Your rights under the General Data Protection Regulation (GDPR) and how asktodo.ai approaches data protection. asktodo.ai operates from Karnataka, India and does not actively target the EU market, but we honour the GDPR rights of any EU resident who chooses to use our service.
Last updated: May 18, 2026 | Effective Date: May 18, 2026
The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on May 25, 2018, across the European Union. It gives individuals greater control over their personal data and requires organizations to be transparent about how they collect, use, and protect personal information.
GDPR applies to:
asktodo.ai is committed to honouring GDPR rights for any EU/EEA or UK resident who uses our service. We are based in Karnataka, India and operate primarily under Indian law (including the DPDP Act, 2023), but we treat your data-protection rights as universal rather than regional. We have implemented technical and organizational measures — encryption in transit and at rest, row-level security, server-side audit logs, default-denied cookie consent, and a first-party telemetry-only authenticated dashboard — to back this commitment up.
What it means: You have the right to know how your personal data is being processed.
How we comply: Our Privacy Policy provides clear, comprehensive information about our data processing activities.
What it means: You can request a copy of all personal data we hold about you.
How to exercise: Email hi@asktodo.ai with your request.
Response time: Within 30 days (free of charge for the first request).
What it means: You can request correction of inaccurate or incomplete personal data.
How to exercise: Update your information in account settings or contact us at hi@asktodo.ai.
Response time: Within 30 days.
What it means: You can request deletion of your personal data in certain circumstances.
When applicable:
How to exercise: Delete your account in settings or email hi@asktodo.ai.
What it means: You can request limitation of processing in certain situations.
When applicable:
What it means: You can receive your personal data in a machine-readable format and transfer it to another service.
What's included: Account data, generated content, usage history, preferences.
Format: JSON or CSV files.
How to exercise: Request data export via hi@asktodo.ai.
What it means: You can object to processing based on legitimate interests or for direct marketing.
Direct Marketing: Absolute right to object - we must stop immediately.
Legitimate Interests: We must demonstrate compelling legitimate grounds to continue processing.
How to exercise: Email hi@asktodo.ai or use unsubscribe links.
What it means: You have rights regarding automated decision-making and profiling.
Our practice: We do not make automated decisions that significantly affect you without human involvement.
AI Content Generation: Our AI tools generate content based on your prompts but do not make decisions about you as a person.
Under GDPR, we must have a legal basis for processing your personal data. Here are the legal bases we rely on:
| Processing Activity | Legal Basis | GDPR Article |
|---|---|---|
| Account creation and management | Contract performance | Article 6(1)(b) |
| AI content generation | Contract performance | Article 6(1)(b) |
| Payment processing | Contract performance | Article 6(1)(b) |
| Customer support | Contract performance | Article 6(1)(b) |
| Service improvement and analytics | Legitimate interest | Article 6(1)(f) |
| Security and fraud prevention | Legitimate interest | Article 6(1)(f) |
| Marketing communications | Consent | Article 6(1)(a) |
| Cookies (non-essential) | Consent | Article 6(1)(a) |
| Legal compliance | Legal obligation | Article 6(1)(c) |
| Data Type | Retention Period | Reason |
|---|---|---|
| Account data | Until deletion + 30 days | Service provision, backup recovery |
| Generated content | Until user deletion | User access and management |
| Usage analytics | 24 months | Service improvement |
| Payment records | 7 years | Legal and tax compliance |
| Support communications | 3 years | Quality assurance |
| Security logs | 12 months | Security monitoring |
When we transfer your personal data outside the EU/EEA, we ensure adequate protection through:
EU-approved contractual terms with service providers ensuring GDPR-level protection.
Transfers to countries deemed adequate by the European Commission.
Service providers with recognized privacy certifications and codes of conduct.
Encryption, pseudonymization, and other technical measures to protect data.
| Service Provider | Location | Safeguard | Purpose |
|---|---|---|---|
| Supabase | EU/US | SCCs | Database, authentication |
| Groq | US | SCCs | AI processing |
| PayPal | Global | Adequacy/SCCs | Payment processing |
| Vercel | Global | SCCs | Web hosting |
Data Protection Officer:
Privacy Team:
General Support:
Legal Department:
Email us with your specific request and include your account email address.
We may ask for additional information to verify your identity and protect your data.
We'll process your request and respond within 30 days (may be extended to 60 days for complex requests).
You'll receive a detailed response with the requested information or action taken.
Exercising your GDPR rights is free of charge. However, if requests are manifestly unfounded, excessive, or repetitive, we may charge a reasonable fee or refuse to act on the request.
If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with a supervisory authority, particularly in the EU member state where you:
You can find your local data protection authority at:European Data Protection Board
While you have the right to lodge a complaint directly with a supervisory authority, we encourage you to contact us first so we can try to resolve any concerns directly.
We may update this GDPR information from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes through: