Data processing addendum

Published by [COMPANY LEGAL NAME / ADDRESS]. Contact: [PRIVACY CONTACT EMAIL]. See also the privacy policy.

Roles

You (the customer, the owner of the WordPress site) are the controller of the personal data that Ask sends from your site. Glimpse is the processor for the data that passes through the Ask relay. For account, license and billing data about you as our customer, Glimpse acts as a controller, as described in the privacy policy.

Subject matter and duration

Subject matter: relaying Ask requests from your site to AI models and returning the response, and recording usage for billing. Duration: for as long as you use Ask with an active Pro license. The relay is a pass-through for request content; Glimpse keeps usage counts, not questions or answers.

Categories of data and data subjects

• Sent by default: the question typed by a user of your site, your glossary, and the names and types of the tables and columns Ask may see.
• Sent only if an administrator raises the data setting: low-cardinality column values, or up to 200 result rows.
• Never sent: tables marked private (users, user meta and customer details by default), columns matching hidden patterns (emails, passwords, tokens, IP addresses, phone numbers) and database credentials.
• Kept by Glimpse for billing: customer, site, model, token counts, credits and timestamps.

Data subjects are the users of your WordPress site who ask questions, and any individuals whose information appears in values or rows that an administrator chooses to allow.

Instructions and processing

Glimpse processes request content only to obtain a model response for the requesting site. The relay calls DeepSeek V4 models hosted on Cloudflare Workers AI through Cloudflare AI Gateway, with request-body logging turned off. DeepSeek is the author of the model weights; requests are not sent to DeepSeek’s own API. Glimpse does not use customer data to train models. Queries run on your own server; the relay never connects to your database.

Security measures

• TLS for all traffic between your site and the relay.
• Requests authenticated with your license token (a signed JWT) and checked against your license and site.
• Per-site rate limiting.
• No request-body logging at AI Gateway.
• Least-privilege schema exposure: private tables and sensitive column patterns are never exposed.
• Read-only queries, validated against a syntax tree, executed on your own server.

Sub-processors

DeepSeek is not a sub-processor: it authored the model weights, which run on Cloudflare’s infrastructure. Notice of changes to this list: [PLACEHOLDER].

Deletion and return

Ask conversations are stored in your own WordPress database and can be deleted there at any time; retention is configurable (default 90 days). On termination, Glimpse deletes or returns the data it holds for you: [PLACEHOLDER].

Audit

Audit and information requests: [PLACEHOLDER]. Send them to [PRIVACY CONTACT EMAIL].

International transfers

[PLACEHOLDER]