Skip to main content

Privacy Policy

Who We Are

Askara Solutions OÜ is the controller for the personal data described in this notice. We are registered in Estonia under registry code 17233369, at Ahtri 12, Tallinn 15551, Estonia.

For anything about your data, including the rights set out below, write to privacy@askara.solutions.

We have not appointed a Data Protection Officer. Article 37 of the GDPR requires one only where an organisation is a public authority, carries out large scale regular and systematic monitoring, or processes special category data at large scale, and none of those describes us. Data protection questions go to the privacy address above and are answered by a person, not a queue.

Scope of This Notice

This notice covers the Askara Solutions websites at askara.solutions and its subdomains, including the blog and the ROI calculator. It is one notice for all of them because they are one service operated by one controller. Our community runs on a separate platform under its own privacy notice and terms of use, and this notice does not govern it.

Information We Collect

We collect information you provide directly to us, such as when you send us an enquiry, subscribe to our newsletter, ask for a guide, join a waitlist, or buy an agent. This may include your name, email address, company information and your message.

Our agents run in your own Claude Code against data you already own. Askara Solutions holds none of your management system data, and is not a processor of your personal data. What we do hold, as our own controller, is your contact and purchase details, which is what the rest of this notice is about.

Legal Bases for Processing

Each thing we do with your data has its own lawful basis under Article 6 of the GDPR, rather than one basis covering everything. Where we rely on legitimate interest, the interest is named so you can weigh it. Where we rely on consent, you can withdraw it at any time.

  • We process your data to respond to your enquiry. Our basis is legitimate interest: our interest in answering someone who has asked us a question, which is also why you contacted us.
  • We process your data to handle your support request, or an issue we raise ourselves about your purchase, and respond to you. Our basis is legitimate interest, or contract where you have bought from us: our interest in supporting people who use what we publish.
  • We process your data to take your payment and give you what you bought. Our basis is contract: we cannot deliver a purchase without processing it.
  • We process your data to keep the accounting and tax records we are required to keep. Our basis is legal obligation: Estonian accounting and tax law sets both the obligation and the period.
  • We process your data to keep a record of you as a customer, so we can support you and follow up on what you bought. Our basis is legitimate interest: our interest in knowing who our customers are and what they have bought, so that a question or a renewal reaches someone who has the history.
  • We process your data to send you product updates, where you asked for them when you bought. Our basis is consent: you ticked an optional box, which starts unticked, on the licence page before you paid, and you can unsubscribe from any message we send.
  • We process your data to send you our newsletter. Our basis is consent: you asked for it and confirmed that request by email, and you can withdraw at any time from any message we send.
  • We process your data to send you the guide you asked for. Our basis is consent: you requested a specific document and we send that document.
  • We process your data to tell you when an engine you asked about is ready. Our basis is consent: you asked to be told, confirmed it by email, and can leave from any message we send.
  • We process your data to understand how the site is used. Our basis is consent: analytics cookies are set only after you accept them, and refusing changes nothing about how the site works for you.
  • We process your data to see how quickly pages load for real visitors. Our basis is legitimate interest: our interest in knowing whether the site is slow for the people using it, measured without a cookie and without anything that identifies you.
  • We process your data to keep the site available and protect it from abuse. Our basis is legitimate interest: our interest in a site that stays up and is not used to attack us or you.
  • We process your data to remember your cookie choice. Our basis is legal obligation: we have to be able to show that you were asked and what you answered, which means keeping a record of it.

How Long We Keep Your Data

Each category has its own period, because they are kept for different reasons. Where a period depends on something you do, the trigger is stated instead of a number.

  • Enquiry records (your name, email address, company name, enquiry type, your message, and the page you sent it from): kept 24 months from our last contact with you about it.
  • Support records (your name, email address, issue type, your message and any file you attached, or, where we raise the issue ourselves about a purchase that did not complete, your email address and the details of what went wrong): kept 24 months after the issue is closed.
  • Newsletter, guide and product update subscriptions (your email address, and which list you joined): kept until you unsubscribe, after which we keep your address on a suppression list indefinitely so we cannot add you back without your consent.
  • Guide request records (your name, email address, company name, and the reason you gave for wanting the guide): kept until you unsubscribe, after which we keep your contact record on a suppression list indefinitely so we cannot add you back without your consent.
  • Waitlist records (your email address, and which waitlist you joined): kept until the waitlist closes or you unsubscribe, after which we keep your address on a suppression list indefinitely so we cannot add you back without your consent.
  • Performance measurements (page load timings and which page was measured. No cookie is set and nothing here identifies you): kept aggregated on collection, so nothing is kept against you at all.
  • Marketing consent records (the fact that you opted in, when, from which form, and when you confirmed it by email): kept indefinitely, alongside the suppressed contact record it evidences, so we can show consent was given and later withdrawn if ever asked.
  • Purchase and invoice records (your name, billing address, VAT number where you gave one, what you bought and what you paid. Your card details never reach us): kept 7 years, which is the period Estonian accounting law sets.
  • Customer records (your name, email address, your company where you gave one, what you bought, what you paid excluding VAT, when, and our payment provider's reference for the purchase): kept for as long as you are a customer, and for 24 months after that.
  • Product update consent records (whether you ticked the product updates box when you bought, and which version of its wording you were shown): kept with the purchase record it is part of, which is 7 years.
  • Licence acceptance records (which version of the licence you accepted, and when): kept 7 years, matching the purchase record it evidences.
  • Server and edge logs (your IP address, the pages requested, timestamps and basic browser information, plus a buyer's email address when a paid delivery to them fails): kept up to 7 days.
  • Rate limiting counters (a count of recent requests, kept against your IP address): kept 10 minutes at most, and nothing is kept beyond it.
  • Analytics records (pages viewed, session information and the journey through the site, collected only if you accept analytics cookies): kept 14 months in Google Analytics. The cookies themselves last up to two years in your browser, and the cookie section below states each one.
  • Your cookie choice (which categories of cookie you accepted or refused): kept 6 months, as the cookie section below also states.

Processors and Sub-processors

We do not sell or trade your personal information. These are the third parties that receive it, named as the entity that actually contracts with us rather than the brand, because the entity is what tells you who holds your data and under whose law.

Each of them engages its own sub-processors, and each publishes that list. We link to those lists rather than copying them, because a copy here would go out of date the moment a vendor changed theirs and nothing would tell us.

  • Pipedrive (Pipedrive OÜ, Estonia, EU): the customer relationship system we use to answer enquiries, track the conversation, and keep a record of what our customers have bought. Their sub-processor list.
  • Brevo (Brevo SAS, France, EU): the email service that confirms your enquiry, delivers it to us, sends the newsletter and any guide you request, runs the waitlists, sends your access link after you buy, and sends product updates if you asked for them. Their sub-processor list (published as an annex to their data processing agreement rather than as a separate page).
  • Stripe (Stripe Payments Europe, Ltd, Ireland, EU): the payment processor. Checkout happens on a page Stripe hosts, so your card details never reach us. Their sub-processor list.
  • Linear (Linear Orbit, Inc., United States): the issue tracker our team works from, which receives support requests. Their sub-processor list (listed as Exhibit B to their data processing agreement).
  • Google Analytics and Tag Manager (Google LLC, United States): analytics and the tag container, loaded only after you accept analytics cookies. Their sub-processor list.
  • Vercel (Vercel Inc., United States): hosting. Every request to this site is served by Vercel, which also keeps edge logs, runs the firewall that rate limits abusive traffic, stores the video and images your browser loads from this site, and measures page performance without cookies. Their sub-processor list.
  • Netlify (Netlify, Inc., United States): hosting. Hosting is moving from Vercel to Netlify, so for the length of that move both are named. Netlify serves requests to this site, keeps edge logs, and holds the per address counters that rate limit abusive traffic. Their sub-processor list (opens their trust centre, where the list is published).

We may also share information when the law requires it, to protect our legal rights, or in connection with a business transfer.

Buying an agent does not add you to our newsletter list. You join that list only by ticking a marketing opt-in on one of our forms and confirming through the email Brevo then sends you.

When you buy an agent, the licence page you accept before paying has an optional box for product updates, which starts unticked. Only if you tick it do we add you to our product updates list, and you can unsubscribe from any message we send.

Automated Decision-Making

No decision that produces legal effects for you, or similarly significantly affects you, is made solely by automated means. Two automated processes do act on you, and it is fairer to name them than to leave them out.

  • Payment fraud screening, run by Stripe, on the checkout page it hosts: a payment can be declined. If that happens and you think it is wrong, contact us and a person will look at it.
  • Rate limiting, run by our hosts, Vercel and Netlify, in front of this site: a request can be refused when too many arrive from one address in a short time, and on the purchase page Vercel may ask you to pass a check instead. This is counted against your IP address and nothing is kept beyond the counting window.

International Transfers

Some of the processors above are outside the EU. For each of those, we rely on a transfer mechanism rather than on the country having equivalent law, and the mechanism is named so you can check it.

  • Linear (United States): Standard Contractual Clauses, together with the UK Addendum where relevant, under their data processing agreement.
  • Google Analytics and Tag Manager (United States): the EU to US Data Privacy Framework, with Standard Contractual Clauses as the fallback under their Ads data processing terms.
  • Vercel (United States): the EU to US Data Privacy Framework, with Standard Contractual Clauses in their data processing addendum.
  • Netlify (United States): the EU to US Data Privacy Framework, with Standard Contractual Clauses in their data processing agreement.

Your Rights

You have the right to ask for a copy of your personal data, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time, and doing so does not affect what we did before you withdrew it.

Write to privacy@askara.solutions. We will answer within one month, and tell you if we need longer and why.

If you are not satisfied with our answer, you can complain to our supervisory authority, Andmekaitse Inspektsioon (the Estonian Data Protection Inspectorate). You can also complain to the authority in your own country, wherever you live or work in the EU, rather than having to come to ours.

Cookies and Tracking Technologies

We use cookies and similar technologies to operate our website. These are managed through our cookie consent banner, which you can access at any time by clicking "Cookie Settings" in the site footer.

Consent preferences are stored in a cookie on the .askara.solutions domain and shared across all Askara Solutions sites. We use three categories of cookies:

Essential cookies (always active)

These are required for the website to function. They cannot be disabled.

  • askara_consent (6 months): Stores your cookie consent preferences for 6 months.
  • nis2_guide_token (7 days): Authenticates access to the NIS2 applicability guide after form submission. HttpOnly, expires after 7 days. Scoped to /nis2-guide.
  • skills_access_token (12 months): Authenticates access to the Risk Investigation Agent skill download after Stripe purchase. HttpOnly, expires after 12 months. Scoped to /.

Analytics cookies (optional, requires your consent)

These help us understand how visitors use the site. Data is aggregated and does not identify individual users.

  • _ga (2 years): Google Analytics 4 measures page views, sessions, and user journeys. Retained for 2 years. Provided by Google LLC, USA.
  • _ga_* (2 years): Google Analytics 4 measures page views, sessions, and user journeys. Retained for 2 years. Provided by Google LLC, USA.

These cookies are set by Google Analytics 4 (Google LLC, USA), measurement ID G-T2490CGCP9, which is loaded and managed through Google Tag Manager, container ID GTM-TQ2QSBVQ. Google Tag Manager is the single deployment mechanism for all third-party tracking tools on this site and does not itself set analytics cookies, which is why it is described here rather than listed above.

Marketing cookies (optional, requires your consent)

These support our marketing and newsletter operations.

  • __brevo_* (Session): Brevo Tracker tracks newsletter engagement and marketing interactions. Provided by Brevo SAS, France/EU.
  • sib_* (Session): Brevo Tracker tracks newsletter engagement and marketing interactions. Provided by Brevo SAS, France/EU.

These cookies relate to subscribers only, and the data is processed under Brevo's privacy terms.

You can change your preferences at any time by clicking "Cookie Settings" in the website footer. Withdrawing consent will remove any non-essential cookies that have been set.

Performance monitoring (cookieless, no consent required)

Vercel Analytics (Vercel Inc., USA): Cookieless, privacy-friendly performance monitoring. Measures Core Web Vitals and page views without setting any cookies or collecting personally identifiable information. Does not require consent.

Updates to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on our website and updating the effective date.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: privacy@askara.solutions

Address: Askara Solutions OÜ, Ahtri 12, Tallinn 15551, Estonia

Last updated: 29 September 2026

Revision history

  • Version 11.0.0, effective 2026-09-29. Added "Sending product updates to a buyer who asked for them", on consent. The licence page you accept before paying for an agent now has an optional box for product updates, which starts unticked, and we add you to that list only if you tick it. We keep a record of your choice, and of the wording you were shown, with your purchase record. You can unsubscribe from any message we send.
  • Version 10.0.0, effective 2026-09-29. Removed three cookies from the list because this site does not set them: two older Google Analytics cookies, including the rate-limiting cookie added in 5.0.0, and a cookie described as remembering the state of a navigation sidebar. We checked by recording the cookies a browser actually receives from the site, with optional cookies both refused and accepted.
  • Version 9.0.0, effective 2026-09-29. Named Netlify alongside Vercel as a host that can refuse a request when too many arrive from one address. Only Vercel, and only on the purchase page, may ask you to pass a check instead. Server and edge logs are now kept for up to 7 days rather than 1, because that is what Netlify's plan keeps and both hosts serve the site during the move between them. The rate-limit counter still clears within 10 minutes; we no longer describe how its window resets, because Netlify does not document that. We also removed "slowed", because neither host slows a request.
  • Version 8.0.0, effective 2026-09-29. Added "Keeping a record of a customer", on legitimate interest. When a purchase completes, our customer relationship system, Pipedrive, now receives your name, email address, company, what you bought and what you paid, and keeps that record for as long as you are a customer and 24 months after. Before this, Pipedrive held only contact enquiries. The 7-year period for purchase and invoice records is unchanged and still applies to the invoice, not to this record.
  • Version 7.0.0, effective 2026-09-29. Widened "Handling a support request" to cover an issue we raise ourselves about a purchase, not only one the person submits. This is for a Linear issue raised when a paid fulfilment is dropped, carrying the buyer's email but nothing they wrote. Same basis, same data category, same 24-month retention: nothing about what is kept or for how long changed, only who can originate the record.
  • Version 6.0.0, effective 2026-09-21. Corrected six retention statements found wrong on verification: server and edge logs from an unconfirmed 30 days to the 1-day default Vercel's plan actually gives runtime logs, the rate-limit counter from a rolling window to the fixed window the Firewall rules actually run, and the newsletter, guide and waitlist subscriptions and the marketing consent record from an unsubscribe-triggered deletion nothing in our systems performs to the suppression they actually undergo.
  • Version 5.0.0, effective 2026-09-21. Disclosed three cookies the notice previously omitted: the Google Analytics rate-limiting cookie and the two Brevo tracking cookies. Every cookie is now listed with its purpose, how long it lasts and who provides it.
  • Version 4.0.0, effective 2026-09-21. Named Netlify as a processor. Hosting is moving from Vercel to Netlify, and both are named for the length of that move.
  • Version 3.0.0, effective 2026-09-16. Rewritten from the processing register: a legal basis for each purpose, a retention period for each category of data, every processor named with its region and its own sub-processors, the position on automated decision-making, the bases for transfers outside the EEA, the route to the supervisory authority, and why no Data Protection Officer is appointed.
  • Version 2.0.0, effective 2026-09-10. Disclosed Pipedrive, Stripe, Brevo and Linear as recipients, and corrected the customer-data position so it matches the wording of the agent licence rather than paraphrasing it.
  • Version 1.0.0, effective 2026-03-01. Initial publication of this privacy notice.