Data we process and why
We process account and contact details to provide the service. Your website content and approved documents prepare search and answers. Conversations, contact details you volunteer and data needed for authorised actions support answers, human follow-up and service diagnostics. AI requests may include questions, relevant conversation history, authorised document excerpts and necessary member-action results. Conversations and private member facts are not automatically added to website knowledge. Do not submit passwords, payment-card details or unnecessary sensitive data.
AI processing services we use
AskCore uses the GenCMS / AIHK AI processing service from iGears for answer generation, converting text into search representations (embeddings), and ranking search results. Necessary questions, document text, conversation context and authorised action results are sent to this service according to the feature used. These service names identify the data-processing route.
Confirmation outstanding: a complete verified list of other model providers or subprocessors receiving data behind GenCMS / AIHK, their processing locations and contractual arrangements is not yet available. This page therefore cannot guarantee that only the named service receives data or that all AI processing takes place in Hong Kong. Obtain the written list and arrangements for your deployment from us before submitting personal or confidential data.
Is data used to train models?
The current AskCore answering and knowledge-preparation workflows do not train or fine-tune general-purpose AI models on your uploads or conversations. Preparing searchable text and embeddings lets the assistant retrieve your approved content; it is not model training. Service diagnostics may retain request and response excerpts under the rules below.
AI processor use requires separate confirmation: we do not yet have verified no-training terms and retention commitments covering the complete processing chain above. We therefore cannot currently promise that every processor refrains from model training or that processing has zero retention. The description of uses within AskCore is not a promise by an external processor. Confirm these arrangements with us first; an unconfirmed position must not be treated as a prohibition on training.
How long data is kept
These are the current rules by category. Scheduled cleanup processes expired data. Expiry of chat access on your device does not also delete the case content held by the service.
| Data category | Retention and deletion |
|---|---|
| Anonymous web pre-sales conversations | With guest privacy enabled, content and related personal data become due for cleanup 7 days after the last visitor message. Requests handed to people follow the next rule. |
| Anonymous human-support cases | Content and related personal data become due for cleanup 30 days after closure. Open or reopened human requests remain available for follow-up. Independently maintained shared customer-contact records are not automatically deleted when one case expires. |
| Member conversations, email cases and account records | The anonymous-guest 7/30-day rules do not apply. There is currently no common automatic expiry period; records remain until authorised deletion or a separately agreed retention arrangement is applied. Other messaging channels have separate policies. Necessary payment or legal records may require separate retention. |
| Knowledge documents and search data | Original temporary uploads are removed after successful processing. Extracted text, search data and source metadata remain until authorised deletion or an agreed arrangement applies. Failed uploads require administrator attention. Download links point to your approved websites or documents. |
| Temporary progressive answers | Cleared on completion. A remaining temporary copy expires 10 minutes after its last update. The saved full conversation still follows its conversation category above. |
| Anonymous access and recovery | Chat credentials in page memory expire after 5 minutes of inactivity or 60 minutes in total, and ending the chat revokes access. Single-use email recovery codes last 10 minutes and do not grant member access. Related expired access and recovery records become eligible for routine cleanup 24 hours after expiry. |
| Diagnostics, usage and audit records | Guest-conversation erasure removes or clears linked raw diagnostic, action and personal data. Content-free usage, quality and erasure records may remain. Other diagnostics and audit records currently have no common automatic expiry period and require authorised deletion or an agreed retention arrangement. |
| Specified AskCore-managed backups | Specified database backup files become eligible for daily cleanup 30 days after their last file modification, and specified quality-check and diagnostic logs after 7 days. This is not a maximum retention guarantee for every backup. Infrastructure-provider snapshots, separately managed copies and downloaded files are outside this rule; their periods require separate confirmation. |
| Data retained by AI processors | Each processor’s retention of requests, outputs and security records awaits written confirmation. The AskCore 7/30-day and temporary-storage rules above do not apply to processor copies. Deleting AskCore content does not establish simultaneous deletion by a processor. |
Storage and processing locations
Standard cloud service: The actual storage region is not currently publicly confirmed. Confirm it with us before uploading personal data. Storage, backup and AI processing locations each need confirmation.
Dedicated Hong Kong deployment or a customer-selected environment can be arranged separately. The written proposal defines the actual storage, backup and AI processing scope. Standard cloud service does not automatically include dedicated Hong Kong deployment or mean that all processing takes place in Hong Kong.
Access and separation of data
Your authorised workspace members access data according to their permissions. Authorised iGears platform operations and support staff may access necessary data for support, maintenance and security investigation; tenant impersonation is recorded in audit logs. Tenant data is separated. Sharing knowledge between websites in the same tenant requires an explicit choice and does not automatically share conversations or action permissions. Necessary data also goes to the AI processing service above and the messaging or other services you enable.
Your responsibilities and privacy requests
We process necessary data for the stated purposes. Ensure you have authority to provide visitor and customer data, explain its uses to the people concerned, obtain the necessary permissions and avoid excessive collection. A new purpose or marketing use requires appropriate notice and consent. An enquiry does not automatically subscribe anyone to marketing emails.
For confirmation of processors, retention or training arrangements, or requests for access, correction, deletion or privacy information, email [email protected]. We may need to verify your identity and workspace authority. We will explain limits on deletion arising from legal or unfinished service obligations. Deletion does not immediately erase every backup, copy or third-party record.