Not legal advice. This page describes how AskCub is built and operated. If the language versions disagree, the English version prevails unless mandatory local law says otherwise.
1. Who we are and the two roles we play
AskCub is operated by TapCub ("we", "us"). We run this website, the console you sign in to and the AskCub live chat service. You can reach us about privacy at hello@tapcub.com.
- Controller — for people who register an account, are invited as members or agents, contact us, or browse this website.
- Processor — for visitors who open the chat on our customers' websites and apps. The customer is the controller; we process conversations only on the customer's instructions, under this policy and a data processing agreement available on request.
If you chatted on a site that uses AskCub and want to exercise your rights, contact the operator of that site first; the visitor privacy notice explains how.
2. Data we collect as controller
Account data. Email address, password hash, display name, optional avatar, language and time-zone preferences, multi-factor settings, and the time, IP address and user agent of each sign-in (kept for security). Agents you invite give us their email and name.
Billing data. Plan, order and invoice history, the payment provider used (Stripe, PayPal, Alipay or WeChat Pay), the amount and the provider's transaction reference; for card payments, the card brand and last four digits. We never see or store full card numbers.
Support data. Messages you send us by email or through the chat on this website.
Product usage. Which console features you use, aggregated into counts. We run no third-party analytics or advertising pixels on this website or in the console.
3. Data we process on behalf of customers
Conversations. Message text, images, audio, video and files a visitor sends, the email a visitor leaves for an offline reply, the consent record written with the first message, ratings, and the translation or AI reply produced for a message.
Visitor context shown to agents. Coarse country or region, device type, browser language, the current page, the referrer and the pages viewed during this visit. Agents see a daily visitor hash, not an IP address. If the customer's site identifies signed-in users, the customer may also pass a user ID and name.
Presence. While the launcher is on a page, it reports the current page, referrer and language so agents can see who is browsing and start a conversation. Nothing is stored on the device for this.
4. What the chat widget stores on a device
The launcher writes nothing to the device while the chat window is closed. When a visitor opens the window, the widget writes one opaque session token to localStorage so a refresh, another tab or a later visit continues the same conversation. The token encodes nothing about the visitor and expires after 24 hours without chat activity, or 30 days if the visitor chooses to remember the conversation. Visitors can clear the conversation from their device with "Clear history" in the window.
5. Cubby, translation and AI providers
When AI replies are on, the current question and the knowledge-base entries that matched it are sent to the model provider; when two-way translation is on, the text that needs translating is sent. The full conversation history, the visitor's context and any analytics are not sent. Providers are contractually prohibited from training on this data. AI replies are always labelled, and visitors can ask for a person at any time.
6. This website
askcub.com sets no cookies. It writes two localStorage keys only after you act: your language choice and whether you dismissed the announcement bar. It is measured with a cookieless analytics script. If you chat with Cubby on this website, the widget writes the session token described above.
7. Purposes and legal bases
- Performance of a contract — running your account, billing, support and the features you turn on.
- Legitimate interests — securing the service (sign-in logs, rate limiting, abuse detection) and understanding aggregate usage.
- Legal obligation — tax and accounting records, lawful requests.
- Consent — optional product emails, and a visitor's choice to remember a conversation for 30 days.
For conversations on customer sites, the legal basis is the customer's to establish. Under China's Personal Information Protection Law, the customer is the personal information handler and we are the entrusted party.
8. How long we keep data
Conversations are kept for the retention period of the customer's plan — 30 days on Free, 3 months on Pro, 6 months on VIP 1, 12 months on VIP 2 — or shorter if the customer sets it, then messages, attachments, translations and consent records are deleted together. Customers can delete any conversation immediately.
Account data is kept while the account exists and for 30 days after deletion. Billing records are kept as long as tax law requires. Server and security logs are kept for up to 90 days. Backups roll over within 35 days of data being deleted from production.
9. Sharing and sub-processors
We do not sell personal data and we do not share it with advertisers. We use these categories of service providers, each bound by contract to act only on our instructions:
- cloud infrastructure, databases and object storage for messages and attachments;
- content delivery for the widget and this website;
- payment processors — Stripe, PayPal, Alipay and WeChat Pay;
- transactional email for sign-in, notifications and invoices;
- AI model providers for Cubby, translation and reply suggestions, under no-training terms;
- notification channels you connect yourself.
A current list is available on request. We disclose data to authorities only when legally required.
10. Where data is stored
The widget and the hosted chat page are served from chat.askcub.com and conversations run through ws.askcub.com. Data is currently stored in the United States. Where data leaves the region in which it was collected, we rely on recognised safeguards such as standard contractual clauses, and on encryption in transit.
11. Your rights
Depending on where you live, you may have the right to access, correct, export, delete or restrict the processing of your personal data, to object, to withdraw consent, and to complain to a supervisory authority.
Account holders can do most of this in the console. For anything else, write to hello@tapcub.com; we respond within 30 days. Visitors should contact the site operator, who can delete or export their conversations from the console.
12. Security
All traffic is encrypted in transit. The chat window runs in an isolated iframe, so scripts on the host page cannot read the conversation. Card-number-like patterns are masked in the inbox by default. Access is role-based and tenant-isolated, administrative actions are logged, and we notify affected customers of a personal data breach without undue delay and, where the GDPR applies, within 72 hours.
13. Changes to this policy
We update this policy when the product or the law changes. Material changes are announced by email or in the console before they take effect, and the date at the top of this page tells you when it last changed.
14. Contact
Write to hello@tapcub.com. If you are not satisfied with our answer, you can complain to the data protection authority in your country.