Privacy Notice
Last updated 17 June 2026 · GDPR (Regulation (EU) 2016/679)
Template notice. This is a starting-point privacy notice for Ask Bob. Review and adapt it with qualified legal counsel before using it in production — bracketed details (legal entity, address, supervisory authority) must be completed.
1. Who we are
Ask Bob (“we”, “us”) operates the Ask Bob procurement platform at getaskbob.com. For the personal data described here, the data controller is [Ask Bob legal entity, registered address]. You can reach us at hello@getaskbob.com, and our data protection contact at dpo@getaskbob.com.
Where you use Ask Bob on behalf of your employer, your organisation is the controller of the procurement data in your account and we act as its processor under a Data Processing Agreement; this notice then describes our own processing as well as the processing we carry out on their instructions.
2. What we collect
- Account data — name, work email, organisation, role, and authentication credentials.
- Quote & case content — the supplier quotes, documents, and context you upload or paste, and the structured data, benchmarks, negotiation messages, and decisions derived from them.
- Supplier contact data — names and email addresses you provide to enable negotiation.
- Usage & technical data — log data, device/browser information, and security events needed to run and protect the service.
- Communications — messages you send us (support, demo requests).
3. Why we use it, and our legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Provide and operate the platform (parse quotes, run market intel, negotiate within your mandate) | Performance of a contract |
| Authenticate users and keep accounts secure | Contract; legitimate interests (security) |
| Maintain an audit trail of agent actions and costs | Legitimate interests; legal obligation |
| Respond to enquiries and provide support | Legitimate interests |
| Non-essential cookies / optional communications | Consent (you may withdraw at any time) |
4. Automated processing & AI
Ask Bob uses AI agents to parse quotes, benchmark prices, and draft and send negotiation messages. On your instruction we send automated emails to your suppliers on your behalf; each message identifies Ask Bob as the buyer’s assistant and sets a reply-to address routing back to your team. These agents operate only within a mandate you approve, and any irreversible step — approving spend, sending to a supplier — pauses for explicit human confirmation. We do not make decisions producing legal or similarly significant effects about you solely by automated means without that human involvement. Supplier free text is handled through a constrained boundary and is never executed as instructions.
5. Who we share it with
We use a small set of subprocessors to run the service. Each is bound by data-processing terms and, where relevant, EU Standard Contractual Clauses:
| Subprocessor | Purpose | Region |
|---|---|---|
| Supabase | Database, authentication, storage | EU (eu-west-1) |
| Anthropic | LLM processing for agent tasks | US — SCCs |
| Resend | Transactional & negotiation email | US — SCCs |
| Exa | Market-intelligence search | US — SCCs |
| Stripe | Billing & payments | US/EU — SCCs |
| Vercel | Application hosting | EU regions |
| Sentry | Error monitoring | EU — SCCs |
A current subprocessor list is available on request at dpo@getaskbob.com.
6. International transfers
Your account and case data are primarily stored and processed in the EU. Where a subprocessor processes data outside the EEA, we rely on adequacy decisions or EU Standard Contractual Clauses together with supplementary measures.
7. How long we keep it
We keep account and case data for as long as your organisation’s account is active, then delete or anonymise it within [retention period, e.g. 90 days] of account closure, unless a longer period is required by law (for example, billing records). Audit records are retained for [period] to meet accountability obligations.
8. Your rights
Under the GDPR you have the right to: access your data; rectify it; erase it (“right to be forgotten”); restrict or object to processing; data portability; and to withdraw consent at any time where processing is based on consent. To exercise any of these, contact dpo@getaskbob.com; we respond within one month. You also have the right to lodge a complaint with your supervisory authority [name of lead supervisory authority].
9. How we protect your data
We enforce row-level access controls, encryption in transit and at rest, least-privilege service credentials kept server-side, an append-only audit log, and a kill-switch on every agent. Access to production data is restricted and logged.
10. Cookies
We set only strictly-necessary cookies and load no analytics or advertising trackers by default. See our Cookie Policy for details and how to manage your choice.
11. Changes
We may update this notice; we will post the new version here and update the date above. Material changes will be communicated through the platform.