askbowtie ("we", "us") builds a lightweight analytics and error-monitoring tracker, bowtie.js, that site owners embed on their sites and query through their AI agent over MCP. This policy covers two things: the data we hold about you as an askbowtie customer, and the data the tracker collects from visitors to the sites that run it.
The short version#
- No cookies by default. The tracker sets no cookies and uses no cross-site identifiers. A session is a random id held in the browser's
localStoragefor 30 minutes of activity. It is not a tracking cookie and does not follow anyone across sites. - No personal data is collected by design. We never capture form input values, and click text is scrubbed for emails, phone numbers, and card numbers before it leaves the page.
- We don't sell data, run ads, or share with data brokers. Ever. There is no second business model here.
- Aggregate bot statistics only. We may publish anonymous, grouped counts of AI-crawler traffic across our customer base. Never your human visitors, never your numbers, never your name. Opt out any time.
- You can export or delete your data by emailing support@askbowtie.com.
Data we hold about you (the customer)#
| What | Why |
|---|---|
| Your email address and any linked sign-in identities (e.g. Google) | To create your account and sign you in. We use passwordless sign-in, so we never store a password. |
| The domains you add and their settings | To know which sites to track and how to interpret conversions for each. |
| Connector grants (Google Search Console, Google Ads) if you connect them | Stored encrypted at rest; used only to pull your own search and ads data into your dashboard. Revoke any time in settings or at your Google account. |
| MCP API tokens you create | Stored only as a hash. The raw token is shown once and never again. |
| Support emails you send us | To answer you. |
| Your payments and credits | Your credit balance, a ledger of every purchase and every Ask charge (when, how much, which question), and the Stripe ids that link your account to your Stripe payments. Used to charge you correctly, show your history and keep our financial records. Your card details go to Stripe and never reach us. |
| Your conversations with the in-app agent: the questions you type and the answers you get back | So a refresh does not lose your work, and so you can reopen a past conversation. Stored against your account and readable only when you are signed in as you. Your saved history does not include the underlying analytics your question pulled in. Kept for 90 days, and you can delete any conversation from the ask page at any time. |
What the tracker collects from your visitors#
When a visitor loads a page on a site running bowtie.js, the tracker records anonymous usage and error data so the site owner can see what's working and what's broken:
- Page paths viewed, referrer, and page title (title and referrer are length-limited and scrubbed)
- A 30-minute session id from
localStorage(not a cookie, not cross-site) - Clicks: recorded as element context (tag, id, class, link target) only. Never the text inside, never input values.
- Errors: JavaScript errors, failed network requests, broken resources, content-security-policy violations, and rage clicks
- Performance metrics (Core Web Vitals: LCP, CLS, INP/FID, TTFB)
- Marketing attribution on session start: UTM parameters and ad click ids (e.g.
gclid) present in the page URL - Custom events and conversions the site owner chooses to send via the tracker's API (the site controls exactly what those contain)
Derived from the network request, not stored as identity
- Approximate country: from an edge header (country only; not city, not a precise location)
- Browser, OS, and device type: parsed from the User-Agent string
- IP address: used transiently for rate-limiting and the country lookup. It is not written to the event record.
Optional visitor identity
A site owner can call bowtie.identify() with their own identifier (for example a user id or a hashed email) to connect a visitor's sessions, useful for funnels that complete across multiple visits. This is off by default. When a site uses it, that identifier belongs to the site owner and is collected under their relationship with their visitor, not ours. Sites that never call it stay fully cookieless and identifier-free.
Roles: who controls the data#
For data collected on a customer's own site, the site owner is the data controller and askbowtie is the data processor. We process that data only to provide the analytics service to them, on their instruction. The site owner is responsible for having a lawful basis to run analytics and for their own visitor-facing privacy notice. For data about askbowtie customers themselves (your account), askbowtie is the controller. askbowtie is operated by Benjo LLC (Kentucky, USA); reach us at support@askbowtie.com for any data request.
Aggregate statistics about bot traffic#
We sometimes publish aggregate statistics about automated traffic: how many sessions across our customer base came from AI crawlers such as GPTBot, ClaudeBot or Meta-ExternalAgent, and how that mix changes over time. Two hard limits, and they are the whole point:
- It covers bots only. A crawler is machine traffic, not a person: no visitor, no IP, no identifier, nothing describing a human being. We never publish statistics about your human visitors, your traffic volumes, your conversions, or your revenue.
- You are never named. No customer, domain, industry or country is identified, and figures are only ever published grouped across sites, never per site.
If you would rather your site's bot counts were left out even of anonymous totals, email support@askbowtie.com and we will exclude them. No reason needed.
Cookies#
askbowtie.com itself uses one essential, first-party cookie to keep you signed in to your dashboard. That is the only cookie. The tracker we distribute sets none. Because no tracking cookies are involved, sites running only bowtie.js generally do not need a cookie-consent banner for it, though you should confirm your own obligations.
Paid Ask: what we keep and for how long#
When you ask Ask a question, in the app or by email, we keep a working record of it so we can check that Ask answered well and fix it when it did not. For each question that record holds: the question you typed, the notes the model wrote while working, the lookups Ask ran on your data and the first part of what each one returned (so it can contain figures from your own site), how long each step took, what it cost, and the answer.
This record is internal. It is never shown on a page, never sold, never shared, and never used to train anyone else's AI models. Only we can read it.
We keep it for 30 days, then it is deleted automatically. You can ask support@askbowtie.com to delete yours sooner.
Three other things are kept separately. Your conversation history, the part you see in the app, is kept for 90 days and you can delete any conversation yourself. A short log of which lookups ran, how long they took and whether they worked, with no question or answer text, is kept for 12 months. And a billing record of every question (when it ran, which model, how many tokens, what it cost), again with no question or answer text, is kept as a financial record after the working record is gone (see Your rights).
Where data lives and who else touches it#
Data is stored on Cloudflare's infrastructure. We use a small number of processors strictly to run the service: Cloudflare (hosting and edge), an email provider (Resend) to send sign-in links, alerts, and the reports you ask for, and to receive the questions you email to Ask, Stripe, which takes your card and processes payments when you buy credits or Pro (Stripe receives your email address, what you are buying and the amount, and an internal account number so we can match the payment to you; card details go to Stripe and never touch our servers, and Stripe's own privacy policy covers what it holds), and Anthropic, which writes the answer when you use Ask (it receives your question and the specific figures needed to answer it, nothing more). If you connect Google Search Console or Google Ads, we exchange data with Google on your behalf to pull your own metrics. We do not use any advertising or data-broker services.
How long we keep it#
We keep your account data for as long as your account is active. Analytics and error data is retained to power your dashboard and historical comparisons; operational logs (uptime checks, resolved alerts) are pruned automatically on a rolling basis. You can ask us to export or delete your data at any time, and we'll action it. Ask question records are kept 30 days, Ask conversation history 90 days, and the Ask lookup log 12 months. Billing records (purchases, credit charges and Stripe identifiers) are kept as financial records.
Your rights#
Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict its processing. To exercise any of these, email support@askbowtie.com. We'll respond within a reasonable time and won't make you jump through hoops. When you delete your account we remove your data, except billing and usage totals (how many questions, what they cost) and the record of your purchases, which hold no question or answer text and which we keep as financial records.
Children#
askbowtie is a tool for site owners and is not directed at children. We don't knowingly collect personal data from anyone under 16.
Changes#
If we change this policy materially, we'll update the date above and, for significant changes, notify account holders by email. Continued use after a change means you accept the updated policy.
Contact#
Questions, requests, or concerns: support@askbowtie.com.