Privacy Policy

Effective date: September 18, 2026.
Last updated: October 8, 2026.

This Privacy Policy explains how José Julio Córdova Jaramillo, a natural person with RUC 1707017693001, operating commercially under the brand AskRoby, hereinafter “AskRoby”, “we”, “we” or “our”, collects, uses, stores, shares, protects and deletes Personal Data related to AskRoby and the services available through www.askroby.io, hereinafter the “Services”.

This Policy is applied in accordance with the data protection legislation that is applicable to the corresponding treatment, including the Organic Law on the Protection of Personal Data of Ecuador and its implementing regulations, and, when applicable due to the treatment or the affected persons, other regulations such as the GDPR of the European Union or UK GDPR.

AskRoby can be used by individuals, professionals, companies and other organizations.

1. Who is responsible for your Personal Data

AskRoby can fulfill different roles depending on the treatment performed.

Regarding information such as your Account data, billing, communications with AskRoby, security, analytics, preferences, consents and administration of the contractual relationship, AskRoby generally acts as the Data Controller.

When a Client, whether a natural or legal person, uses AskRoby to store or process Personal Data of third parties and determines the purposes and essential elements of such processing, the Client acts as Controller and AskRoby acts as Processor with respect to that data. In such cases the AskRoby Data Processing Agreement also applies. In that case AskRoby processes that Personal Data only on the Client's instructions and for the purposes stated in the Data Processing Agreement, and does not disclose, assign or transfer it to other persons, not even for retention, except to authorized subprocessors to the extent necessary to provide the Service, on the Client's instruction, or where a competent authority requires it.

A natural person who uses AskRoby solely to organize his or her own documents does not automatically become, by that fact alone, a Data Controller with respect to third parties.

2. Personal Data we collect

The Personal Data we process depends on how you use AskRoby.

2.1 Account Data

We may process information such as:

• email address;
• name, when provided;
• organization name, where applicable;
• type and status of the Account;
• internal Account identifiers;
• invitations and membership in organizations;
• information about security settings;
• multi-factor authentication status; and
• other information necessary to manage the Account.

Authentication credentials are managed by our authentication provider using appropriate hashing and security mechanisms. AskRoby does not store user passwords in plain text.

3. Billing and Subscription Information

When you purchase a Subscription, Recharge or other paid Service, the transaction is managed through Polar Software, Inc., which acts as Merchant of Record for the corresponding transactions.

AskRoby may receive and retain limited information related to the transaction, such as:

• Contracted plan;
• amount;
• currency;
• payment date;
• planned renewal date;
• Subscription status;
• order or transaction identifiers;
• country;
• certain tax data where applicable;
• status of a refund; and
• other information necessary to administer the contracted Service.

AskRoby does not need to store your full payment card number.

Polar and the payment providers it uses process the information necessary to complete the transaction in accordance with their own legal and privacy obligations.

4. Content you provide to AskRoby

Depending on how you use the Service, we may process:

• documents;
• PDFs;
• Word documents;
• photographs;
• images;
• scanned files;
• text;
• contracts;
• communications;
• queries made to AskRoby;
• other files or content that you decide to provide.

The content of these documents may include Personal Data of you or third parties.

AskRoby does not determine what information you choose to include in your documents.

When you provide Personal Data of third parties, you are responsible for having the rights, authorizations and legal bases that are necessary for such processing.

5. Information generated from your documents

To provide AskRoby features, we may generate and store derivative representations of the Content, including:

• optimized page images;
• extracted text;
• information obtained through OCR;
• metadata;
• extracted structured data;
• indices;
• embeddings or vector representations;
• references between documents and pages;
• consultations;
• recovered fragments;
• processing results; and
• responses generated with the assistance of artificial intelligence.

These representations are used to provide the documentary, search, retrieval and query functions of AskRoby.

6. Technical, activity and safety data

We may collect technical data reasonably necessary to operate, protect, maintain and diagnose the Services, including, as applicable:

• IP address;
• browser and user-agent;
• device;
• language;
• date and time;
• authentication events;
• relevant Account activity;
• MFA related events;
• errors;
• processing times;
• results of automated processes;
• security events;
• information on the execution of scheduled tasks;
• results of backup and recovery processes; and
• other technical records related to the operation of the Service.

Not all of this data is kept for the same period. Retention periods are described later in this Policy.

7. Analytics

AskRoby may use analytics tools to aggregately understand how the Services are used, identify problems and improve the product.

Currently these tools can include Vercel Analytics and Google Analytics.

Optional analytics are activated only after appropriate choice via AskRoby's consent mechanism where such consent is necessary.

Analytical information may include, depending on the tool and configuration:

• pages visited;
• navigation events;
• device;
• browser;
• technical data;
• approximate region;
• dates and times; and
• technical identifiers or pseudonyms used by the tool.

We do not need to analyze the content of your documents to perform general site navigation analytics.

8. Communications, support and feedback

When you contact AskRoby we can deal with:

• your email;
• name;
• content of your messages;
• support requests;
• comments;
• feedback;
• voluntarily provided information about cancellations; and
• voluntary reasons for reimbursement.

When AskRoby optionally requests information such as the reason for a refund, providing that information is voluntary.

9. Contractual evidence and consents

AskRoby maintains records intended to demonstrate the conclusion, administration and fulfillment of the contractual relationship.

These records may include:

• Account identification;
• email address used;
• name, when it exists;
• organization, where applicable, with its tax identifier and the name and position of the person accepting on its behalf;
• accepted legal document;
• version of the document;
• language;
• date and time of acceptance;
• archived copy or reference to the accepted text;
• cryptographic hash of the document;
• acceptance or revocation of certain consents;
• Account closure instruction;
• relevant cancellation or refund events; and
• evidence of the execution of certain legal or contractual actions.

These records may also include the IP address, browser or device information, technical request identifiers and evidence of the mechanism used to express acceptance, where reasonably necessary to substantiate the contractual relationship.

These records are different from the documentary content stored within the Memories.

Closing an Account does not necessarily imply immediately eliminating this contractual evidence.

10. How we use Personal Data

We use Personal Data only for legitimate purposes related to AskRoby.

Among them:

The specific legal basis may vary depending on the jurisdiction and the circumstances of the processing.

11. Marketing

AskRoby may send newsletters, information about new features, offers, promotions or other commercial communications when you have given the corresponding consent.

You can withdraw that consent at any time by using the unsubscribe mechanism included in the communications, where available, or by writing to:

support@askroby.io

Withdrawing marketing consent does not prevent AskRoby from sending communications necessary to:

• security;
• Account;
• billing;
• renovation;
• cancellation;
• elimination;
• medium; or
• contractual or legal compliance.

12. Artificial Intelligence

AskRoby uses third-party artificial intelligence providers for certain functions, including:

• reading pages;
• OCR;
• information extraction;
• classification;
• search;
• response generation;
• information retrieval; and
• generation of embeddings.

Depending on the operation, they can be sent to the corresponding supplier:

• page images;

• text;

• fragments of documents;

• consultations;

• results retrieved; or

• information necessary to complete the application.

AskRoby does not use the Client's documents to train or fine-tune its own models.

AI requests containing Customer Content are configured to enforce collection and retention restrictions consistent with AskRoby's privacy architecture, including no data collection and zero retention requirements when permitted by the feature and provider.

AskRoby uses an architecture intended to prevent requests containing Customer Content from being sent to routes that are incompatible with such restrictions.

13. Current artificial intelligence providers

Currently used providers may include:

OpenRouter.
It acts as a gateway and routing system for artificial intelligence requests.

Google.
Certain Google models can be used for functions such as page reading, extraction, OCR, or response generation.

OpenAI.
Certain OpenAI models may be used to generate embeddings and other functions supported by the Services.

Specific providers or models may change as the Service evolves, provided that AskRoby maintains a reasonably equivalent level of protection and complies with applicable obligations.

14. Automated processing and automated decisions

AskRoby uses automated processing and artificial intelligence for functions such as:

• information extraction;
• classification;
• search;
• response generation;
• date identification;
• documentary organization; and
• reminders.

For example, AskRoby can automatically identify that a contract is about to expire and generate a reminder.

That type of automation does not mean that AskRoby is itself making a legal decision about a person.

AskRoby does not use its artificial intelligence functions to adopt, on its own, decisions based solely on automated processing that produce legal effects or significantly similar effects on users.

AskRoby also does not perform profiling for this purpose.

15. Special or sensitive categories of Personal Data

AskRoby does not require you to provide any special or sensitive categories of Personal Data to use the general functions of the Service.

However, the Client may decide to upload documents that contain sensitive information, including, for example:

• health data;
• financial information;
• disability;
• biometric information included in documents;
• information about minors;
• beliefs;
• affiliations;
• or other categories protected by applicable legislation.

When the Client incorporates information of this nature, it is responsible for determining that it has a valid legal basis and that the processing through AskRoby is appropriate and lawful.

AskRoby processes such data only to the extent necessary to provide the Services and in accordance with applicable instructions.

16. Minors

You must be at least 18 years old to hire AskRoby on your own.

A person under 18 years of age may use AskRoby when his or her father, mother or legal representative has created the Account or expressly authorized its use in accordance with the available mechanisms.

AskRoby does not carry out systematic identity or age verifications.

Accordingly, we cannot guarantee that a minor will never provide false information regarding his or her age or use an Account without appropriate authorization.

If you are a parent or legal representative and believe that a minor is using AskRoby without the required authorization, you can write to:

support@askroby.io

AskRoby may investigate the situation and take appropriate action, including restriction or closure of the Account where appropriate.

17. Providers and recipients of Personal Data

AskRoby uses technology providers to provide the Services.

The subprocessor directory provides their functions, processing locations and verification status.

Current major providers include:

The legal role of each provider may vary. Not all recipients necessarily act as subprocessors of the documentary content.

In particular, Polar acts as Merchant of Record in respect of the relevant transactions.

18. Emails and document titles

Certain transactional communications may require our email provider to process information associated with an Account.

This may include:

• email address;
• name;
• type of notification;
• identifiers;
• necessary billing information; and
• when the purpose of the message requires it, certain names or titles of documents shown in the notification.

We limit the content transmitted to what is necessary for the corresponding communication.

19. Operational and administrative alerts

AskRoby may use technical messaging mechanisms to send internal alerts related to operational events.

When such alerts are related to an Account, we try to minimize the Personal Data transmitted.

For example, a refund event can be represented by an event-specific identifier, such as:

RFD-A8312

along with limited information such as amount, type and status of the operation.

When not necessary, these internal alerts should not include:

• name of the Client;
• email;
• titles of documents; nor
• Memories content.

Additional details can be viewed, where necessary, within AskRoby's authenticated administrative systems.

20. Legal communications and requirements from authorities

AskRoby may communicate Personal Data when necessary to:

• fulfill a valid legal obligation;
• respond to an order from a competent authority;
• investigate fraud or illegal activity;
• protect the security of the Services;
• protect the rights of AskRoby, the Client or third parties; or
• establish, exercise or defend claims.

We will evaluate the requests received and limit the information provided to what is reasonably necessary when permitted by law.

21. Transfer or succession of the business

If AskRoby reorganizes, enters into a future partnership, sells a substantial portion of the business, merges, or transfers the Services to a legitimate successor, certain Personal Data may be part of the transaction.

Where applicable, such information will be transferred under confidentiality and protection obligations consistent with this Policy and applicable law.

22. We do not sell your Personal Data

AskRoby does not sell users' Personal Data.

The use of technology providers to provide the Services does not constitute a sale of personal information by AskRoby.

23. International processing

AskRoby uses infrastructure and providers that may process information in the United States and other jurisdictions.

We do not indicate a specific technical region in this Policy because vendor architectures may evolve.

When a transaction is subject to specific requirements regarding processing or international transfers, AskRoby will apply the mechanisms required by the corresponding legislation.

Where GDPR or UK GDPR is applicable and legally necessary, such mechanisms may include adequacy decisions, standard contractual clauses, addendums or other valid mechanisms.

For transfers to the United States, AskRoby relies on the data processing agreements of Supabase, OpenRouter, Resend, and Cloudflare, which form part of their terms of service and incorporate the European Commission’s standard contractual clauses, and on that of GitHub, which relies on its EU-US Data Privacy Framework certification and, as the case may be, on those clauses. For other providers, their own terms and privacy policies apply.

The use of a supplier located outside Ecuador does not in itself mean that every operation must receive the same legal qualification; Each relationship is structured in accordance with applicable legislation and the role played by the supplier.

24. Security

AskRoby applies technical and organizational measures aimed at protecting Personal Data in accordance with the risks of processing.

These measures include:

• encryption of data in transit using HTTPS/TLS;

• encryption at rest provided by our infrastructure providers;

• secure storage of credentials using hashing mechanisms managed by the authentication provider;

• authentication;

• authorization;

• access policies at the database level;

• logical separation between Accounts and organizations;

• multi-factor authentication;

• restrictions on privileged access;

• operational and error logs;

• automated isolation checks between Accounts; and

• separate copies intended for continuity and infrastructure recovery.

No system connected to the Internet can guarantee absolute security.

25. Multi-factor authentication

AskRoby requires multi-factor authentication to access protected information.

Users have an initial period of approximately four days to configure the second factor.

Once this period has expired, access to protected content may be restricted until configuration is complete.

26. Human access to content

AskRoby's automated systems necessarily process documents to provide the Service.

AskRoby does not routinely read Customer documents as part of ordinary human operations.

Ordinary administration and support interfaces are not designed to allow regular reading of document content.

However, people with privileged access to certain infrastructure could technically access information when necessary to:

• respond to an authorized support request;
• investigate a technical problem;
• respond to a security incident;
• maintain or recover infrastructure;
• fulfill a valid legal obligation; or
• execute an intervention expressly authorized by the Client.

Where there is a separate agreement with a Customer that expressly authorizes human access for testing, implementation, diagnosis or support, such access may be provided in accordance with that agreement.

27. Security incidents

AskRoby maintains mechanisms intended to identify, investigate and respond to incidents that may affect Personal Data.

When a Personal Data breach occurs and applicable legislation requires notification, AskRoby will make the corresponding communications to the persons, Clients or competent authorities within the legally applicable requirements.

28. Conservation of original files

It is important to distinguish between the original file you upload and the Memory that remains active in AskRoby.

The original file can be:

• PDF; -Word;
• photography;
• images; or
• another file originally provided.

AskRoby retains that file temporarily to allow processing and, when necessary, automatic recovery of pages that were not processed correctly.

The original file is retained for a maximum period of approximately two days and is subsequently deleted from the active storage used for that purpose.

Deleting the original does not mean that the Memory disappears.

As long as the Memory remains active, AskRoby retains the representations necessary to provide the Service, such as:

• page images;
• extracted text;
• embeddings;
• indices;
• metadata; and
• other processed information.

29. Individual deletion of a Memory

When you delete a Memory, it immediately enters the delete cycle.

During the recovery period offered by the Service, currently up to approximately two days, Memory may continue to be available for restoration using AskRoby features.

After that period and once the final deletion has been executed:

• Memory is no longer available;

• cannot be restored using normal AskRoby functions; and

• AskRoby does not offer an individual recovery service from internal or infrastructure copies.

Separate copies controlled by AskRoby for continuity and recovery purposes are typically deleted by a periodic purge process, which currently runs daily and waits one day after first detecting the deletion.

This usually means within three days after the active system is permanently removed.

These copies exist for continuity and infrastructure recovery. They are not an additional trash can of the Client nor an individual archive or recovery service.

Certain providers may retain residual technical copies for periods controlled by their own architectures, obligations or recovery mechanisms.

30. Cancellation of a Subscription

Canceling a Subscription does not immediately delete Memories.

The Account retains the paid Plan and its Memories until the end of the period already paid.

At the end of said period:

• existing Memories are no longer available;
• its disposal is initiated or executed according to the applicable cycle;
• the Account goes to the Free Plan; and
• The Client can create new Memories available under said Plan, currently two.

AskRoby tries to communicate the corresponding date in advance so that the Client can retain any information they need on their own.

30 bis. Non-payment of a Subscription

When a renewal charge cannot be completed, the Account is not immediately deleted.

• During the first seven days from the first failed charge, the Customer retains normal access to the Service.
• Starting on the seventh day, if the payment has not been regularized, the Account is suspended: the Client can log in, but cannot access their Memories. The Memories are preserved.
• If the payment is regularized before the deletion date, the Account regains access and the Memories remain as they were.
• If forty-five days pass since the first failed collection without the payment being regularized, the existing Memories are permanently deleted and the Account moves to the Free Plan.

During this period, AskRoby sends email notices—approximately after seven, twenty-one, thirty and forty-four days—indicating in each email the exact date of deletion.

To do this, AskRoby processes the Account email address and, when the Client has voluntarily provided them, the additional contact channels registered in their profile (a second email and a WhatsApp number). Such data is used solely to communicate with the Customer about his/her Account and billing, and may be deleted by the Customer at any time from his/her profile.

31. Refund of the first payment

When a Customer uses the money-back guarantee applicable to the first payment of a new Subscription:

• the paid Subscription ends;
• existing Memories are no longer available;
• its elimination is started;
• the Account remains active under the Free Plan; and
• The Client has the Memory spaces corresponding to said Plan.

The reason for the refund, when requested, is optional.

32. Account Closure

Closing an Account is different from canceling a Subscription.

When the Client confirms the closing:

• AskRoby first cancels any active Billable Subscriptions where applicable;

• access to the Account ends;

• the Memories cease to be immediately available from the Customer's perspective;

• the removal of the associated Content begins; and

• the closure is irreversible from the perspective of normal use of AskRoby.

Prior to closing, Customer must individually retain any information it wishes to maintain.

AskRoby does not guarantee that each technical copy at each provider will disappear at the same instant that the closure is confirmed. Technical deletion processes may continue after the Account has become unavailable.

33. Information we may retain after closing

Closing an Account does not mean that AskRoby must immediately delete all evidence that a contractual relationship existed.

We may retain only the minimum information necessary to:

• demonstrate which person or Account accepted certain legal documents;
• demonstrate which version was accepted;
• demonstrate the date and time of acceptance;
• certify a closure or elimination instruction;
• demonstrate the execution of certain operations;
• comply with tax or accounting obligations;
• manage fraud or security;
• comply with regulatory obligations; or
• establish, exercise or defend rights or claims.

This retention does not mean that AskRoby maintains the Client's Memories, documents, OCR, embeddings or queries to continue using the Service after closure.

34. Conservation periods

AskRoby uses different retention periods depending on the purpose of the information.

34.1 Contractual and legal evidence

The minimum records necessary to demonstrate:

• acceptance of Terms;
• Privacy Policy;
• DPA;
• relevant consents;
• revocations;
• Account closure;
• removal instructions; and
• other relevant contractual events

may be retained for up to ten years from the event or from the termination of the relevant relationship, where such retention is reasonably necessary to establish, exercise or defend rights or claims.

35. Tax and accounting information

Records that must be kept for tax, accounting or documentary purposes may be kept for up to seven years, or for any other period required by applicable law.

36. Security logs and relevant activity

Individualizable records related to:

• security;
• accesses;
• authentication;
• MFA;
• significant Account events; and
• relevant administrative activity

They are generally kept for up to twelve months.

37. Technical and diagnostic records

Detailed technical records intended primarily for diagnosis, such as:

• processing attempts;
• OCR;
• processing times; and
• ordinary errors

They are generally kept for up to ninety days.

38. Automated processes, cron and backups

Summary results of scheduled tasks, continuity checks, and backup processes can be retained for up to twelve months.

Detailed technical logs related to such runs are generally retained for up to ninety days.

39. Analytics

Analytical data that remains identifiable or pseudonymized is generally retained for up to fourteen months.

Information that has been actually aggregated or anonymized so that it no longer reasonably identifies an individual may be retained for longer periods.

40. Support and communications

Support communications, comments and other correspondence are retained for as long as necessary to fulfill the request and provide reasonable follow-up.

When a communication becomes relevant evidence of a dispute, fraud, incident or contractual relationship, it may be retained for the period applicable to that purpose.

41. Exceptions to ordinary retention periods

The periods described above may be extended for specific information when necessary to:

• fulfill a legal obligation;
• respond to a request from authority;
• investigate a security incident;
• investigate or prevent fraud;
• address a dispute;
• establish, exercise or defend a claim; or
• maintain evidence subject to a specific legal hold.

When the reason for further retention no longer exists, the information will be deleted, blocked or anonymized as appropriate.

42. Backups are not equivalent to Customer storage

Infrastructure recovery copies are not part of an archiving service offered to Customer.

They are not intended for:

• save documents indefinitely;
• provide a second trash can;
• allow individual restore requests after final deletion.

The Client is responsible for retaining its own copies of any documents or information it needs to maintain.

43. Cookies and similar technologies

AskRoby uses technologies necessary to:

• maintain sessions;
• authenticate users;
• protect the Service;
• remember certain essential preferences; and
• enable necessary functions of the application.

These strictly necessary technologies may be used without consent when permitted by applicable law.

AskRoby also uses or may use optional analytics technologies.

Currently these may include:

• Vercel Analytics; and -Google Analytics.

Where consent is required, these optional tools remain disabled until the user makes the corresponding choice.

You can accept, reject or modify the available options using AskRoby's consent mechanism.

44. Your rights

Depending on applicable law and specific circumstances, you may have the right to request:

• information about treatment;
• access to your Personal Data;
• rectification or update;
• elimination;
• opposition to treatment;
• limitation or suspension;
• portability;
• withdrawal of a previously granted consent; and
• other rights recognized by applicable legislation.

Withdrawing consent does not affect the legality of treatments carried out before withdrawal.

Some actions can be performed directly through the functions available within the Account.

For other requests you can write to:

support@askroby.io

45. Requests related to data controlled by another Client

When AskRoby processes Personal Data on behalf of a company, professional or other Client acting as Controller, certain requests related to that data must be resolved by said Client.

If we directly receive a request regarding information that we process solely on behalf of another Controller, we may:

• direct the person to the corresponding Manager;
• transfer the request to the Client; or
• assist the Client when appropriate.

46. Identity verification in rights requests

AskRoby does not perform systematic identity or age verification for all users.

However, when someone requests access, modification, deletion or other action with respect to Personal Data, we may request information reasonably necessary to confirm that the person has the right to make the request.

This verification is limited to what is reasonably necessary based on the risk of the request.

47. Claims before authorities

If you consider that the processing of your Personal Data violates applicable legislation, you can file a claim with the competent authority.

In Ecuador, the authority for the protection of Personal Data is the Superintendency of Personal Data Protection.

Where other legislation applies, you may also have the right to go to the appropriate authority in your jurisdiction.

48. Changes to this Policy

AskRoby may update this Policy as and when:

• the Services;
• technology;
• the suppliers;
• treatment practices; or
• legal obligations.

When we make non-material changes, we may update the Policy and its “Last updated” date and provide reasonable notice where appropriate.

When a change is material, we will try to communicate it clearly.

If applicable legislation requires a new consent or a new express acceptance, AskRoby will request such action before carrying out the processing that requires it.

AskRoby may retain previous versions of this Policy and evidence of accepted or communicated versions.

49. Data Protection Officer

AskRoby has not currently appointed a Personal Data Protection Officer or DPO.

Queries related to privacy or protection of Personal Data can be directed directly to:

support@askroby.io

The need to appoint a Delegate will be re-evaluated if the legal structure, activities, scale or nature of the processing carried out by AskRoby changes.

50. Contact

Responsible: José Julio Córdova Jaramillo.
RUC: 1707017693001.
Operating commercially under the brand name: AskRoby.
Privacy, support, security and legal email: support@askroby.io.
Address: La Primavera 2, Cumbayá, Metropolitan District of Quito, Pichincha, Ecuador.
Telephone: +593 99 061 2230.