[ Last updated: October 18, 2026 ]
How we use your information, the services involved and the choices you control.
This policy explains how ShareOfAsk handles personal data when you visit our website, use the application, run a Free Scan, pay for a subscription or contact us. The "Analytics" section explains what we measure and what your cookie choice changes.
ShareOfAsk is operated by Marcin Pastuszek, trading as 10 Seats Agency, ul. Strażacka 4, 66-446 Deszczno, Poland, NIP 5993134291.
For privacy questions and requests to access, correct or delete your data, email [email protected].
We are responsible for the processing described below where we decide its purposes and means. If your employer, agency or another organization supplies information or gives you access, that organization also has responsibilities for how it uses the service. For information processed only on its instructions, contact that organization, or contact us and we'll help direct your request. This doesn't limit your rights for processing we are responsible for.
Account and organization information. We use names, email addresses, sign-in information, organization membership, roles and account settings. If you choose Google sign-in, Google provides the account identifier and basic profile information used to sign you in, such as your name, email address and verification status.
Project information and results. We process brand and competitor names, websites, markets, business descriptions, tracked questions, AI answers, cited sources, reports and Actions. You or an authorized member of your organization supply some of this information. Other information comes from model and search-data providers or publicly accessible websites, including pages and discussions cited in AI answers. These materials can contain personal names, professional contact details or other information about individuals. Please don't supply confidential information or personal data the analysis doesn't need.
Billing information. Stripe processes payments. We receive subscription and payment records, billing contact and address information, tax details and payment notifications. We need these to manage your subscription, reconcile payments and handle disputes. Payment notifications can contain transaction details as well as a payment status.
Support information. We process messages and contact details you provide, together with relevant account and technical information. On the website, the support chat ("Chat via ProjectHQ") is provided by ProjectHQ (projecthq.pro) and loads through Google Tag Manager. Its script loads only after you click the chat button. When it loads, ProjectHQ receives your IP address, device information and the messages you send, and records which site referred you. The messages can include information you supply and the page you contact us from. Legal basis: providing the support you asked for (Art. 6(1)(b) GDPR) and our legitimate interest in answering support requests (Art. 6(1)(f) GDPR).
Technical and security information. Servers and service providers process network and device information, such as IP addresses, browser details, timestamps, authentication events and diagnostic records. We also keep records of Free Scan use to apply the one-time Free Scan rule. Loading an external resource can disclose request information to its provider, even without a cookie.
Analytics on the website (www.shareofask.com). Google Tag Manager (GTM-TT5RJXVM), provided by Google, loads on every page. It includes our consent manager, which shows the cookie banner and stores your choice.
PostHog, provided by PostHog Inc. and hosted in the EU, loads through Google Tag Manager on every page. Before you make a choice, PostHog keeps data in your browser's memory only and sends one anonymous page view. It doesn't record web addresses' query strings, capture clicks or record sessions. Legal basis: our legitimate interest in measuring how the website is used (Art. 6(1)(f) GDPR). You can object at any time. Email [email protected]. If you accept analytics cookies, PostHog uses browser storage (localStorage) and a cookie, shared across shareofask.com subdomains. If you reject before PostHog loads, it isn't loaded and its cookies are deleted. If you reject later, PostHog stops tracking, resets and removes its browser storage.
Google Analytics 4, provided by Google, runs on the website only after you accept analytics cookies. It then measures website visits, page interactions and clicks through to sign-up. It uses browser identifiers, page and referral information, and device, location and usage data. A sign-up click doesn't mean an account was created. Google Signals, user-provided data collection and advertising personalization are off. No Google Ads account is linked. Google Consent Mode sets analytics storage to denied by default and updates it when you choose. Advertising categories are never granted. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in Cookie settings.
Analytics in the application before you sign in. Before you make a cookie choice, or if you reject analytics cookies, PostHog records limited information without cookies or browser storage. It uses a random identifier kept in your browser's memory for that visit only. It records the pages you view (as page types, not full addresses), campaign (UTM) parameters, the domain of the site you came from, whether you started a Free Scan, viewed its results or clicked a link from them, and whether you viewed pricing.
Analytics in the application when you are signed in. When you are signed in, we send PostHog your user ID, email address, first name, plan, organization ID and name, and usage events. We use this to understand how the product is used, to help you when you contact support and to find and fix errors. If you haven't accepted analytics cookies, PostHog keeps this in your browser's memory only, with no cookies or browser storage. Your cookie choice doesn't stop this processing. Events include page views, sign-in and project activity, scan availability, viewing Actions and checkout interactions. They can contain browser and device information; organization, project, scan and analysis identifiers; and status, attempt and action counts. We don't include question or answer content or access tokens. Our server also tells PostHog when a Free Scan is claimed, completed or failed, so we can run and deliver your Free Scan.
Legal basis: performing our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in running, supporting and improving the service (Art. 6(1)(f) GDPR). You can object to the processing based on legitimate interest at any time. Email [email protected]. See "Your rights".
Analytics in the application after you accept analytics cookies. If you accept analytics cookies in the application's Cookie settings:
We rely on your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the application's Cookie settings.
PostHog hosting. PostHog Inc. processes this data for us as our processor, under its terms, on PostHog Cloud EU, hosted in the EU. IP addresses are anonymized for all events. PostHog keeps events for 1 year and session replays for 30 days. See PostHog's data-storage information.
| Purpose | Basis for processing |
|---|---|
| Create and operate your account; provide scans, reports and Actions; manage subscriptions; respond to service requests | Performing our contract with you, or taking steps you ask for before a contract. For representatives of a business customer: our legitimate interest in providing and administering the business service. |
| Analyze business information from submitted questions, AI answers and public sources to measure brand visibility | Where we decide the processing: our legitimate interest in providing accurate business visibility analysis, subject to the rights and interests of the people concerned. Where we act only on a customer's instructions, the customer is responsible for its lawful basis. |
| Secure the service, diagnose failures, prevent abuse and handle legal claims | Our legitimate interests in protecting the service, its users and our legal rights; legal obligations where they apply. |
| Keep tax, accounting and other legally required records | Compliance with legal obligations. |
| Provide the website support chat you open, including ProjectHQ's referrer tracking for that chat (ProjectHQ) | Providing the support you asked for (Art. 6(1)(b) GDPR) and our legitimate interest in answering support requests (Art. 6(1)(f) GDPR). |
| Measure website use with an anonymous page view before any choice (PostHog) | Our legitimate interest in measuring how the website is used (Art. 6(1)(f) GDPR). You can object. Email [email protected]. |
| Measure website use after you accept analytics cookies (Google Analytics 4; PostHog cookie and browser storage) | Your consent given in the website's Cookie settings (Art. 6(1)(a) GDPR). You can withdraw it at any time in Cookie settings. |
| Measure how people use the application before they sign in, without cookies or browser storage (PostHog) | Our legitimate interest in understanding how people find and use the service (Art. 6(1)(f) GDPR). You can object. Email [email protected]. |
| Understand how signed-in users use the product, support them, fix errors, and run and deliver Free Scans (PostHog) | Performing our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in running, supporting and improving the service (Art. 6(1)(f) GDPR). You can object to the processing based on legitimate interest. Email [email protected]. |
| In the application, after you accept analytics cookies: cookies and browser storage, click and error capture, page performance, limited session replay (PostHog) and Google Analytics 4 | Your consent given in the application's Cookie settings (Art. 6(1)(a) GDPR). You can withdraw it at any time in Cookie settings. |
| Handle privacy requests and keep evidence of compliance | Legal obligations that apply, and our legitimate interest in documenting how we handled requests. |
We need certain information to deliver a requested function, such as an email address to operate an account or billing details for a subscription. If you don't provide it, we may be unable to provide that function.
AI answers and Actions are generated automatically and can be inaccurate. They provide business analysis and recommendations. They aren't decisions about your legal rights. You can contact us about inaccurate personal information that appears in a result.
To run the checks and analysis you ask for, we send relevant questions and context to the selected model or search-data provider. Depending on the function, this can include business descriptions, website text, AI answers, source URLs and measured results. We don't claim these inputs are necessarily anonymous. We don't promise that every provider applies the same data-use or retention terms.
| Service | Provider and information involved |
|---|---|
| Website delivery | Webflow and its delivery infrastructure receive the browser and network requests needed to serve the website and its assets. |
| Application hosting and storage | Hetzner hosts application services and stored service information. |
| Payments | Stripe receives payment and billing information and sends subscription and transaction notifications. |
| Google sign-in | Google exchanges the account information needed for the sign-in method you select. |
| Service emails | Mailgun processes recipient details and account-related messages, including verification, password resets, invitations and results notifications. |
| Error monitoring | Sentry processes diagnostic information and, where relevant, a technical account identifier to investigate faults. |
| Analytics (Google) | Google provides Google Tag Manager, which loads on every page of the website and includes our consent manager, and Google Analytics 4. Google Analytics 4 runs only after you accept analytics cookies, on the website and in the application. Google Consent Mode sets analytics storage to denied by default, and advertising categories are never granted. |
| Product analytics | PostHog Inc. (PostHog Cloud EU) processes analytics as our processor. On the website, it loads through Google Tag Manager and sends one anonymous page view before any choice, then uses a cookie and browser storage only after consent. In the application, it processes the signed-in and anonymous data described in "Analytics" and, after consent, click, page-performance and error data and limited session replays. IP addresses are anonymized for all events. |
| Support chat (with referrer tracking) | ProjectHQ (projecthq.pro) provides the website's support chat, including referrer tracking for the chat you open. Support chat: loaded through Google Tag Manager, only after you click the chat button. ProjectHQ then receives your IP address, device information and chat messages. Referrer tracking: once you open the chat, ProjectHQ's tracker records which site referred you, using the phq_ref cookie and projecthq_* browser storage. |
| AI and search analysis | Depending on the model and function selected, integrations include OpenAI, Anthropic, Google Gemini, Perplexity and xAI, and DataForSEO for relevant Google AI search results. Not every provider receives every check. |
| External resources | Google-hosted fonts, scripts and website icons can receive browser and network requests when those resources load. |
Providers can have different roles. Some process information on our instructions. Others have their own responsibilities, such as Stripe's fraud prevention and regulatory obligations, or Google's operation of a Google account. Their own notices explain those separate activities. See, for example, Stripe's privacy notice, Google's privacy notice and Webflow's privacy notice.
Your organization's authorized users can see information according to their permissions. If you or another authorized user creates a sharing link, people with access to that link may see the shared report. We may also disclose relevant information to professional advisers, where the law requires it, or as part of a lawful business transfer.
Some providers and their support or infrastructure operations are outside the European Economic Area, including in the United States. A European hosting location doesn't by itself mean that all access and processing stay in Europe.
Providers' published transfer arrangements include the European Commission's Standard Contractual Clauses and, where they apply to the recipient and transfer, adequacy decisions. The arrangement depends on the service and recipient. A provider's certification doesn't cover every possible transfer. Email [email protected] to learn which safeguards apply to your data and how to get a copy. Providers' notices also describe their international processing.
Necessary cookies and browser storage support sign-in, security, service functions and remembering your privacy choice. Blocking necessary storage in your browser can stop a requested function from working.
Use Cookie settings on the website or in the application to accept or reject analytics cookies, or to change or withdraw your choice. The website and the application store choices separately; a choice on one doesn't apply to the other. The website's cc-settings cookie and the application's soa_consent cookie remember your choice for 182 days. You can change it sooner or clear your browser storage.
Cookies and browser storage on the website:
| Name | Type | Provider | Purpose | Category | When it's set | On Reject |
|---|---|---|---|---|---|---|
| cc-settings | Cookie (first-party, set by our consent manager) | ShareOfAsk | Stores your cookie choice for 182 days | Necessary | When you make a choice | Kept (it stores the Reject choice) |
| projecthq_exclude=true | localStorage | ProjectHQ | Set when you open the support chat | Functional | When the chat opens | Kept |
| phq_ref | Cookie | ProjectHQ | Referrer tracking: records which site referred you, as part of the chat you open | Functional | When you open the support chat | Removed |
| projecthq_* (other keys) | localStorage | ProjectHQ | Support chat and its referrer tracking | Functional | When you open the support chat | Removed |
| _ga, _ga_* | Cookie | Google Analytics 4 measurement | Analytics | Only after you accept | Removed | |
| ph_<key>_posthog | Cookie and localStorage | PostHog | PostHog analytics identifier, shared across shareofask.com subdomains | Analytics | Only after you accept | Removed (PostHog resets) |
Google Analytics 4's _ga and _ga_* cookies are set only after consent, on the website and in the application. Their lifetime in your browser is separate from the server-side retention described below. ProjectHQ's support chat loads only when you click the chat button. Once you click the chat button and confirm opening the chat, ProjectHQ sets its phq_ref cookie and projecthq_* storage keys, and records which site referred you. If you reject analytics cookies, they are still removed, except projecthq_exclude.
If you reject analytics cookies on the website, Google Analytics 4 is turned off. We remove its _ga and _ga_* cookies, ProjectHQ's phq_ref cookie and its projecthq_* storage keys, except projecthq_exclude, which the chat needs. PostHog isn't loaded, or, if it's already running, it stops tracking, resets and removes its cookie and browser storage.
If you reject analytics cookies in the application, Google Analytics 4 stays off, and PostHog stops using cookies, browser storage, click and error capture and session replay. This doesn't stop the limited in-memory processing described in "Analytics". If you are signed in, account analytics continues on the basis of contract and legitimate interest. To object to it, or to the anonymous page view on the website, email [email protected].
Withdrawing doesn't undo processing already carried out, or delete events a provider has already received. You can ask for deletion separately. The website and application stay available whatever you choose.
We don't currently run advertising or remarketing, upload customer lists to advertising platforms or run a newsletter. Advertising through Google Ads, Meta (Facebook and Instagram) and X, including remarketing and audience matching, is only planned. Their advertising pixels, remarketing tags and customer-list integrations aren't active on ShareOfAsk. Before we start any of these, we will explain the providers, purposes and data involved, update this notice and get any consent the law requires. Existing cookie choices don't authorize future marketing purposes.
Retention depends on the category and purpose. Access to a report, expiry of a browser cookie and deletion from servers are different things.
| Information | Retention period or criteria |
|---|---|
| Account, organization and project information | As long as we need it to operate the account or organization, provide the report history you asked for and resolve account closure or deletion requests. Longer retention can apply to records needed for a particular legal obligation, an unresolved dispute or a documented security issue. Canceling a subscription doesn't by itself erase all records. |
| Free Scan results | Results are available for 7 days. This is an access period, not an erasure deadline. Closing access doesn't automatically remove inputs, answers or related records. Retention also depends on whether the project continues under a subscription, on any deletion request, and on the eligibility and legal-record purposes below. |
| Free Scan eligibility records | Records that a Free Scan was used support the one-time Free Scan rule. We keep them while that rule needs them, subject to the deletion rights that apply. |
| Billing and legal records | The period required by the tax or accounting obligation that applies to the record, plus the time needed to resolve an outstanding payment, dispute or legal claim. These records may need to remain after the account closes. |
| Support conversations and diagnostics | The time needed to resolve the request or fault, and to keep relevant evidence for related follow-up, security incidents or claims. Factors include whether the matter is still open, whether the issue recurs and any legal requirement that applies. |
| Google Analytics 4 (after consent) | User-level and event-level data retention is set to 14 months. New activity renews the user-level period. This setting doesn't cover most standard aggregated reports. It isn't a universal deletion deadline for all information Google holds. |
| PostHog analytics (website and application) | Events: 1 year. Session replays (application only): 30 days. Signed-in users can also ask for deletion of their profile (user ID, email address, first name, plan, organization ID and name) and events at [email protected]. We then delete them within 30 days. |
| Consent records | Browser preference cookies are set for 182 days. Any separate evidence needed to answer a complaint or show consent is assessed against that specific purpose and the claim or legal requirement that applies. |
| Recovery copies and archives | The need to recover affected services or keep particular legally required records is assessed separately from live account access. We don't promise that removing a record from the application immediately removes every retained copy. A deletion request covers these copies as well as active systems, subject to lawful retention exceptions. |
To request deletion, email [email protected]. Account deletion is handled through this contact. You can't yet do it yourself in the application. We assess what can be deleted, what must remain for a specific lawful purpose and whether service providers also hold relevant records. We explain any exception that applies. Our deadline for answering a request isn't a promise that every technical copy is erased in that same period.
Subject to the applicable conditions, you can ask for access to, correction or deletion of your personal data, restriction of processing and data portability. You can object at any time to processing based on our legitimate interests (Art. 21 GDPR), including analytics in PostHog. Email [email protected]. We will then stop that processing unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need it to establish, exercise or defend legal claims. You can withdraw analytics consent in the application at any time in Cookie settings. Where applicable, you can object to direct marketing, including related profiling.
Send requests to [email protected]. We may need proportionate information to verify your identity. We normally respond within 1 month. If the complexity or number of requests means we lawfully need more time, we will tell you within that first month.
You can complain to the President of Poland's Personal Data Protection Office (UODO) or another competent supervisory authority. Contact details are on the UODO website.
We update this notice when our processing changes. The date at the top shows the current version. Where a new purpose requires consent, we will ask for it. Continuing to use the service doesn't count as consent to new optional processing.
Check 10 questions across 3 AI models and review one action analysis. Choose a paid plan when you want to keep monitoring.
One free scan of your brand. Review and share your results for 7 days.
