Who we are
askneutron is built and run by workneutron (“we”, “us”). This policy covers askneutron.com, the askneutron portal at app.askneutron.com, the API at api.askneutron.com, the embeddable chat widget, and the MCP connection for AI tools.
When an organization uses askneutron, it decides what content goes in and who can see it. For that content and the people records it adds, we process data on the organization’s behalf. For account, billing, website and contact form data, we decide how it is used. For content and people records an organization adds, the organization is the controller (a “data fiduciary” under India’s Digital Personal Data Protection Act, 2023) and we are its processor. For account, billing, website and contact form data, we are the controller. Organizations can ask us for a data processing agreement at support@workneutron.com.
What we collect
Your account
- Your work email address, name and organization name when you sign up. Sign-up asks for a work address and verifies it with an emailed code.
- A password, if you set one. We store only a hash. When you choose a password, we check whether it appears in known data breaches by sending the first five characters of its hash to Have I Been Pwned; the password itself never leaves our service.
- If you sign in with Google or Microsoft, the work account details those providers return. Only Google Workspace and Microsoft work or school accounts are accepted.
- If your organization uses single sign-on, the identity details your identity provider sends.
- Session records, including the IP address and browser user agent of each sign-in.
Your organization and its people
- Organization settings, agents, roles, invitations, allowed domains and billing profile.
- People records added by admins or synced from a connected HR system, such as name, employee ID, job title, grade, work email, date of joining and probation status, plus groups and departments.
Content you add
- Documents you upload, their earlier versions, and the text and passages we extract from them.
- Websites you ask us to crawl. We fetch the pages you point us at and index their text.
- Content, metadata and permission information from tools you connect, such as Google Drive, Slack, Jira or an HR system. Connection credentials are stored encrypted.
Chats and actions
- Questions, answers, the sources cited, feedback you give on answers, and actions prepared and confirmed in a chat.
- For people who use the embedded widget: name, email and company where the widget asks for them, and the emailed codes that verify them. Codes are stored hashed and expire after five minutes.
Usage and diagnostics
- Usage records for each billable step, such as model calls, storage, crawls, syncs and API calls, kept for billing and plan limits.
- Service logs and traces. For each chat turn we keep debugging metadata, such as timing, status and which tools ran, for 30 days. Tool inputs and outputs are kept encrypted for 7 days, and not at all when the turn read restricted content.
- Product analytics and error reports from the portal and widget, sent to PostHog’s EU region. Automatic click capture and session recording are turned off, and error reports are scrubbed of tokens and keys before they are sent.
Contact form and email
- When you use the contact form on askneutron.com, we receive your name, work email, company if given, topic and message by email. Your IP address is used to limit how many messages can be sent each minute. We keep contact messages for up to 24 months so we can follow up, then delete them.
- We send transactional email, such as sign-in codes, invitations and notifications you have turned on.
Payments
Paid plans are bought through Dodo Payments’ hosted checkout. Dodo collects your payment details; we receive the subscription, invoice and billing contact, never your full card number.
How we use it
- To run askneutron: index your content, answer questions with citations, run the actions people confirm, and send the email you need.
- To limit each answer to what the person asking may open. Before content is used in an answer, we check that person’s access, using the permissions your organization sets and the permissions synced from your connected tools.
- To meter usage, apply plan limits and bill your organization.
- To keep the service secure, investigate problems and prevent abuse.
- To understand how the product is used and improve it.
- To reply when you contact us.
We do not sell personal data. We do not use your content, questions or answers to train AI models. Our model provider processes requests under business API terms that do not allow it to train on that data.
How AI models see your data
To write an answer, we send the question, the conversation so far and the passages or records retrieved for it to a language model. By default this is OpenAI. Text embeddings for search are created with Cloudflare Workers AI. Only content the person asking may open is retrieved.
An organization can instead connect its own OpenAI-compatible model provider. Requests for that organization then go to the provider it chose, under its own terms with that provider.
Who processes data for us
These providers process personal data on our behalf to run askneutron.
| Provider | What they do | Data involved |
|---|---|---|
| Cloudflare | Runs the website, portal, API and widget (Workers), queues, containers for document extraction and analysis, website crawling (Browser Rendering), text embeddings (Workers AI), model routing (AI Gateway), transactional email, logs and traces. | All service data in transit; sync replays; logs and diagnostics |
| Supabase | Hosts the Postgres database and file storage. | Account, organization and people records, uploaded files, indexed content, chats, usage records |
| OpenAI | The managed language model that writes answers and prepares actions. | Questions, the passages and records retrieved for them, and the conversation so far |
| Dodo Payments | Checkout, subscriptions, invoices and usage-based billing for paid plans. | Billing contact, organization, plan and usage totals. Card details go to Dodo’s checkout, not to us. |
| PostHog (EU) | Product analytics and error reports for the portal and widget. | Account ID, name, email, role, organization, product events and redacted error logs |
Tools your organization connects, such as Google, Microsoft, Slack or your HR system, and any model provider you bring yourself, are chosen by you and work under your agreements with them. Have I Been Pwned receives only a partial password hash, as described above. Our providers may process data outside your country, including in the United States and the European Union. Where the law requires it, transfers rely on the provider’s standard contractual clauses or an equivalent safeguard, and on contracts that limit each provider to processing data for us.
How long we keep it
- Uploaded documents. Kept until you delete them. Earlier versions and deleted uploads are kept for the periods set in your organization’s retention settings; the choices available depend on your plan.
- Synced content. Removed when you remove the source or connection.
- Permissions from connected tools. If a connection stops syncing, its permissions lapse within 24 hours and the content it governs stops appearing in answers.
- Chat history. Kept for the period your plan sets; on Enterprise, admins choose the period. Automatic deletion at the end of that period is being built. Until it ships, an admin can ask us to delete chat history and we do so within 30 days.
- Chat debugging traces. Metadata for 30 days, tool inputs and outputs for 7 days.
- Accounts and organizations. When an organization is deleted, its records are deleted with it. To close an account or organization, email support. We delete an organization’s content and people records within 30 days of closing it, and they leave our backups within a further 90 days as backups expire. We keep usage and billing records for as long as tax and accounting law requires, and security logs for up to 12 months.
How we protect it
Stored credentials are encrypted, answers are checked against each person’s access, and changes in your tools run only after a person confirms them. Read more on our security page.
Your choices and rights
You can ask to access, correct, export or delete your personal data, or object to how we use it. Admins can edit or remove people and sources in the portal. If your employer’s askneutron holds your data, contact your employer first; we will help them respond. Depending on where you are, these rights come from laws such as India’s Digital Personal Data Protection Act, 2023 and the EU and UK GDPR. Our Grievance Officer handles privacy requests and complaints at support@workneutron.com and responds within 30 days. You can also complain to your data protection authority, or in India to the Data Protection Board of India.
To make a request, email support@workneutron.com. Write “Privacy request” in the subject so it reaches our Grievance Officer.
Cookies and similar storage
The portal and widget use cookies or browser storage to keep you signed in. PostHog analytics stores an identifier in your browser to group events from the same visit. askneutron.com uses Cloudflare Web Analytics, which counts visits without cookies and without tracking you across sites. The marketing site sets no non-essential cookies.
Children
askneutron is a workplace product and is not meant for children. You must be at least 18 to use it. We do not knowingly collect data from children; if you believe a child’s data reached us, tell us and we will delete it.
Changes to this policy
We will update this page when our practices change and change the date above. For significant changes, we email organization admins at least 30 days before they take effect.
Contact
Questions about this policy or your data: support@workneutron.com.