GDPR at AskVault, data deletion, export, and rights
AskVault's role under GDPR
AskVault is a Data Processor. You (the AskVault customer) are the Data Controller for the visitor and end-user data you process through our platform. Three implications:
- You decide what data to collect from your end users.
- We process that data only on your instructions, governed by our Data Processing Agreement.
- End users exercise their GDPR rights with you. You answer them with the tools below.
For most B2B SaaS customers using AskVault on a customer-support chatbot, this is the standard processor relationship.
When an end user contacts AskVault directly
Sometimes an end user writes to AskVault instead of to you, for example at [email protected]. We don't answer the request ourselves, because the data is yours to decide on. We:
- Forward the request to the owner of the workspace the person used, without delay.
- Tell the end user that we have passed it to you, and who to contact.
- Leave the decision and the reply to you. We act on it only if you instruct us to.
Rolling out, not yet switched on: AskVault's public data deletion page is being updated to send your end users to you first, in line with this process. Until then it still asks end users to email [email protected], and any request that arrives there is forwarded to you as above.
The three customer rights, operationalized
GDPR grants several rights; three matter most for AskVault customers in practice. This section lists the self-serve tools that exist in AskVault today.
Right to access (Article 15)
Visitors and end users can ask you for a copy of their data. The tools available:
- Find their conversations. Search the Live Chat inbox for the visitor's name, email or phone, then open each matching conversation.
- Export all conversations (CSV). Growth+ In the Inbox, click Export all (CSV). It downloads every message in the workspace, not only one person's, so filter the file to the conversation IDs you found above.
- Export leads (CSV). Growth+ Export from the Leads page.
- Export one person (JSON). Rolling out, not yet switched on. Open the person on the Contacts page and choose Export data (JSON), or call the API below with their email, phone or visitor ID. The file holds their contact record, every conversation with its messages and attachment names, the files they uploaded in the chat widget (with any text read from a PDF), their leads, their outbound-sequence enrollments and any events your site sent with
AskVault.track()during their chats in that workspace. Your team's internal notes are left out and counted, so you can decide whether to disclose them. Workspace owners and admins only.
There is no single export that bundles a workspace's documents, conversations, leads and audit logs into one file. Until the per-person export is switched on for your workspace, there is no export filtered to one end user either.
Right to erasure (Article 17)
Visitors and end users can ask you to delete their data. The self-serve deletion tools:
- Per-lead. Delete a lead, or several selected leads, on the Leads page.
- Whole workspace. The workspace owner can delete the workspace under Settings > Danger Zone. This removes its documents, search index, conversations, messages, leads and contacts.
- Whole account. Under Settings > Password & Security, Delete account removes every workspace you own and then the account itself.
- Automatic retention. Conversations older than your plan's retention window are deleted automatically (see the FAQ below).
- Per person. Rolling out, not yet switched on. Open the person on the Contacts page, choose Delete permanently, then confirm. This removes the person's contact record and all of their conversations, messages, attachments, leads and outbound-sequence enrollments in that workspace, plus any events your site sent with
AskVault.track()during those chats. It can't be undone. Workspace owners and admins only.
Until per-person deletion is switched on for your workspace, there is no self-serve control to delete all conversations from one end user or a single contact record. There is no control to delete a single conversation.
Both per-person actions by API (rolling out, not yet switched on). POST /api/workspaces/{workspace_id}/contacts/subject-requests/export and .../subject-requests/delete take a JSON body with exactly one of contact_id, email, visitor_id or phone; delete also needs "confirm": true. The person is looked up in that workspace only. The same email in another of your workspaces, or another company's, is never touched. An unknown person returns 404. Each action is written to your workspace audit log with counts only, never the person's details.
Deleted data can stay in our database provider's encrypted backups until those backups expire. Email [email protected] for the current backup window.
Right to data portability (Article 20)
The conversation and lead exports above are plain CSV files, which load into spreadsheets, CRMs and other support tools. The conversations export has one row per message: timestamp, conversation ID, session ID, role, content, channel, tokens used and feedback.
The Data Processing Agreement (DPA)
AskVault publishes a standard DPA, available on request. The DPA covers:
- The processor-controller relationship.
- Categories of personal data processed.
- Security measures (AES-256 at rest at our database provider, TLS 1.2 or higher in transit, workspace-scoped queries).
- Sub-processor list (see below).
- International transfers (Standard Contractual Clauses where applicable).
- Audit rights.
A DPA is available on request — email [email protected].
Sub-processor list
AskVault uses a small set of sub-processors to deliver the service. The provider list is available on request from [email protected].
Categories of sub-processors:
- Database and storage (a managed provider with a SOC 2 Type II report)
- Application hosting
- AI model providers (used per query to write answers from your content; their terms govern retention and training)
- Email and notification delivery
- Payment processing
- Error monitoring and product analytics
- Cache and job queue
- Voice, SMS and messaging carriers for the channels you connect
The full category list is on the sub-processors page.
Specific providers and regions are disclosed under NDA via the DPA.
EU data residency
The application and its primary data store run in the United States. LLM inference runs in the providers' regions (see the sub-processor list). There is no EU-region deployment option today.
Standard Contractual Clauses cover the EU-to-US transfer for customers with EU end users. For most B2B SaaS workloads, the SCC-covered transfer is sufficient.
If your end users include public-sector or healthcare data subjects with a hard in-EU-only residency requirement, contact [email protected] before signing to confirm whether AskVault is a fit.
Right to object and restrict processing (Articles 21-22)
For requests under Articles 21 or 22 (right to object to processing, right to restrict processing):
- The end user contacts you.
- You assess whether the request is compatible with your legitimate processing basis.
- If granted, the self-serve option is deletion, using the tools under Right to erasure above. AskVault has no per-conversation "restrict processing" switch today.
Lawful basis and consent
AskVault doesn't make decisions about lawful basis on your behalf. You determine the basis for processing visitor and end-user data (consent, legitimate interest, contractual necessity, etc.).
Breach notification
If AskVault detects a security incident affecting customer data, we notify affected customers without undue delay once it is confirmed. Notification goes to the workspace owner's email plus any designated security contacts.
Customers are responsible for telling their own affected end users without undue delay. The 72-hour GDPR window is the deadline for notifying the supervisory authority, where a notification is required.
DPIA support
For customers conducting a Data Protection Impact Assessment (DPIA) for a high-risk processing use case (e.g., automated decision-making, large-scale processing of special-category data), the DPA, the sub-processor list and data handling describe how data is processed. Contact [email protected] with specific questions.
Common pitfalls
Customer asks for export, you can't find their data. They might be searching by an email that wasn't used during the conversation. Search by phone or name as well.
Deleted data shows up in old exports. Past exports are point-in-time snapshots; they don't reflect post-export deletions. Run a fresh export after every material deletion.
End user asks for full erasure, but you have legal obligation to retain. Some data (financial transactions, fraud-related logs) has retention requirements that override the erasure right. Document the legal basis and explain to the end user.
International data transfer concerns. If your end users are EU residents and you're concerned about US processing, the transfer is covered by Standard Contractual Clauses (see EU data residency above); talk to [email protected] if that isn't sufficient for your use case.
FAQ
Is AskVault registered with a data protection authority?
AskVault operates from India, where the Digital Personal Data Protection Act, 2023 applies. This page does not claim a data protection authority registration. For EU transfers, see the DPA.
Can I get a signed SCC?
Standard Contractual Clauses are included with the DPA, which is available on request — email [email protected].
How long do you keep conversations and audit logs?
Conversation retention is tiered by plan: 7 days on Free, 30 days on Starter, 90 days on Growth, and 365 days on Business and Enterprise. Audit log entries are deleted after 365 days on every plan.
What happens to my data if I cancel my AskVault subscription?
Cancelling does not by itself delete your workspaces. To remove your data, delete the workspace or your account from Settings, as described under Right to erasure. Export anything you need first. Free-plan workspaces that stay inactive can be paused and later removed; the owner is emailed before that happens.
Can my end users contact AskVault directly for their data?
End users should contact you, the Data Controller. We don't have a direct relationship with your end users; we process their data on your behalf. If they write to us, we forward the request to you without delay, tell them we have done so, and leave the reply to you (see When an end user contacts AskVault directly).