Privacy Policy

Protecting your personal data matters to NowAskAI. This policy explains what we collect, how we use it and what your rights are. If you are in the European Union, the European Economic Area or the United Kingdom, it also explains your rights under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the UK GDPR.

1. Data controller

Site: NowAskAI — nowaskai.com

Controller: [OPERATOR NAME AND ADDRESS]

Privacy contact: contact@quenzai.com

2. Data we collect

NowAskAI is built with privacy in mind. Here is what we collect, depending on how you use it:

Visitors without an account

Your conversations are saved and linked to an anonymous session for this browser, with no name or email address, then erased 30 days after your last message
To apply usage limits and measure traffic: IP address, city and country inferred from that address, browser type, pages visited
If you leave it in the chat, your email address, to tell you about our plans
No advertising cookies or third-party trackers are placed on your device

Users with an account

Email: used to sign you in and to send you messages about the service
Conversation history: stored so you can find your chats again
Account preferences: AI model chosen, display settings
Subscribers: your plan, its billing dates and the payment references sent by Stripe (never your card number)

3. Cookies and analytics

NowAskAI only sets its own cookies:

Sign-in sessionSecure cookie (HttpOnly) that keeps you signed in, with or without an account

Visit IDTraffic measurement and usage limits, 1 year (qai_visitor)

Email leftRemembers the email address you left in the chat, 30 days (qai_lead)

PreferencesAI model chosen (1 year), sidebar state

Our analytics are first-party: we measure visits and feature use with our own tools, on our own servers. No advertising cookies and no third-party tracking pixels (Google Analytics, Meta Pixel and the like) are used on this site. We do not sell or share your personal data for advertising.

4. Hosting, service providers and data transfers

The site is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, United States). Vercel is certified under the EU-U.S. Data Privacy Framework.

The data each feature needs goes through the providers below, each under its own privacy policy. Some of them are located in the United States. Where data leaves the EU, EEA or UK, transfers rely on the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses.

Chat answers: AI models called through the Vercel AI Gateway, depending on your plan and the model you pick: GPT by OpenAI, Claude by Anthropic, Gemini by Google, Grok by xAI or Qwen by Alibaba Cloud
Images (creation and editing), files and images you attach, and conversation titles: OpenAI
Web search: Tavily
Database: Neon; storage of images and files: Vercel Blob; file creation: Vercel Sandbox
Transactional emails: Resend
Payments: Stripe (no card data passes through our servers)
Sign in with Google (optional): Google

5. How long we keep your data

User accountUntil you delete your account. Deleting it also erases your conversations, images, files and any email address you left in the chat.

Conversation historyKept while the account is active, deleted when it is closed

Generated images3 days without an account or with a free account, then deleted for good. Kept with an active subscription, under the same terms as your conversation history.

Attached files3 days without a subscription, 30 days with an active subscription

Visit and usage statistics180 days for pages viewed, events and the details of messages sent to the models. The visit record (IP address, city, browser): 13 months after your last visit. The count of images and tools used is kept beyond 180 days, with a truncated IP address.

Conversations without an accountErased 30 days after their last message, along with the documents created in them, or sooner if you ask at the address below

Email left in the chat13 months, or until the account it belongs to is deleted

Billing recordsAs long as tax and accounting laws require

Host technical logsUnder Vercel's policy

6. Memory across conversations

To make its answers more useful from one conversation to the next, the assistant can remember a few lasting facts you shared: your job or studies, your recurring projects, how you like answers (length, tone). This memory holds at most twenty short sentences. It never contains sensitive data (health, religion, political opinions, sexual orientation, ethnic origin), the content of documents you send, or one-off details.

If you have an account, the memory is linked to it and follows you on all your devices for as long as the account exists. Without an account, it is linked to your browser's qai_visitor cookie and deleted after 60 days without a visit. Either way, you can view, edit, erase or turn it off at any time from the Memory button in the chat or from your Account page. Deleting your account erases it for good.

7. Your rights

Wherever you live, you can ask us to access, correct or delete your data. If you are in the EU, EEA or UK, the GDPR gives you the following rights over your personal data:

Right of access— get a copy of your data
Right to rectification— correct inaccurate data
Right to erasure— ask us to delete your account and data
Right to data portability— export your data in a readable format
Right to object— object to some kinds of processing
Right to restriction— ask us to limit how we use your data

We process your data to provide the service you ask for (contract), to meet our legal obligations (billing), and for our legitimate interest in keeping the service secure and measuring how it is used. To use your rights, email us at contact@quenzai.com. We reply within 30 days at most. If you are not satisfied with our answer, you can file a complaint with the data protection authority of your country (in the UK, the Information Commissioner's Office).

8. Security

We use appropriate technical and organizational measures to protect your data: hashed passwords (bcrypt), HTTPS enforced everywhere (HSTS), security headers (CSP, X-Frame-Options, X-Content-Type-Options) and strict access control to the database.

9. Children

NowAskAI is not meant for children under 13, or under the minimum age set by the law of your country. We do not knowingly collect their data. If you think a child has given us personal data, contact us and we will delete it.

10. Changes to this policy

We may update this policy to reflect changes to the service or to the law. The date of the last update is shown at the bottom of this page. If we make a significant change, users with an account will be told by email.

Last updated: October 2, 2026