Privacy Policy

Askana provides a multi-tenant software platform that enables organizations to deploy grounded, document-based AI assistants. We recognize that the documents you upload contain valuable business knowledge, policies, and intellectual property.

Our commitment to privacy is straightforward: we do not sell your personal data or monetize your uploaded documents, and we do not use your proprietary documents or customer queries to train foundation AI models.

We collect the information necessary to operate, authenticate, and maintain the platform, including:

• Account & Profile Information: Name, work email address, company affiliation, user role (Company Admin, Department Member, or Super Admin), and secure authentication credentials, such as salted and hashed passwords or Google OAuth tokens.
• Company Knowledge Documents: Files you explicitly upload, such as PDFs, Markdown files, or text documents, for indexing. These files are processed into semantic chunks and vector embeddings stored in an isolated database.
• AI Provider Credentials: API keys, such as OpenAI API keys, supplied by your Company Admin to enable embeddings and AI completions. These credentials are encrypted at rest using AES-256 encryption.
• Operational & Audit Data: Chat conversation histories, token consumption counts, helpfulness ratings, error logs, and request timestamps used by Company Admins for internal audit trails and quality oversight.
• Session Cookies: HTTP-only, secure cookies required to maintain your browser session and protect against Cross-Site Request Forgery (CSRF).

Your information is used strictly to provide the Askana service, including:

• Performing vector similarity searches to retrieve relevant passages from uploaded documents.
• Generating grounded chatbot responses based on retrieved knowledge chunks.
• Enforcing departmental boundaries to prevent unauthorized users from accessing documents outside their departments.
• Providing analytics, token usage reports, and audit logs to authorized Company Admins.
• Maintaining platform integrity, preventing abuse, and troubleshooting technical issues.

Askana integrates with external AI providers to generate embeddings and AI completions. When a user asks a question:

• The relevant query text and retrieved document excerpts are transmitted through encrypted API connections to the selected AI provider, such as OpenAI.
• Under standard commercial enterprise API terms, data submitted through API endpoints is not used to train or improve foundation models.
• We do not share your documents or conversation logs with third-party advertisers, data brokers, or marketing networks.

You maintain control over your organization's data.

• Document Deletion: When a Department Member or Company Admin deletes a document from the Knowledge Base, the original file, extracted text chunks, and corresponding vector embeddings are purged from active storage.
• Account Termination: When an organization terminates its subscription, company data, user accounts, and associated knowledge bases are deleted from production systems according to standard data lifecycle protocols.
• Audit Log Retention: Operational audit logs are retained for a designated period to support internal security investigations and compliance requirements.

We use multiple layers of security to protect your data:

• All network traffic is encrypted in transit using TLS 1.3.
• Third-party API credentials and sensitive tokens are encrypted at rest.
• Multi-tenant row-level isolation ensures that one company's or department's queries do not access another's data.
• Role-based access controls prevent regular members from modifying company billing or API configurations.

We apply strict security controls, but no internet service can guarantee complete immunity from risk. We encourage users to report potential vulnerabilities directly to our security team.

Depending on your jurisdiction, you may have the right to access, review, correct, or request the deletion of personal information held by Askana. Because our software is used by corporate employers and organizations, requests concerning departmental records may also need to be coordinated with your Company Administrator.

For privacy inquiries, compliance reviews, or data deletion requests, contact us at: