Privacy Policy

Last updated: 17 October 2026

This policy explains how AskDolphin handles personal data: what we collect, why, who helps us, how long we keep it, and the choices you have. If anything is unclear, email us at privacy@askdolphin.com.

1. Who this policy covers

This policy covers AskDolphin's website (askdolphin.com), dashboard (app.askdolphin.com), chat widget, AI assistant (Dolphin AI by AskDolphin, "Dolphin AI"), Sales Assistant, QR codes, integrations and support (together, the "Services").

Words we use:

"AskDolphin", "we", "us": STER STUDIO LTD, the company behind AskDolphin (section 2).
"Customer": a business that uses AskDolphin. "Team member": a person who uses AskDolphin for a customer.
"End customer": a person who deals with one of our customers through AskDolphin, for example by chatting on its website, scanning its QR code or emailing a mailbox it connected.
"Visitor": a person who visits our own website.

This policy doesn't cover other websites or services that we link to, including the websites of businesses that use AskDolphin; their own policies apply.

2. Who we are

AskDolphin is operated by STER STUDIO LTD (registered in England and Wales), based in London, United Kingdom. For anything about privacy, email privacy@askdolphin.com.

3. Our two roles

Customers and their team members (account, billing, how the dashboard is used): we decide how this data is used (controller), and this policy applies.
Visitors to our website, and people who contact us (cookies, forms, emails, chats with our own support): we decide how this data is used (controller), and this policy applies.
End customers of our customers (conversations, emails to a connected mailbox, visits to the customer's website, recordings, order details): we handle this data for the customer, on its instructions (processor). The customer's own privacy notice applies. Under US state privacy laws we act as the customer's "service provider" or "processor" for this data: we use it only to provide the Services to that customer, and we don't sell or share it.

If you chatted with, emailed or visited a business that uses AskDolphin, please contact that business first about your data. If you contact us, we will pass your request on and help it answer.

The chat widget on a business's website may show a line such as "By chatting with us, you agree to our Privacy Policy". That link goes to the business's own privacy policy, which the business adds and keeps up to date; when a business adds no link, no such line is shown. Please read that policy, or ask the business, to learn how it uses your data, because each business decides this for itself. We are not responsible for the privacy practices of the businesses that use AskDolphin. When you chat with us on askdolphin.com, this policy applies.

4. What we collect

4.1 Customers and team members

Account: name, email, password (or your Google account if you sign in with Google), profile photo, role and settings.
Billing: company name, billing contact and address, tax ID, plan and invoices. Payments are handled by our payment provider, or by Shopify if you installed AskDolphin from the Shopify App Store. We don't store full card numbers.
Use of the Services: actions in the dashboard, usage counts, and device and log data such as IP address and browser.
Connections you set up: your store, mailboxes, sending domains and website-builder connections.
What you add: knowledge sources (website pages, questions and answers, products, help articles), saved replies, notes, QR codes and widget settings.
Support: what you send us when you ask for help.

4.2 Visitors to our website and people who contact us

Cookies: see section 11.
Chats with us: the conversation and anything you share. Dolphin AI may answer, and our team may join.
Forms and emails: what you send us, such as your name, email, company and message. Some forms use a bot check.

4.3 Data from integrations a customer connects

Shopify: store details, products and collections, and, for the shoppers the team or the Sales Assistant help, the order and contact details needed for that help.
Gmail / Google Workspace and Microsoft 365 / Outlook: with the customer's permission, we read the emails in the connected mailbox, send replies from it and identify the account. Emails we import are stored as part of conversations.
Email forwarding: emails a customer forwards to AskDolphin are stored as conversations.
Website builders (such as Framer): what is needed to add AskDolphin to the site.

4.4 Data the Services handle for customers (about their end customers)

What is collected depends on the features each customer turns on:

Conversations in chat, QR-code chats and email, including files, images, ratings and details end customers share; speech customers dictate to Dolphin AI, which is turned into text.
Visits to the customer's website: for example the pages viewed, time on page, device and browser, and approximate location (country or city, from the IP address); on shops, products viewed and steps toward checkout.
Purchase-intent scores and summaries, if the customer uses the Sales Assistant.
Session recordings, if the customer turns them on: what a visitor sees and does on the page, only after the visitor accepts. Form fields and passwords are masked, and checkout, sign-in, payment and account pages are not recorded.
Requests made in the chat (for example a cancellation or refund request). A person on the customer's team decides on each one.
AI output: replies, drafts, notes, summaries and scores.

5. Why we use data, and our legal grounds

What we do, and the legal ground we rely on under UK and EU law:

Run accounts and the features customers use; billing: our contract with the customer, or our legitimate interest in providing what the customer asked for.
Tax and accounting records: legal obligation.
Security, fraud and abuse prevention: legitimate interests.
Support and service emails: contract and legitimate interests.
Improving the Services from usage data and statistics: legitimate interests.
Telling customers about AskDolphin by email (always with an unsubscribe link): legitimate interests, or consent where the law requires it.
Analytics and advertising cookies on our website: your consent (section 11).
Answering your chats, forms and emails: legitimate interests.

For data we handle for customers, the customer chooses the legal ground and is responsible for it.

6. AI features

How they work. Dolphin AI and our other AI features use AI models provided by carefully selected third-party AI providers. When an AI feature is used, we send the content needed for that task (for example the message, relevant parts of the conversation and the customer's knowledge sources) to the provider, which returns the result. Under our AI providers' business terms, this data is not used to train their models by default, and they may keep it only for a limited time, for example to detect abuse.
No training by us. We don't use customers' or end customers' data to train AI models.
AI can be wrong. AI answers can be inaccurate or incomplete. Customers are responsible for checking what matters.
People can tell it's AI. By default the chat shows when Dolphin AI is answering, and AI email replies carry an AI notice. The read-aloud voice is an AI voice.
People decide. AskDolphin doesn't make decisions with legal or similarly significant effects on anyone by itself. Requests such as cancellations and refunds are decided by a person.

We don't sell personal data. We share it only:

with service providers who help us run the Services, for example: cloud hosting and infrastructure, content delivery and security, data storage, email delivery, AI model providers, session-recording storage, real-time messaging, payment processing, customer support and analytics. They may use the data only to provide their services to us, under written contracts with confidentiality and security obligations. Customers can ask us for the current list of providers that process their data at privacy@askdolphin.com;
with the services a customer connects (such as Shopify, Google, Microsoft or a website builder), as the customer asks;
with professional advisers (such as accountants and lawyers), under confidentiality;
when the law requires it, or to protect people's safety or our rights;
in a business transfer, such as a merger or sale (we would tell customers first).

We may share statistics that don't identify anyone.

Transfers abroad. Our main systems are hosted in the United Kingdom. Some providers process data in other countries, including the United States and countries in the European Economic Area. When data goes to a country without UK or EU "adequacy" status, we rely on recognized safeguards, such as the EU Standard Contractual Clauses with the UK Addendum or the UK International Data Transfer Agreement, or the recipient's certification under the EU–US Data Privacy Framework and its UK Extension. You can ask us for more information.

8. How long we keep data

Account and conversations: while the account is open. When an account is closed, we delete its data within a reasonable time, normally within 90 days, except what the law requires us to keep.
Invoices and tax records: 6 years (UK law).
Emails imported from a connected mailbox: as long as the conversation they belong to. Disconnecting a mailbox stops new access. To remove imported emails, delete the conversations or ask us.
Data from a Shopify store: while the store uses our app, then deleted on request or through Shopify's data requests.
Session recordings: for the period the customer chooses. Copies held by our providers may remain for a limited period after that, until their own deletion cycle.
Visitor activity and logs: while the customer's account is open, unless deleted earlier.
Our own chats, support emails and partner applications: up to 2 years after the last contact.
Website analytics: as set by the analytics provider (for example 14 months for Google Analytics).

Backup or log copies may remain for a short time after deletion until they are overwritten.

9. Security Measures

We use technical and organizational measures designed to protect personal data, and we keep improving them as AskDolphin grows. They include:

encryption of data in transit (HTTPS/TLS);
encryption of stored files and of the credentials used for connected services;
access controls and roles, so customers decide what each team member can do;
a rule that our staff access customer content only to provide support a customer asks for, to keep the Services secure, or when the law requires it, under confidentiality;
privacy safeguards in the product, such as consent before session recording, masking of form fields, and a person approving customer requests made through AI;
an independent security assessment of our Gmail integration, as required by Google.

No method of sending or storing data is completely secure, and we can't guarantee absolute security. Customers are responsible for deciding whether AskDolphin is suitable for the data they put into it, and for keeping their logins safe. Please don't use AskDolphin for highly sensitive data, such as health information, payment-card numbers, government ID numbers, or details of someone's religion, ethnicity, sex life, political views or criminal record. If a personal data breach is likely to affect your rights, we will tell you without undue delay, and the regulator where the law requires.

More information is on our Trust page.

10. Your rights

Depending on where you live, you can ask to see your data and get a copy, correct it, delete it, restrict or object to how we use it (including marketing, at any time), take it to another provider, and withdraw consent. In some US states you can also opt out of the "sale" or "sharing" of personal data and targeted advertising: we don't sell personal data, and our advertising cookies run only if you choose "Accept all". If you unsubscribe from marketing, we will still send the emails needed to run your account, such as invoices, security notices and important changes.

How to ask: email privacy@askdolphin.com. We answer within one month (we may extend that by up to two months for complex requests, and we will tell you why). We may need to confirm who you are. It is free unless a request is clearly unfounded or excessive. If you are an end customer of a business using AskDolphin, please ask that business; we will help it.

Children: AskDolphin is for businesses and adults. We don't knowingly collect children's data. If you think a child has given us personal data, email privacy@askdolphin.com and we will delete it.

11. Cookies and tracking

11.1 On our own website and dashboard

Always on: cookies the site needs to work, such as remembering your cookie choice and keeping a chat connected.
Only if you choose "Accept analytics": analytics tools (such as Google Analytics and Microsoft Clarity) that help us understand how our site is used.
Only if you choose "Accept all": advertising tools (such as Meta and LinkedIn) that measure and show our ads.

Until you choose, only the "always on" cookies are used. Change your choice any time with Cookie Settings at the bottom of the page. Our website doesn't respond to Do Not Track browser signals; to turn off analytics or advertising tools, use Cookie Settings. Parts of our Services are protected by reCAPTCHA.

The widget uses small identifiers in the visitor's browser to keep the chat and the visit connected, and shares basic visit information (such as the page, time on page, device and approximate country) so the business can see who is on its site and offer help. Session recording and more detailed browsing information are used only after the visitor accepts. The widget doesn't identify a visitor by name unless they share it.

Businesses that use AskDolphin are responsible for describing it in their own cookie and privacy notices and for getting any consent their local law requires.

12. Shopify, Google and Microsoft

Shopify. When a store owner uninstalls AskDolphin, or a shopper asks to see or delete their data through Shopify, we respond to Shopify's data requests. A store owner can also email us to have their store's data deleted.

Google (Gmail and Google Workspace). We use Gmail access only to show the emails in your shared inbox, let your team reply from AskDolphin and, if you turn them on, draft or send AI replies. We don't sell Google user data or use it for advertising, and we don't use it to develop, improve or train generalized AI or machine-learning models. Our staff don't read it unless you ask us to for specific messages, for security, or when the law requires it. AskDolphin's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can remove our access at any time in AskDolphin or in your Google Account permissions.

Microsoft (Outlook and Microsoft 365). The same rules apply. Remove our access in AskDolphin, at account.live.com/consent/Manage (personal accounts) or at myapps.microsoft.com (work accounts).

13. Complaints

If you're unhappy with how we handled your data, please tell us at privacy@askdolphin.com. We will look into it and reply. You also have the right to complain to a data protection authority.

14. Changes to this policy

We update this policy when the Services or the law change, and change the date at the top. If a change is important, we tell customers by email or in the dashboard. We will never start training AI models on customer data just by changing this policy.

15. Contact

Questions about this policy or your data: privacy@askdolphin.com.