver the page and to protect the service against abuse, in line with standard server-log practice.

2. AI processing disclosure

To generate Anny's responses, your messages and the extracted text of any attached documents are sent to a large language model via the Lovable AI Gateway, which routes the request to underlying model providers (currently Google Gemini models). This processing is necessary to provide the service you requested (Art. 6 (1) (b) GDPR) and, as far as additional log processing by the providers is concerned, is based on their legitimate interest in operating and securing their platforms (Art. 6 (1) (f) GDPR).

According to the current published terms of the Lovable AI Gateway and Google's Gemini API, prompts sent through these paid API endpoints are not used to train the providers' foundation models, and request data may be retained for a limited period for abuse prevention, security and operational purposes. We rely on these provider commitments and cannot independently verify them on a per-request basis. Ask Anny itself does not add tracking, profiling or behavioural identifiers to the requests.

Important: Please do not share information you do not want a third-party AI provider to process — in particular unredacted personal data of others, trade secrets, health data, or confidential client information. Ask Anny is a reflection tool, not a secure vault.

3. Confidentiality of your conversations

Ask Anny is designed so that individual user conversations are not stored in a database operated by Ask Anny and are not accessible to its administrators through any application back-office. The application has no admin view that lists user sessions or message content. Conversations exist in your browser tab for the duration of your session and are not associated with a user identity by Ask Anny.

We cannot, however, rule out that message content appears temporarily in operational logs of the infrastructure and AI providers that process the request on our behalf. Access to those provider-side logs is governed by the respective providers' policies and security controls, not by Ask Anny.

4. Hosting & infrastructure

• Hosting & application runtime: Lovable, running on Cloudflare Workers edge infrastructure. Standard server logs are processed for security and operations.
• AI inference: Lovable AI Gateway with Google Gemini as the underlying model provider at the time of writing. The selected model may change as the service evolves.
• Backend / database: Lovable Cloud (built on Supabase). At the time of writing, Ask Anny does not store conversation content or user profiles in this database.
• Web fonts: Typography is loaded from Google Fonts. This means your browser establishes a connection to Google and transmits standard request data (including your IP address) to Google in order to download the font files.
• Search indexing: A Google Search Console verification meta tag is included in the page source so that the operator can monitor search indexing. The meta tag itself does not set cookies and does not track visitors.

Some of these providers are based in, or may process data in, countries outside the EU/EEA — in particular the United States. According to the providers' published documentation, such transfers are covered by appropriate safeguards under Chapter V GDPR, including the EU-US Data Privacy Framework where applicable and/or Standard Contractual Clauses (Art. 46 GDPR). We rely on these provider statements.

5. Cookies & local storage

Ask Anny does not set tracking, advertising or analytics cookies. No web analytics tool (such as Google Analytics, Meta Pixel or Hotjar) is loaded by the application.

The application uses your browser's local storage for one purpose: to remember the onboarding answers you provided (organization, role, challenge) so they do not have to be asked again on your next visit. This data stays on your device and can be cleared at any time via your browser's site-data controls, or by visiting /onboarding and starting over.

Third-party providers (e.g. the hosting platform) may set strictly technical cookies required to deliver the page or to protect the service. These are not used by Ask Anny for tracking or profiling.

6. Third-party services we use

• Lovable (hosting, edge runtime, AI Gateway)
• Google (Gemini AI models, Google Fonts, Search Console verification)
• Supabase (backend infrastructure provided through Lovable Cloud)

The application does not embed social media widgets or advertising networks. If you would prefer to avoid the connection to Google Fonts, browser extensions that block third-party requests can prevent it; the site will still load.

7. Data retention

• Conversation messages & uploaded documents: not persisted in a database operated by Ask Anny. They are held in your browser tab for the session and may appear transiently in provider-side operational logs as described in sections 2–4.
• Onboarding answers in local storage: kept on your device until you clear them.
• Server logs and AI gateway logs: retained by the respective providers in line with their own retention policies and applicable legal obligations.
• Email correspondence: kept as long as necessary to handle your request and to comply with any applicable legal retention obligations, then deleted.

8. Your rights under GDPR

Under the EU General Data Protection Regulation you have the right to:

• access the personal data we process about you (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure / "right to be forgotten" (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on legitimate interests (Art. 21)
• withdraw consent at any time, where processing is based on consent (Art. 7 (3)) — without affecting the lawfulness of processing before withdrawal
• lodge a complaint with a supervisory authority (Art. 77), e.g. your local data protection authority in the EU/EEA

Because Ask Anny does not maintain user accounts and does not store your conversations, in many cases there will be no personal data of yours on our side to access, correct or delete.

9. Contact for privacy requests

For any privacy-related question or to exercise your GDPR rights, please email:

anvoelker@googlemail.com

We will respond within the timeframes set by GDPR (normally within one month).

10. Changes to this policy

We may update this Privacy Policy to reflect changes in the service or in legal requirements. The current version is always available at this URL with the "last updated" date at the top.