Privacy policy

Ascue sorts contact form messages for business owners into Lead, Pitch, Spam or Ask me. This page explains what we collect to do that, what we do with it, how long we keep it, and how to ask us about it.

The short version

• A message's subject, sender and text are deleted 30 days after it arrives, unless the customer opts in to "Help improve Ascue".
• We keep scores, labels, corrections, text fingerprints and a scrambled (hashed) copy of the sender's address. Neither a fingerprint nor the hash can be turned back into the original.
• We never show one customer's messages to another customer.
• Each week someone at Ascue reviews a small random sample of held messages, to catch real leads held by mistake.
• We don't sell personal data or use advertising cookies. The public website uses Google Analytics, which sets cookies; the dashboard doesn't.
• You can download your data or delete your account yourself, from the Account page in your dashboard.

Who this covers

Two kinds of people:

• Customers: business owners with an Ascue account.
• People who fill in a customer's form: anyone whose message reaches Ascue through a form a customer runs.

For form messages, Ascue works on behalf of the business that runs the form. That business decides what its form collects and what happens to the messages; we process them to sort them for it. If you sent a message through a form and have a question about it, or want it removed, ask that business. We'll help them answer.

Customers who need a data processing agreement (DPA) can email us at support@ascue.dev for one.

What we collect from customers

• Your account: your email address, your password (stored only as a hash, see below) and, if you give it, your name.
• Your plan and billing status, and how many checks you've used this month. Payments go through Stripe. We never see your full card number.
• Your site settings: site name, domain, business category, a one-sentence description of your business, the email address we deliver to, and a webhook or Slack URL if you set one.
• Referral codes: your own, and the one you signed up with, if any.

You sign in with your password, or with a one-time link we email you. Once you're in, the dashboard keeps your sign-in token in your browser's local storage so you stay signed in. The dashboard doesn't use advertising or tracking cookies.

Your password is never stored in readable form. We keep only a salted, slow hash of it (PBKDF2): enough to check the password you type, not enough to work out what it is. Nobody at Ascue can see it. We count wrong attempts so we can lock out guessing: after 10 wrong passwords in a row, password sign-in pauses for 15 minutes (a sign-in link or a password reset still works). Changing or resetting your password signs you out on every other device.

What we collect from form messages

Messages reach us by email forwarding (a form's notification email pointed at a private Ascue address), the WordPress plugin, or our API. For each one we receive:

• the text of the message: the body and any other form fields;
• the subject;
• the sender's name and email address, as the form sent them;
• from the WordPress plugin, and from developers who choose to send them, the visitor's IP address and browser user agent (the short text a browser sends to say what it is);
• from the WordPress plugin, whether the visitor's browser passed its invisible check (a small puzzle the browser solves, set and checked by the customer's own website) and how many seconds the visitor took to send the form.

We use the IP address and user agent only to block spam bots, as described below. The IP address is turned into a keyed hash the moment it arrives and is never stored itself. Site owners using the WordPress plugin can turn this off.

What a form asks for is up to the business that runs it.

What we work out and keep

Sorting a message leaves a record of how it was sorted. We keep:

• Labels and confidence scores: what we called the message, and how sure we were.
• Jev's answers: the scores Jev gave each of Ascue's questions, such as who wrote the message and what they want.
• The decision record: the scores, model version, question wording and thresholds behind each decision, so it can be explained and checked later.
• Corrections and releases: when someone changes a label or releases a message from a held folder.
• Text fingerprints and a hashed sender address.

A text fingerprint is a one-way code computed from a message's wording (we use a technique called MinHash). It lets us recognize the same or a near-identical message when it turns up again, without keeping the text, and it can't be turned back into the message. The hashed sender address is the sender's email address run through SHA-256, a one-way function: it lets us notice the same sender writing to many sites, but it can't be turned back into the address. Both are kept after the message itself is deleted.

How we use messages

• To sort them for the customer they were sent to. That's the main job.
• To tune that customer's site. A customer's corrections adjust their own site's thresholds, within the strictness they chose. A few of their recently corrected messages are also sent to Jev as short examples alongside new messages, so it learns what a lead looks like for that business.
• To train a small model on scores. We train a small model on Jev's scores, corrections and simple counts, such as how many links a message had. It never sees message text.
• To spot campaigns across sites. When the same or near-identical text, or the same sender, turns up at many sites, that's a campaign. We spot it by comparing text fingerprints and hashed sender addresses. We never compare message text or the sender's actual address, and we act only when many independent sites agree. One site's reports can't get a sender held everywhere.
• To block spam bots attacking a form. When one address keeps sending a site spam, or a form gets a sudden burst of it, we block further messages from that address and copies of what it sends, so they don't reach the customer or use their checks. Blocked messages wait in the customer's spam folder like any other. We compare keyed hashes of IP addresses, never the addresses, and we never block an address that sent the site a real message in the last day. An address that sent spam to several customers' sites in the last hour is blocked at every customer's site, unless it sent any of them a real message in the last day; no site learns where else it was seen. A message sent without a browser, by a known scripting tool, or faster than a person could fill in the form counts as spam.
• To post to your Slack, if you connect it. When a site has a Slack webhook, we post a short note to that channel for each lead we deliver. You choose the channel; Slack then holds the note under your workspace's own terms.

We never show one customer's messages to another customer. Campaign spotting only counts how many other sites saw a match; it never tells a site where else a message went.

We also publish a monthly Spam Report with totals across all customers, such as how many messages were leads, pitches or spam. It contains counts only: no messages, senders or sites.

A person reviews a small sample of held messages

Owners rarely open their held folders, so a real lead held by mistake can go unnoticed. To catch those, each week someone at Ascue reviews a small random sample of held messages from across customers. They see the message along with the site's name and business description, and note whether it was sorted correctly.

"Help improve Ascue" is off unless you turn it on

There's a setting called "Help improve Ascue" on the account page in your dashboard. It's off by default.

• When it's on, the subject and text of messages that arrive are kept past 30 days, with personal details removed: email addresses, phone numbers, links and the sender's name. The sender's name and address themselves are still deleted at 30 days.
• We use those messages to test changes to Ascue before they reach every customer. This collection is our evaluation set.
• You can turn it off any time. New messages then follow the normal 30-day rule. To have messages we already kept removed, email us.

How long we keep it

• The message itself (its subject, body and form fields, and the sender's name and email address): deleted 30 days after it arrives. For customers who opted in to "Help improve Ascue", the subject and body are kept with personal details removed, as described above. Until then, the customer can read the message in the dashboard and release it if it was held.
• Scores, labels, decision records, corrections, text fingerprints and hashed sender addresses: kept indefinitely. They're what make thresholds, campaign spotting and the learned model work.
• Hashed IP addresses and user agents: deleted within 7 days.
• Your account, sites and their messages: kept while you have an account. Delete your account from the Account page in your dashboard and we delete it with all its sites, messages, decisions and corrections. (Cancel a paid plan in Billing first.)

The free checker

At ascue.dev/check, anyone can paste a message and see what Ascue thinks. What you paste is sent to our classifier, including Jev, to get an answer. It is not stored by Ascue. To keep the checker free, requests are rate limited by IP address.

Visits to this website

On the public pages of ascue.dev, we count page views to see whether people are interested in Ascue: a daily count per page and per traffic source (a campaign tag in the link, or the website that linked here). We store no cookies, IP addresses or visitor identifiers for this. Your browser remembers the traffic source for the rest of the visit (in session storage, which clears when you close the tab). If you sign up, that source is saved with your new account so sign-ups can be credited to it. The dashboard is never counted.

The public pages also use Google Analytics, so we can see how people find and use the site. It sets cookies in your browser (their names start with _ga), and Google receives the page you're on, the page that sent you there, your browser and device type, and your IP address, which it uses to estimate your rough location. Google Analytics doesn't run in the dashboard, or on sign-in, password reset or correction links. You can block it with your browser's cookie settings or Google's opt-out add-on.

Support emails

If you email us at support@ascue.dev, we keep your email and our reply so we can follow up. A draft reply may be written by Claude (see below); a person reads and edits every reply before it is sent.

Pre-orders

If you pre-order, Stripe handles the payment, and we keep your email address and a record of the order so we can honor or refund it.

Who else handles data

We use a few other services to run Ascue:

• TypeSafe AI runs Jev, the model that answers Ascue's questions about each message. To classify a message, it receives the message (its text, subject and sender details as the form sent them), the site's business description, and the few corrected examples mentioned above.
• Anthropic (Claude) drafts replies to emails sent to our support address. It receives the support email and basic account details (plan, sites and their settings, message counts), never your customers' form messages. A person reads and edits every reply before it is sent.
• Google (Google Analytics) measures visits to the public pages of the website, as described above.
• Our email provider sends your leads, digests and sign-in links.
• Stripe handles payments.
• Cloudflare hosts the website and dashboard, and receives forwarded form emails (Email Routing). If our API is down, Cloudflare holds those emails briefly and retries, so they arrive late rather than get lost.
• Our hosting provider runs the API and database.

We don't sell personal data, to these services or anyone else.

Your rights

Customers can do two of these themselves, from the Account page in the dashboard: Download my data gives you everything we hold for your account as one file, and Delete account deletes it with all its sites, messages, decisions and corrections.

You can also ask us to:

• show you the personal data we hold about you;
• correct it;
• export it;
• delete it.

Email support@ascue.dev. We may need to confirm the request comes from you, for example by replying from the email address on your account. If your request is about a message you sent through a customer's form, start with that business; we'll help them answer.

If you're in the EU or UK

The GDPR gives you the rights above and a few more, including the right to object to some processing and to complain to your local data protection authority. For form messages, the business that runs the form is the controller and Ascue is its processor. For customer accounts, we rely on our contract with you to run the service, on your consent for "Help improve Ascue" (withdraw it by turning the setting off), and on our legitimate interest in sorting accurately and catching mistakes, which covers the held-message review and campaign spotting. Ascue and the services above may handle data outside the EU and UK; where the law requires it, we use the standard safeguards for those transfers.

Security

Data is encrypted in transit between your browser, your forms and us. Access to customer data is limited to the people who need it to run and support Ascue. Passwords are stored only as salted PBKDF2 hashes, and repeated wrong guesses lock password sign-in for a while. Sign-in links expire after 20 minutes and work once, reset links after an hour, and site keys are stored only in a form that can't be read back. No service is perfectly secure, and we won't pretend otherwise; if something goes wrong that affects your data, we'll tell you.

Children

Ascue is a tool for businesses and isn't meant for children. We don't knowingly collect personal data from children. If you think a child has given us theirs, email us and we'll delete it.

Changes to this policy

When we change this policy, we'll update the date at the top. If a change is material, we'll also email customers about it.

Contact

Questions, requests or a DPA: support@ascue.dev.