[ Last updated: October 27, 2026 ]
How we use your information, the services involved and the choices you control.
This policy explains how ShareOfAsk handles personal data when you visit our website, use the application, run a Free Scan, pay for a subscription or contact us. The "Analytics" section explains what we measure and what your cookie choice changes.
ShareOfAsk is operated by Marcin Pastuszek, trading as 10 Seats Agency, ul. Strażacka 4, 66-446 Deszczno, Poland, NIP 5993134291.
For privacy questions and requests to access, correct or delete your data, email privacy@shareofask.com.
We are responsible for the processing described below where we decide its purposes and means. If your employer, agency or another organization supplies information or gives you access, that organization also has responsibilities for how it uses the service. For information processed only on its instructions, contact that organization, or contact us and we'll help direct your request. This doesn't limit your rights for processing we are responsible for.
Account and organization information. We use names, email addresses, sign-in information, organization membership, roles and account settings. If you choose Google sign-in, Google provides the account identifier and basic profile information used to sign you in, such as your name, email address and verification status.
Workspace information and results. We process brand and competitor names, websites, markets, business descriptions, tracked questions, AI answers, cited sources, reports and Actions. You or an authorized member of your organization supply some of this information. Other information comes from model and search-data providers or publicly accessible websites, including pages and discussions cited in AI answers. These materials can contain personal names, professional contact details or other information about individuals. Please don't supply confidential information or personal data the analysis doesn't need.
Billing information. Stripe processes payments. We receive subscription and payment records, billing contact and address information, tax details and payment notifications. We need these to manage your subscription, reconcile payments and handle disputes. Payment notifications can contain transaction details as well as a payment status.
Support information. We process messages and contact details you provide, together with relevant account and technical information. On the website, the support chat ("Chat via ProjectHQ") is provided by ProjectHQ (projecthq.pro) and loads through Google Tag Manager. Its script loads only after you click the chat button. When it loads, ProjectHQ receives your IP address, device information and the messages you send, and records which site referred you. The messages can include information you supply and the page you contact us from. Legal basis: providing the support you asked for (Art. 6(1)(b) GDPR) and our legitimate interest in answering support requests (Art. 6(1)(f) GDPR).
Technical and security information. Servers and service providers process network and device information, such as IP addresses, browser details, timestamps, authentication events and diagnostic records. We also keep records of Free Scan use to apply the one-time Free Scan rule. Loading an external resource can disclose request information to its provider, even without a cookie.
If you sign up for our newsletter, we collect the email address you enter and your consent checkbox choice. We use your email address only to send you occasional ShareOfAsk emails, and we rely on your consent (Art. 6(1)(a) GDPR). The sign-up form is processed and stored by Webflow, our website host.
You can unsubscribe or ask us to delete your email address at any time by writing to privacy@shareofask.com.
Analytics on the website (www.shareofask.com). Google Tag Manager (GTM-TT5RJXVM), provided by Google, loads on every page. It includes our consent manager, which shows the cookie banner and stores your choice.
PostHog, provided by PostHog Inc. and hosted in the EU, loads through Google Tag Manager on every page. Before you make a choice, PostHog keeps data in your browser's memory only and sends one anonymous page view. It doesn't record web addresses' query strings, capture clicks or record sessions. Legal basis: our legitimate interest in measuring how the website is used (Art. 6(1)(f) GDPR). You can object at any time. Email privacy@shareofask.com. If you accept analytics cookies, PostHog uses browser storage (localStorage) and a cookie, shared across shareofask.com subdomains. If you reject before PostHog loads, it isn't loaded and its cookies are deleted. If you reject later, PostHog stops tracking, resets and removes its browser storage.
Google Analytics 4, provided by Google, loads on the website and in the application with analytics storage denied until you accept analytics cookies. Before your choice, and after you reject those cookies, it sends limited cookieless measurement signals, including controlled page views and, in the application, viewing Free Scan results. Basic events exclude URL query strings, private application paths and account identifiers. Google still receives network and device information when its tag communicates with Google; cookieless does not mean anonymous. If you accept analytics cookies, GA4 can use browser identifiers and fuller measurement to connect activity across visits. Google Signals, user-provided data collection and advertising personalization remain off; Google advertising storage and user-data consent remain denied. A website sign-up click is not a completed registration. We use limited measurement to understand use of the service on the basis of legitimate interest (Art. 6(1)(f) GDPR); analytics cookies and fuller measurement rely on your consent (Art. 6(1)(a) GDPR). Change your choice in Privacy settings on the website or Cookie settings in the application. To object to basic measurement, email privacy@shareofask.com.
Analytics in the application before you sign in. Before you make a cookie choice, or if you reject analytics cookies, PostHog records limited information without cookies or browser storage. It uses a random identifier kept in your browser's memory for that visit only. It records the pages you view (as page types, not full addresses), campaign (UTM) parameters, the domain of the site you came from, whether you started a Free Scan, viewed its results or clicked a link from them, and whether you viewed pricing.
Analytics in the application when you are signed in. When you are signed in, we send PostHog your user ID, email address, first name, plan, organization ID and name, and usage events. We use this to understand how the product is used, to help you when you contact support and to find and fix errors. If you haven't accepted analytics cookies, PostHog keeps this in your browser's memory only, with no cookies or browser storage. Your cookie choice doesn't stop this processing. Events include page views, sign-in and project activity, scan availability, viewing Actions and checkout interactions. They can contain browser and device information; organization, project, scan and analysis identifiers; and status, attempt and action counts. We don't include question or answer content or access tokens. Our server also tells PostHog when a Free Scan is claimed, completed or failed, so we can run and deliver your Free Scan.
Legal basis: performing our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in running, supporting and improving the service (Art. 6(1)(f) GDPR). You can object to the processing based on legitimate interest at any time. Email privacy@shareofask.com. See "Your rights".
Analytics in the application after you accept analytics cookies. If you accept analytics cookies in the application's Cookie settings:
We rely on your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the application's Cookie settings.
PostHog hosting. PostHog Inc. processes this data for us as our processor, under its terms, on PostHog Cloud EU, hosted in the EU. IP addresses are anonymized for all events. PostHog keeps events for 1 year and session replays for 30 days. See PostHog's data-storage information.
| Purpose | Basis for processing |
|---|---|
| Create and operate your account; provide scans, reports and Actions; manage subscriptions; respond to service requests | Performing our contract with you, or taking steps you ask for before a contract. For representatives of a business customer: our legitimate interest in providing and administering the business service. |
| Analyze business information from submitted questions, AI answers and public sources to measure brand visibility | Where we decide the processing: our legitimate interest in providing accurate business visibility analysis, subject to the rights and interests of the people concerned. Where we act only on a customer's instructions, the customer is responsible for its lawful basis. |
| Secure the service, diagnose failures, prevent abuse and handle legal claims | Our legitimate interests in protecting the service, its users and our legal rights; legal obligations where they apply. |
| Keep tax, accounting and other legally required records | Compliance with legal obligations. |
| Provide the website support chat you open, including ProjectHQ's referrer tracking for that chat (ProjectHQ) | Providing the support you asked for (Art. 6(1)(b) GDPR) and our legitimate interest in answering support requests (Art. 6(1)(f) GDPR). |
| Measure basic use of the website and application without analytics cookies or ad click identifiers (limited GA4 signals, OpenAI basic events before an advertising choice, and the website's initial PostHog page view) | Our legitimate interest in understanding use of the service and the effectiveness of acquisition (Art. 6(1)(f) GDPR), subject to your rights and interests. You can object. OpenAI basic measurement stops when you turn Ad measurement off. For other objections, email privacy@shareofask.com. |
| Measure website use with fuller analytics after you accept analytics cookies (Google Analytics 4; PostHog cookie and browser storage) | Your consent given in the website's Cookie settings (Art. 6(1)(a) GDPR). You can withdraw it at any time in Cookie settings. |
| Measure how people use the application before they sign in, without cookies or browser storage (PostHog) | Our legitimate interest in understanding how people find and use the service (Art. 6(1)(f) GDPR). You can object. Email privacy@shareofask.com. |
| Understand how signed-in users use the product, support them, fix errors, and run and deliver Free Scans (PostHog) | Performing our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in running, supporting and improving the service (Art. 6(1)(f) GDPR). You can object to the processing based on legitimate interest. Email privacy@shareofask.com. |
| In the application, after you accept analytics cookies: cookies and browser storage, click and error capture, page performance, limited session replay (PostHog) and fuller Google Analytics 4 measurement | Your consent given in the application's Cookie settings (Art. 6(1)(a) GDPR). You can withdraw it at any time in Cookie settings. |
| Handle privacy requests and keep evidence of compliance | Legal obligations that apply, and our legitimate interest in documenting how we handled requests. |
We need certain information to deliver a requested function, such as an email address to operate an account or billing details for a subscription. If you don't provide it, we may be unable to provide that function.
AI answers and Actions are generated automatically and can be inaccurate. They provide business analysis and recommendations. They aren't decisions about your legal rights. You can contact us about inaccurate personal information that appears in a result.
To run the checks and analysis you ask for, we send relevant questions and context to the selected model or search-data provider. Depending on the function, this can include business descriptions, website text, AI answers, source URLs and measured results. We don't claim these inputs are necessarily anonymous. We don't promise that every provider applies the same data-use or retention terms.
| Service | Provider and information involved |
|---|---|
| Website delivery | Webflow and its delivery infrastructure receive the browser and network requests needed to serve the website and its assets. |
| Application hosting and storage | Hetzner hosts application services and stored service information. |
| Payments | Stripe receives payment and billing information and sends subscription and transaction notifications. |
| Google sign-in | Google exchanges the account information needed for the sign-in method you select. |
| Service emails | Mailgun processes recipient details and account-related messages, including verification, password resets, invitations and results notifications. |
| Error monitoring | Sentry processes diagnostic information and, where relevant, a technical account identifier to investigate faults. |
| Analytics (Google) | Google provides Google Tag Manager, which loads on website pages and includes the consent manager, and Google Analytics 4. On the website and in the application, GA4 uses limited cookieless measurement while analytics storage is denied and fuller measurement after analytics consent. Google advertising categories remain denied. |
| Product analytics | PostHog Inc. (PostHog Cloud EU) processes analytics as our processor. On the website, it loads through Google Tag Manager and sends one anonymous page view before any choice, then uses a cookie and browser storage only after consent. In the application, it processes the signed-in and anonymous data described in "Analytics" and, after consent, click, page-performance and error data and limited session replays. IP addresses are anonymized for all events. |
| Support chat (with referrer tracking) | ProjectHQ (projecthq.pro) provides the website's support chat, including referrer tracking for the chat you open. Support chat: loaded through Google Tag Manager, only after you click the chat button. ProjectHQ then receives your IP address, device information and chat messages. Referrer tracking: once you open the chat, ProjectHQ's tracker records which site referred you, using the phq_ref cookie and projecthq_* browser storage. |
| AI and search analysis | Depending on the model and function selected, integrations include OpenAI, Anthropic, Google Gemini, Perplexity and xAI, and DataForSEO for relevant Google AI search results. Not every provider receives every check. |
| External resources | Google-hosted fonts, scripts and website icons can receive browser and network requests when those resources load. |
Providers can have different roles. Some process information on our instructions. Others have their own responsibilities, such as Stripe's fraud prevention and regulatory obligations, or Google's operation of a Google account. Their own notices explain those separate activities. See, for example, Stripe's privacy notice, Google's privacy notice and Webflow's privacy notice.
Your organization's authorized users can see information according to their permissions. If you or another authorized user creates a sharing link, people with access to that link may see the shared report. We may also disclose relevant information to professional advisers, where the law requires it, or as part of a lawful business transfer.
Some providers and their support or infrastructure operations are outside the European Economic Area, including in the United States. A European hosting location doesn't by itself mean that all access and processing stay in Europe.
Providers' published transfer arrangements include the European Commission's Standard Contractual Clauses and, where they apply to the recipient and transfer, adequacy decisions. The arrangement depends on the service and recipient. A provider's certification doesn't cover every possible transfer. Email privacy@shareofask.com to learn which safeguards apply to your data and how to get a copy. Providers' notices also describe their international processing.
Necessary cookies and browser storage support sign-in, security, service functions and remembering your privacy choice. Blocking necessary storage in your browser can stop a requested function from working.
Use Privacy settings on the website or Cookie settings in the application to accept or reject analytics cookies and Ad measurement, or to change or withdraw your choice. The website and the application store choices separately; a choice on one does not apply to the other. The website's cc-settings cookie and the application's soa_consent cookie remember your choice for 182 days. You can change it sooner or clear your browser storage.
Cookies and browser storage on the website:
| Name | Type | Provider | Purpose | Category | When it's set | On Reject |
|---|---|---|---|---|---|---|
| cc-settings | Cookie (first-party, set by our consent manager) | ShareOfAsk | Stores your cookie choice for 182 days | Necessary | When you make a choice | Kept (it stores the Reject choice) |
| projecthq_exclude=true | localStorage | ProjectHQ | Set when you open the support chat | Functional | When the chat opens | Kept |
| phq_ref | Cookie | ProjectHQ | Referrer tracking: records which site referred you, as part of the chat you open | Functional | When you open the support chat | Removed |
| projecthq_* (other keys) | localStorage | ProjectHQ | Support chat and its referrer tracking | Functional | When you open the support chat | Removed |
| _ga, _ga_* | Cookie | Google Analytics 4 measurement | Analytics | Only after you accept | Removed | |
| ph_<key>_posthog | Cookie and localStorage | PostHog | PostHog analytics identifier, shared across shareofask.com subdomains | Analytics | Only after you accept | Removed (PostHog resets) |
Google Analytics 4's _ga and _ga_* cookies are set only after consent, on the website and in the application. Their lifetime in your browser is separate from the server-side retention described below. ProjectHQ's support chat loads only when you click the chat button. Once you click the chat button and confirm opening the chat, ProjectHQ sets its phq_ref cookie and projecthq_* storage keys, and records which site referred you. If you reject analytics cookies, they are still removed, except projecthq_exclude.
If you reject analytics cookies on the website, Google Analytics 4 continues limited cookieless measurement with analytics storage denied. We remove its _ga and _ga_* cookies, ProjectHQ's phq_ref cookie and its projecthq_* storage keys, except projecthq_exclude, which the chat needs. PostHog isn't loaded, or, if it's already running, it stops tracking, resets and removes its cookie and browser storage.
If you reject analytics cookies in the application, Google Analytics 4 continues limited cookieless measurement with analytics storage denied, and PostHog stops using cookies, browser storage, click and error capture and session replay. This doesn't stop the limited in-memory processing described in "Analytics". If you are signed in, account analytics continues on the basis of contract and legitimate interest. To object to basic analytics or account analytics, email privacy@shareofask.com.
Withdrawing doesn't undo processing already carried out, or delete events a provider has already received. You can ask for deletion separately. The website and application stay available whatever you choose.
Before you make an Ad measurement choice, our servers send OpenAI limited page-view, completed-registration and first-paid-plan events. These basic events include a random event identifier, the event time and type, a fixed public website or application URL and, for purchases, amount and currency. They do not include your name, email, phone number, account identifier, IP address, browser user agent or advertising click reference. OpenAI receives our server's network information. These signals do not guarantee attribution to an advertisement. We use this limited measurement to understand acquisition on the basis of legitimate interest (Art. 6(1)(f) GDPR); you can object by turning Ad measurement off.
If you allow Ad measurement, an OpenAI image pixel and server-side conversion events can also use an advertising click reference to measure whether ads lead to visits, registrations and purchases. The image request exposes your IP address and basic browser request information to OpenAI. This fuller advertising measurement uses your consent (Art. 6(1)(a) GDPR). Purchases include amount and currency. Our integration does not load the OpenAI JavaScript SDK, read customer form fields for automatic matching, or send names, email addresses, phone numbers or account identifiers to OpenAI. Clicking a website link is not treated as a completed registration or purchase.
After advertising consent, we store an ad click reference in the first-party soa_openai_ads_oppref cookie for up to 30 days. It may accompany a link to app.shareofask.com, where the application applies its own advertising choice. The website's soa_openai_ads_consent cookie remembers the choice for up to 182 days. Server attribution references remain until withdrawal or context expiry, for at most 182 days. Pending event payloads are retained for at most 7 days and erased after delivery or final failure. Page-view records are removed after 7 days. Minimal basic-conversion deduplication and account-level refusal records remain while the account exists. Minimal deduplication and revoked-context records for consented attribution are retained without a preset expiry to prevent duplicate conversions and replay of a withdrawn context. The application also keeps a local refusal receipt until a fresh explicit grant or browser-storage deletion.
Turning Ad measurement off stops future OpenAI measurement in that website or application context. A refusal in the application is remembered locally and, after sign-in, at account level so that a later plan payment is not reported. A fresh explicit grant can enable future measurement again. Website and application choices are stored separately. Changing a choice cannot recall events already sent. Unidentified page views cannot be linked retrospectively to a later refusal. Use Privacy settings on the website or Cookie settings in the application to change your choice. Older Analytics consent does not grant Ad measurement.
Advertising and remarketing through Google Ads, Meta (Facebook and Instagram) and X remain planned. Their advertising pixels, remarketing tags and customer-list integrations are not active on ShareOfAsk. We do not upload customer lists to advertising platforms. Before introducing additional advertising purposes, we will update this notice and obtain any required consent.
Retention depends on the category and purpose. Access to a report, expiry of a browser cookie and deletion from servers are different things.
| Information | Retention period or criteria |
|---|---|
| Account, organization and workspace information | As long as we need it to operate the account or organization, provide the report history you asked for and resolve account closure or deletion requests. Longer retention can apply to records needed for a particular legal obligation, an unresolved dispute or a documented security issue. Canceling a subscription doesn't by itself erase all records. |
| Free Scan results | Results are available for 7 days. This is an access period, not an erasure deadline. Closing access doesn't automatically remove inputs, answers or related records. Retention also depends on whether the workspace continues under a subscription, on any deletion request, and on the eligibility and legal-record purposes below. |
| Free Scan eligibility records | Records that a Free Scan was used support the one-time Free Scan rule. We keep them while that rule needs them, subject to the deletion rights that apply. |
| Billing and legal records | The period required by the tax or accounting obligation that applies to the record, plus the time needed to resolve an outstanding payment, dispute or legal claim. These records may need to remain after the account closes. |
| Support conversations and diagnostics | The time needed to resolve the request or fault, and to keep relevant evidence for related follow-up, security incidents or claims. Factors include whether the matter is still open, whether the issue recurs and any legal requirement that applies. |
| Google Analytics 4 | User-level and event-level data retention is set to 14 months. After analytics consent, new activity renews the user-level period. This setting does not cover most standard aggregated reports and is not a universal retention limit for cookieless signals or all information Google holds. |
| PostHog analytics (website and application) | Events: 1 year. Session replays (application only): 30 days. Signed-in users can also ask for deletion of their profile (user ID, email address, first name, plan, organization ID and name) and events at privacy@shareofask.com. We then delete them within 30 days. |
| Consent records | Browser preference cookies are set for 182 days. Any separate evidence needed to answer a complaint or show consent is assessed against that specific purpose and the claim or legal requirement that applies. |
| Recovery copies and archives | The need to recover affected services or keep particular legally required records is assessed separately from live account access. We don't promise that removing a record from the application immediately removes every retained copy. A deletion request covers these copies as well as active systems, subject to lawful retention exceptions. |
To request deletion, email privacy@shareofask.com. Account deletion is handled through this contact. You can't yet do it yourself in the application. We assess what can be deleted, what must remain for a specific lawful purpose and whether service providers also hold relevant records. We explain any exception that applies. Our deadline for answering a request isn't a promise that every technical copy is erased in that same period.
Subject to the applicable conditions, you can ask for access to, correction or deletion of your personal data, restriction of processing and data portability. You can object at any time to processing based on our legitimate interests (Art. 21 GDPR), including analytics in PostHog. Email privacy@shareofask.com. We will then stop that processing unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need it to establish, exercise or defend legal claims. You can withdraw analytics consent in the application at any time in Cookie settings. Where applicable, you can object to direct marketing, including related profiling.
Send requests to privacy@shareofask.com. We may need proportionate information to verify your identity. We normally respond within 1 month. If the complexity or number of requests means we lawfully need more time, we will tell you within that first month.
You can complain to the President of Poland's Personal Data Protection Office (UODO) or another competent supervisory authority. Contact details are on the UODO website.
We update this notice when our processing changes. The date at the top shows the current version. Where a new purpose requires consent, we will ask for it. Continuing to use the service doesn't count as consent to new optional processing.
Start with a one-time Free Scan. Choose a plan when you want daily tracking.
