Privacy Policy

askTheodor is operated from Germany (EU). For privacy questions, contact privacy@asktheodor.com or open a ticket at support.asktheodor.com.

askTheodor is a desktop app. Your conversations, documents, memory, and workfiles are processed and stored on your own machine. We do not receive, store, or have access to that content. When you connect a third-party AI model or tool, your data flows directly from your device to that provider under their terms.

Purchases & licensing. When you buy a licence, payment is handled by Stripe; we receive your email, order metadata, and a Stripe customer/subscription id (never your card number). We store your licence, plan, and the devices it is activated on (a device identifier and activation timestamps) to enforce your seat count.

Support. If you open a support ticket, we store your name, email, and the messages you send so we can help you.

Affiliates. If you join the affiliate programme, we store your name, email, payout details, referral code, and aggregate click/conversion counts. Referral links set a first-party cookie to attribute a purchase to the referring affiliate.

Customer referrals ("invite a friend"). If you share your personal referral link, we generate a referral code for your account and record each signup made through it: the referred person’s email address, their order, and whether the referral has qualified for a reward. That record is linked to you as the referrer, and we keep it for as long as the reward can be claimed or audited (and as required by German tax law for the discount granted). The person you refer sees no data about you beyond the link itself, and you are never shown their email address — only counts. Legal basis: performance of the contract and our legitimate interest in preventing reward fraud (Art. 6(1)(b) and (f) GDPR).

Site analytics. We keep minimal, privacy-respecting usage counts (e.g. page views, download and checkout events) using a hashed visitor identifier. This runs server-side, sets no cookie, and is always on.

Google Analytics (only with your consent). If you accept our cookie banner, we load Google Analytics 4 on asktheodor.com and on our docs, academy, and support subdomains, to understand which pages are useful. It sets third-party cookies and transmits your IP address, pages viewed, and device/browser details to Google Ireland Ltd., who may transfer them to Google LLC in the USA. Nothing is loaded and no analytics cookie is set until you accept — declining, or simply ignoring the banner, keeps it off. We do not use it for advertising or remarketing.

We process purchase and licensing data to perform our contract with you; support data on the basis of our legitimate interest in helping customers; and our own server-side usage counts on the basis of legitimate interest in a working, secure website.

Google Analytics and both attribution cookies run only on your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG). You can withdraw at any time, with effect for the future, by deleting the at_consent cookie in your browser — the banner will then ask again. Transfers to Google LLC in the USA rely on the EU Commission's adequacy decision for the EU-US Data Privacy Framework and Google's standard contractual clauses.

We share data with the processors that run the service: Stripe (payments), our hosting provider (an EU server), and — only if you consented to analytics — Google Ireland Ltd. (Google Analytics). Transactional email (licence keys, support replies) is sent from our own self-hosted mail server in the EU — no third-party email provider is involved. We do not sell your data.

We keep purchase, licence, and invoice records as long as required by law (tax/accounting) and for the life of your licence. Support tickets are kept while relevant to your account. You can ask us to delete data we are not legally required to keep.

Under the GDPR you may request access, correction, deletion, restriction, portability, and object to processing. Email privacy@asktheodor.com and we will respond within one month. You may also lodge a complaint with your local data protection authority.

Essential (no consent needed): first-party cookies for sign-in (admin), and at_consent (180 days), which remembers your choice here.

Only after you accept: two first-party attribution cookies (90 days each) — ref if you arrived via an affiliate partner’s link, and rref if you arrived via a customer’s “invite a friend” link. Each records only that code, so the referral can be credited when you buy; and Google Analytics' third-party cookies (_ga, _ga_* — up to 2 years), which are set by Google and shared across asktheodor.com and its docs, academy, and support subdomains.

We use no advertising or remarketing cookies. If you ignore or dismiss the banner, no non-essential cookie is set — dismissing is not consent.