This notice explains what Ask Olive does with personal data. It is written to be read, not to be survived — if anything here is unclear, ask us and we will explain it.
1. Who is responsible
Olive Wood IT Limited (company number 14193135, registered office Office D23, Chelworth Industrial Estate, Cricklade, Swindon, SN6 6HE) is the data controller for the personal data described here. Contact us about privacy at help@owgroup.co.uk.
Where you use Ask Olive to process personal data belonging to your customers — for example by pasting it into a question — you are the controller of that data and we act as your processor. Section 8 covers that case.
2. What we collect, and why
| What | Why | Lawful basis |
|---|---|---|
| Account details — name, work email, organisation, and your sign-in identifier | To create and secure your account and identify you when you sign in | Performance of a contract |
| The questions you ask and the answers generated | To answer you, to meter what your questions cost, to investigate support issues, and to improve answer quality | Performance of a contract; legitimate interests (running and improving the service) |
| Usage and billing records — timestamps, the level chosen, the amount of allowance consumed, ledger entries | To bill you accurately and show you your balance and history | Performance of a contract; legal obligation (accounting records) |
| Payment details | Taken and stored by our payment processor, not by us. We hold only the processor’s customer reference, the last four digits, and payment status | Performance of a contract |
| Technical logs — IP address, browser type, request paths, error traces | Security, abuse prevention, and diagnosing faults | Legitimate interests (keeping the service secure and working) |
We do not use your questions or your content to train models — neither ours nor anyone else’s. We do not sell personal data, and we do not share it for advertising.
Please do not put special-category personal data (health, biometric, and the other categories in UK GDPR Article 9) into a question. The service is not designed to handle it.
3. Who else processes your data
We use a small number of sub-processors. Each is contractually bound to protect the data and to use it only to provide its service to us.
| Sub-processor | What it does | Data involved |
|---|---|---|
| Our AI model provider (USA) | Generates the written answer from the question and the evidence we retrieve | Your question and the retrieved evidence. Our model provider’s commercial terms provide that inputs and outputs are not used to train its models |
| Stripe (USA/Ireland) | Takes payments and stores card details | Your name, email, billing address and card details — supplied directly to Stripe, never held by us |
| Cloudflare (USA/UK) | Network protection, access control, and delivering the site | IP address and request metadata |
| Microsoft (where you sign in with a work account) | Verifies who you are | Your identifier, name and email as released by your own organisation |
A current list of our sub-processors, including the name of our AI model provider, is maintained in our Trust Centre sub-processor register. Transfers outside the UK are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent approved mechanism. We will update the register before adding a sub-processor that handles your content.
4. How long we keep it
- Project data — the working content of your implementation project (tasks, issues, documents, process flows, and similar) is retained for as long as your subscription is active. It is deleted when you request your project be cancelled, or automatically after 6 months in which nobody from your organisation has logged in (we send two reminders first, at 5 and 5.75 months). A failed card payment on its own never triggers this. Deletion removes the working content; it does not delete records we are separately required to keep for tax purposes (see below).
- Questions and answers — retained for up to 12 months from when they are recorded, after which they are automatically deleted. You may ask us to delete your question history sooner.
- Billing and ledger records — retained for 6 years after the end of the relevant financial year, because UK tax law requires it.
- Technical logs — request telemetry (timings, token counts, and the text of questions and answers) is retained for up to 12 months, then automatically deleted.
- Account details — deleted when the account is closed and the retention periods above have run.
5. Where your data is held
The Ask Olive knowledge base, your question history and the billing ledger are held on infrastructure we control in the United Kingdom. Questions are sent to our AI model provider (see the sub-processor register linked in section 3) to generate an answer, and payment data goes to Stripe; those are the only routine routes by which data leaves our own systems.
6. Security
We protect the service with access control at the network edge, authenticated sessions, encryption in transit, and strict separation between customers — one customer’s content is never retrievable by another. Access to production data is limited to those who need it to run the service.
No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the Information Commissioner’s Office within 72 hours and tell you without undue delay where the risk is high.
7. Your rights
Under UK GDPR you may ask us to: give you a copy of your personal data; correct it if it is wrong; delete it; restrict or object to how we use it; or send it to another provider in a portable form. Where we rely on legitimate interests, you may object and we will stop unless we have compelling grounds not to.
Write to help@owgroup.co.uk. We will respond within one month. If you are unhappy with our response you may complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113), though we would rather you gave us the chance to put it right first.
8. When you are the controller
If you put personal data belonging to your own customers into Ask Olive, you decide why and how it is processed, so you are the controller and we are your processor. In that case we will: process it only on your documented instructions; keep it confidential; apply the security measures in section 6; use only the sub-processors in section 3; help you respond to data-subject requests and to your own security obligations; and delete or return it when your account ends. If you need this as a signed data processing agreement, ask and we will provide one.
9. Cookies
We use only what the service needs to work: a session cookie to keep you signed in, and local storage in your browser to remember your preferences such as theme and answer level. We do not use advertising or third-party tracking cookies, which is why you are not being asked to accept any.
10. Changes
If we change this notice materially we will tell you by email before the change takes effect. The current version is always the one on this page.