Privacy Policy

This Privacy Policy applies to OnceAsked's website, web application, and iOS and Android apps (together, the "Services"), and to support interactions.

If a customer has a separate data processing agreement with OnceAsked, that agreement applies where required.

Account information: name, email address, password (stored as a salted hash, never in plain text), profile picture, and workspace role.

Content you provide: messages, replies, reactions, tags, pins, files and attachments you upload, poll and survey responses, and Touch Base recordings/transcripts you or your workspace generate.

Usage and diagnostic data: app and feature usage events, device type and operating system version, crash and error logs, and IP address, used to operate, secure, and improve the Services.

Mobile-specific data: which platform a message was sent from (iOS, Android, or web) is recorded so workspace admins and OnceAsked can see activity by client; this is metadata about the app used, not additional personal content.

We do not require or collect biometric data. If you enable Face ID, Touch ID, or fingerprint unlock in the mobile app, that authentication happens entirely on your device using Apple's or Google's own secure hardware (e.g., iOS Secure Enclave) — OnceAsked never receives, transmits, or stores your biometric data. We only receive a yes/no result confirming your device unlocked the app.

Baquë, OnceAsked's AI assistant, and related automated features (search and question-answering, meeting recaps, message clarity suggestions, data visualization) process the content of your messages and workspace data to generate their output. This processing is performed using third-party AI model providers under contract, who process this data solely to return a result to OnceAsked and are contractually prohibited from using it to train their own models or for any other purpose.

You can ask a workspace administrator whether AI features are enabled for your workspace; administrators control which AI features are available.

To provide and operate the Services (delivering messages, rendering the River feed, running Baquë, syncing across web and mobile); to secure the Services (authentication, fraud and abuse prevention, audit logging); to communicate with you (service notices, support responses, and, only with your consent, product updates); and to improve the Services (aggregated usage analysis, debugging).

We process information based on your and your workspace's instructions, our contractual obligations to your workspace, legal requirements, and our legitimate interest in operating and securing the Services.

OnceAsked does not sell personal information, and we do not share your Customer Content with third parties except: (a) with subprocessors who help us operate the Services (see OnceAsked Subprocessors), under contractual confidentiality and data-protection obligations; (b) with a third-party integration you or your workspace administrator explicitly enable (see Section 8 of the Terms of Service) — enabling an integration is your choice, and OnceAsked only sends the data that integration's connection is configured to sync; (c) with your workspace administrator, who has visibility into workspace activity as part of the product's design; (d) when required by law, subpoena, or to protect the rights, safety, or property of OnceAsked or others; or (e) in connection with a merger, acquisition, or sale of assets, subject to this Privacy Policy continuing to apply to your information.

You can request account deletion at any time from Account Settings on the web app (River → Settings → Delete Account), by typing DELETE to confirm. The mobile apps include a link to the same web deletion flow from the app's Settings screen. You can also email support@onceasked.com to request deletion.

Requesting deletion immediately suspends your account and begins a 30-day grace period, during which you can cancel the request by logging back in. We do this so an accidental or coerced deletion request doesn't immediately and irreversibly destroy your data. After the grace period, your account and associated personal data are permanently deleted, except for information we are required to retain for legal, tax, security, or dispute-resolution purposes, or that has already been legitimately shared as part of a workspace's records (for example, a message you sent that other workspace members retain access to as part of the workspace's own content).

Depending on your location, you may have the right to access, correct, export, or delete your personal information, object to or restrict certain processing, and withdraw consent where processing is based on consent. To exercise these rights, contact support@onceasked.com or use the in-app account settings where available. We will respond within the time required by applicable law.

California residents have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and the right to delete it; OnceAsked does not sell or share personal information for cross-context behavioral advertising. Residents of the EU/EEA and UK have rights under the GDPR/UK GDPR, including the rights listed above and the right to lodge a complaint with a supervisory authority.

Processing is performed under contract performance, legitimate interests, legal obligations, and consent where required.

Cross-border transfers rely on documented safeguards and contractual protections aligned to relevant regulatory requirements.

OnceAsked limits collection and retention to data needed to operate, secure, and improve platform services for approved purposes.

Retention periods are defined by feature requirements, customer configuration, contractual terms, and legal obligations, and by the account deletion process described above.

The web app uses essential cookies required for login and security, and, only with your consent given through our cookie banner, optional analytics and marketing cookies. You can change your cookie choices at any time from the cookie preferences link in the web app's footer. The mobile apps do not use tracking cookies; they use the same account/session token mechanism as the web app, stored securely in your device's Keychain (iOS) or EncryptedSharedPreferences (Android), never in plain text.

The Services are intended for business and professional use and are not directed to children under 16. We do not knowingly collect personal information from children under 16; if you believe a child has provided us information, contact support@onceasked.com and we will delete it.

When you subscribe to a paid plan, payment card details are collected and processed directly by our payment processor, Stripe, Inc., through a secure, PCI-compliant interface embedded in OnceAsked. Your full card number, CVV, and other sensitive card authentication data are transmitted directly to Stripe and are never received or stored by OnceAsked.

OnceAsked retains limited billing metadata needed for invoicing, support, and fraud prevention — such as billing name, billing email, plan and seat count, transaction history, and the card's last four digits and expiration month/year (returned to us by Stripe, not entered through us).

Stripe acts as an independent controller/processor for the payment data it collects and processes it under its own privacy policy, available at https://stripe.com/privacy. Stripe is a listed payment-processing subprocessor — see OnceAsked Subprocessors for details.

OnceAsked, Inc. is a Delaware C Corporation headquartered in New York City, NY 10001.

For legal matters, contact legal@onceasked.com. For all other matters, contact support@onceasked.com.

OnceAsked does not sell personal information under any circumstances.

We only share information with trusted partners when expressly permitted by contract, administrator configuration, or user instruction.