Skip to content
Legal

Privacy Policy

Last updated: November 2026

This text describes how the service actually works. It must be reviewed by a qualified lawyer and completed with the operator's details before commercial launch.

1. Who we are

AsteriskAI ("we") operates this service. The data controller's identity and contact details are shown on the contact page.

2. Private mode (default)

You can analyse a document without an account. In private mode:

  • The uploaded file is stored encrypted in temporary storage, only while its text is extracted, and is deleted as soon as extraction ends.
  • The extracted text, the report and any chat are kept encrypted and only for the length of your session (configurable, currently stated on the analysis page). When the session ends or expires, they are deleted automatically.
  • We never store the original file in our database or in permanent storage.
  • We keep technical metadata without document content (for example: analysis status, page count, processing cost) until the session expires, and accounting records of AI usage (tokens and cost, without content).

3. Processing by AI providers

To analyse your document, its text is sent to an external AI provider (currently OpenAI and/or Anthropic, depending on configuration). This means your document leaves our systems to be processed by that provider, under its terms for API customers. We send only what is needed for the analysis and we do not authorise providers to use it to train models where they offer that option. Retention by the provider is governed by its own policy.

4. Account mode

If you create an account, we store your email address, a password hash, your plan, credits and payment history. Reports are stored only when you choose to save them and your plan allows it; they are kept for 10 days and then deleted automatically, and you can delete them sooner. Original documents are never kept.

5. Payments

Payments are handled by Stripe. We never receive or store full card numbers. We store payment identifiers, amounts and status.

6. Legal bases (GDPR)

  • Performance of the service you request: analysing your document, managing your account.
  • Legal obligations: invoicing and accounting records.
  • Legitimate interest: security, abuse prevention and cost control (using a keyed hash of your network address, never the address itself).

7. Your rights

You can access, export, correct and delete your data. Signed-in users can export all their data and delete their account from Account → Your data. You may also contact us and complain to your data protection authority (in Spain, the AEPD).

8. Retention

  • Private-mode content: until the end of the session, at most the configured session lifetime.
  • Saved reports: 10 days from when you save them, then deleted automatically. You can delete them sooner, or with your account.
  • Billing records: as long as tax law requires.
  • Logs: they do not contain document content; they are rotated and kept for a limited time.

9. Security

Encryption in transit (HTTPS) and at rest for temporary content (AES-256-GCM), access control, rate limiting, and administrative actions logged without document content. Administrators cannot read private documents.