AskGAAP Public-Website Privacy Notice
Effective date: · Version 1.2
This notice explains how Contract Intelligence Systems LLC, a Wyoming limited liability company ("AskGAAP," "we," "us," or "our"), handles personal information on the current public website.
1. Scope and pre-launch boundary
AskGAAP is pre-launch. The current public offering is a marketing and knowledge website with contact, publication-subscription, and early-access request forms. There are no public product accounts or paid product onboarding. This notice does not make promises about a future customer application, customer documents, model providers, or production product data flows. Those practices require a separate product privacy notice and supporting operational evidence before launch.
2. Information collected now
- Hosting and request data. Netlify receives ordinary network and device data needed to deliver the site, such as IP address, requested URL, timestamp, browser or user-agent information, and security signals.
- Information you submit. Formspree processes the email address and any optional fields you choose to send through our publication, early-access, or contact forms. Hidden fields identify the originating page, request type, and list choice; they do not contain the email address or free text.
- Optional analytics. If you allow Analytics, Google Analytics 4 may receive page and interaction data. If you allow Experience measurement, Microsoft Clarity may receive masked interaction and device data. These tags remain off until the relevant category is affirmatively allowed.
- Error and security diagnostics. Sentry is used for browser error and content-security-policy reporting. Requests may include the affected page, browser context, error details, and technical data needed to investigate a defect or security-policy violation.
- Your privacy choice. The site stores the categories you allowed or rejected in local storage for up to 180 days.
Do not place sensitive personal information, credentials, confidential client data, or customer documents into these public-site forms.
Information comes from you, your browser or device, and the providers that operate the functions described below. We do not obtain public-site lead profiles from data brokers. Ordinary request/security data are necessary to deliver the page safely. Form fields and optional measurement are voluntary; if you do not provide a form field, we cannot route that request, and if you reject measurement, the site remains available without it.
The current public site does not make decisions based solely on automated processing that produce legal or similarly significant effects. AskGAAP has not designated a data protection officer; privacy matters are handled through privacy@askgaap.ai.
3. Purposes and legal bases
The table below identifies why AskGAAP processes information and, where the EU or UK GDPR applies, the legal basis relied upon. A legal basis is tied to a purpose; this is not a general authorization to reuse information for unrelated purposes. Where Microsoft acts as an independent controller for Clarity, Microsoft is responsible for identifying its own purposes and legal bases under its terms and privacy statement.
| Purpose | Information involved | EU/UK legal basis |
|---|---|---|
| Deliver, secure, and troubleshoot the website | Hosting, request, error, and security data | Legitimate interests in operating a secure, available public site — Art. 6(1)(f) |
| Route and respond to a contact, privacy, correction, or early-access request | Information submitted through the relevant form and related correspondence | Steps requested before a possible contract where applicable — Art. 6(1)(b); otherwise legitimate interests in responding to requested correspondence — Art. 6(1)(f) |
| Send publication messages separately requested by the visitor | Email address, list choice, source, and unsubscribe state | Consent — Art. 6(1)(a) |
| Measure aggregate site use through Google Analytics 4 | Page, interaction, device, and network data described by Google | Consent — Art. 6(1)(a) |
| Measure masked site interaction through Microsoft Clarity | Masked interaction, page, device, and network data described by Microsoft | Consent — Art. 6(1)(a) |
| Maintain necessary records, comply with law, and protect legal rights | Limited records relevant to the obligation, request, or dispute | Legal obligation — Art. 6(1)(c); or legitimate interests in establishing, exercising, or defending legal rights — Art. 6(1)(f) |
Our legitimate interests are limited to the purposes identified above and are assessed against the interests, rights, and reasonable expectations of affected people. Optional analytics and experience measurement are not run on legitimate interests: they require your affirmative choice.
AskGAAP does not sell personal information or use the current website for targeted advertising. Microsoft states that, as an independent controller, it may use Clarity personal data under the Microsoft Privacy Statement for its own purposes, including service improvement and creation of profiles for advertising; AskGAAP does not control those independent purposes.
4. Current recipients and providers
| Provider | Current public-site function | Role and contract status | Activation |
|---|---|---|---|
| Netlify | Website hosting, content delivery, and ordinary request/security logs | Processor for customer data under its incorporated DPA; separate controller for its own account/site data | Necessary when a page is requested |
| Formspree | Processes information you choose to submit through a form | Role is not fully verified: its security page says processor, while its Terms describe independent controllers and possible joint control; no operative AskGAAP DPA is archived | Only when you submit |
| Google Analytics 4 | Aggregate page and interaction measurement | Processor where Google's measurement data-processing terms apply; Google may be a controller for enabled data-sharing features; AskGAAP acceptance and settings evidence remains open | Only after Analytics is allowed |
| Microsoft Clarity | Masked interaction and usability measurement | Microsoft and AskGAAP are independent controllers under the Clarity Terms | Only after Experience measurement is allowed |
| Sentry | Browser error and content-security-policy reporting | Processor only where Sentry's DPA applies; AskGAAP account acceptance evidence remains open | Necessary diagnostic/security processing |
This current-site list does not represent WorkOS, Stripe, Supabase, Vercel, AWS, email vendors, or model providers as selected production subprocessors.
5. Cookies, consent, and Global Privacy Control
Optional analytics and experience measurement are denied by default in every region. Google and Microsoft tags are not requested until you allow the corresponding category. You can reject optional measurement, choose categories, reopen settings, or withdraw a prior choice.
· Read the Cookie and Tracking Notice
If your browser sends Global Privacy Control, optional analytics and experience measurement remain off. Generic Do Not Track signals do not have a common technical standard; we disclose and act on GPC instead.
6. Retention
- Privacy choice. The choice stored in your browser expires after no more than 180 days.
- Public forms and correspondence. We review records when the request is closed and delete or de-identify them when they are no longer needed for the requested follow-up, a continuing relationship, security, legal compliance, or a dispute. Unconverted contact and early-access records are scheduled for review no later than 12 months after the last substantive interaction.
- Publication list. We retain the subscription while it is active. After withdrawal, we may keep the minimum suppression record needed to honor the request not to send further messages.
- Rights requests. We retain a minimized record of the request, identity-verification steps, decision, and response only as long as needed to demonstrate and administer the response or resolve a dispute.
- Provider data. Hosting, security, diagnostic, and optional measurement data are retained under the applicable configured provider period and are reviewed when configuration, plan, or purpose changes. We do not extend retention merely because a provider permits it.
Exact product-account, customer-content, backup, export, and deletion schedules are not represented by this notice because the product is not publicly launched.
7. Your choices and rights
Depending on the law that applies, you may request access, correction, deletion, restriction, portability, or information about processing. You may withdraw consent at any time without affecting processing that was lawful before withdrawal. You may object to processing based on legitimate interests.
Direct-marketing objection. You may object to direct marketing at any time. Use the unsubscribe method in the message or email privacy@askgaap.ai. We will stop the marketing use and may retain a minimal suppression record so the objection remains effective.
To make another request, email privacy@askgaap.ai or select the Privacy request lane on the Contact page. We use proportionate identity verification, search the systems reasonably likely to contain responsive public-site information, document the outcome, and respond within the period required by applicable law. Rights may be subject to lawful exceptions.
If the EU GDPR applies, you may complain to the data-protection authority where you live, work, or believe an infringement occurred. If the UK GDPR applies, you may complain to the UK Information Commissioner's Office. Contacting a regulator does not prevent you from contacting us first.
8. Security
The public site uses HTTPS, security headers, a constrained Content Security Policy, and named service providers. No system is perfectly secure. See our Security and Responsible Disclosure page for the inspectable website posture and reporting channel. We do not claim a security certification or independent attestation that has not been published with current evidence.
9. International processing
We are established in the United States. Public-site information may be processed in the United States and in other locations used by the providers above. Where EU, UK, or Swiss transfer restrictions apply, the mechanism depends on the provider and processing:
- Netlify. Netlify is listed as active under the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. Data Privacy Framework. Its DPA is incorporated into self-serve terms and contains EU Standard Contractual Clauses and the UK transfer addendum.
- Google Analytics 4. Google LLC is listed as active under the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. Data Privacy Framework. Google's measurement terms publish Standard Contractual Clauses where another mechanism does not apply. AskGAAP has not yet archived account-level acceptance or data-sharing configuration evidence.
- Microsoft Clarity. Microsoft Corporation is listed under the Data Privacy Framework with re-certification under review. Clarity's EU FAQ describes a Microsoft Ireland affiliate-SCC path, but that does not establish the transfer route or UK safeguard applicable to AskGAAP's US project. We do not describe a Clarity customer SCC or UK mechanism as verified.
- Sentry. Functional Software, Inc. is listed as active under the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. Data Privacy Framework. Sentry publishes a DPA incorporating EU Standard Contractual Clauses and the UK transfer addendum, but that DPA requires acceptance and AskGAAP has not yet archived an acceptance receipt.
- Formspree. Formspree's security page says it relies on Standard Contractual Clauses as a processor, while its Terms describe independent controllers and possible joint control. No current public operative DPA, UK Addendum/IDTA, subprocessor list, or Data Privacy Framework certification was verified. We therefore do not describe Formspree's EEA or UK contractual transfer path as verified.
You may request information about the safeguard relevant to your information, including how to obtain a copy, by emailing privacy@askgaap.ai. Provider participation or published terms can change and are rechecked before a new regional product launch or material processing change.
10. EU and UK representative assessment
AskGAAP has no establishment in the EEA or United Kingdom and has not appointed an EEA or UK representative. The current product is not offered for non-US onboarding. Because the public site can process optional measurement after consent, we are assessing the territorial-scope and representative requirements rather than claiming an exemption that has not been ratified. Until any required representative is appointed and published, privacy requests and regulator correspondence should be sent directly to privacy@askgaap.ai or legal@askgaap.ai.
11. Changes and contact
We may update this notice when the public-site data flow, vendors, regional availability, or controls materially change. The effective date and version identify the current notice. Privacy questions and requests: privacy@askgaap.ai. Legal inquiries: legal@askgaap.ai.