Privacy & data FAQ

Is AskAI.free GDPR compliant?

Short answer: Yes, we honour data-access, data-portability and right-to-be-forgotten requests, and we don't transfer EU personal data without standard contractual clauses in place.

Yes. Our privacy policy covers the EU GDPR requirements:

  • Right to access: request a copy of all data we hold on you, delivered within 30 days.
  • Right to portability: chat history exports as JSON.
  • Right to erasure: see how to delete your data.
  • Lawful basis: contractual necessity for the chat service, legitimate interest for abuse-prevention logging, consent for marketing emails.

Subprocessors (Stripe for billing, OpenAI/Anthropic/Google for AI inference, our cloud host) all operate under standard contractual clauses for EU-to-non-EU transfer where applicable.

To exercise any of these rights, email us from the address on your account and name the right you're invoking ("access request", "erasure request", "export request"). We verify by replying to that same address, then act within the GDPR's 30-day window; straightforward requests usually complete much faster. There's no form to find and no fee.

Two clarifications that come up often. First, the AI providers process your prompts as data processors during answering, but because API traffic is excluded from model training, your personal data doesn't end up baked into anyone's model weights. Second, data-minimisation is built into the free and anonymous tiers: chats, images and videos are automatically deleted after 24 hours and are never used for model training, which for one-off sensitive questions is a strong privacy posture.

What GDPR rights look like in practice

For users covered by GDPR, the practical rights are access, correction, deletion, portability and objection to certain processing. In plain English: you can ask what data is held, request a copy, correct inaccurate account details, ask for deletion, and challenge processing that is not necessary for providing the service.

Some records may need to be retained for legitimate reasons, such as fraud prevention, tax, billing or legal compliance. When that applies, the goal is to minimise retained data and remove what is no longer needed for a lawful purpose.

Practical checkpoint

For a GDPR assessment: identify your role, the categories of personal data, the purpose for processing, retention needs, transfer locations and the selected AI provider. Compliance depends on the complete workflow, not a badge on one page. Organizations should have their privacy or legal lead review the current policy and vendor terms.

Try it in a real chatYour first question is free, no signup needed. Ask with your real context, or compare ChatGPT 4o and Claude Sonnet 4 on the same prompt.

Ask an AI