Who is responsible
- Company details: Advisable IKE, Irous 4, 10442 Athens, Greece, VAT EL801073759 (advisable.com). Email: welcome@advisable.ai.
- Advisable IKE is the controller for your account data, billing, our communication with you, security and usage measurement of the website and application.
- For the content your business brings (data from connections, questions, files, answers), your business is the controller and Advisable IKE processes it on its behalf as processor, under the Data processing agreement.
What data we process
- Account: email, first and last name, phone (asked at sign-up), role in the business, language, sign-up and last sign-in dates. Your password is stored only as a cryptographic hash.
- Business: name, VAT number, tax office, address and activity (from GEMI or AADE when you give a VAT number), members and roles, logo.
- Billing: plan, subscription, invoices and, for the card, only its last 4 digits, type and expiry. Only Viva processes the card number.
- Connections: addresses and access details of the systems you connect, encrypted with AES-256-GCM.
- Content: questions, answers, attachments, files you create, Projects, Skills, Routines and whatever the connections return when you ask.
- Usage and security: which tools were called (arguments in brief, without results), AI token counts, answer ratings and comments, sign-in and abuse-protection records.
- Contact: what you write in the contact or partner form, with the IP address it was sent from.
- Sign-up source: which page or campaign brought you (UTM, referring page).
- Usage measurement: if you accept, how you use the pages, through Microsoft Clarity (see below).
Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Account, connections, answers, support | Performance of a contract, Art. 6(1)(b) |
| Billing, invoices, myDATA | Contract and legal obligation, Art. 6(1)(b) and (c) |
| Security, abuse and spam protection | Legitimate interest, Art. 6(1)(f) |
| Usage measurement with Microsoft Clarity | Consent, Art. 6(1)(a) and Greek law 3471/2006 |
| Contacting you to help you get started and about the service (for example on the sign-up phone number) | Legitimate interest, Art. 6(1)(f); you can object at any time |
| Replying to messages and partnership requests | Pre-contract steps or legitimate interest |
| Account and trial notices (for example the reminder before a charge) | Performance of a contract |
Artificial intelligence
Answers are produced by Anthropic's Claude models running on Amazon Bedrock by Amazon Web Services in Ireland (EU). To answer, the model receives the question, the chat history, the Project's instructions and knowledge, your attachments and the results of the connections. Amazon does not use this data to train models and does not share it with Anthropic. We do not train models with your data either.
Voice dictation is done by your browser; the audio never reaches our servers, but the browser may send it to its maker's speech service (for example Google, Apple). We make no automated decisions about people with legal or similarly significant effects.
Microsoft Clarity
If you choose Accept in the cookie banner, we use Microsoft Clarity on the pages of advisable.ai, and inside the application after sign-in, to improve how it works: to see where users get stuck, which steps fail and which errors appear. Clarity records clicks, taps, scrolling, mouse movement, the pages you visit and their titles, time on page, device, browser, screen size, approximate country and errors, and builds session replays and heatmaps from them.
- Masked content: before anything leaves the browser, we hide the text of messages and answers, the titles of chats and Projects in the menu, the business name and your email, and the content of application pages that show business data. Whatever you type in fields is never sent. On chat, Project and file pages the tab title becomes Advisable.AI, so it does not reach Clarity.
- Consent: Clarity loads only after you choose Accept, and then sets the
_clckand_clskcookies. With no choice or Reject it does not load at all. Withdraw your consent at any time from Cookie settings, at the bottom of the website's pages and in your account menu in the application. Details in the Cookie policy. - Where it does not run: pages with a secret link or code in the address (shared links, sign-in and password links, payments), pages with a search term or email in the address, and file previews.
- Advertising: we do not share Clarity data with Microsoft Advertising.
- Retention at Microsoft: session replays 30 days (those we mark as favourites up to 13 months), heatmaps and aggregate data up to 13 months.
- Microsoft processes the data under its privacy statement.
Who receives data
We do not sell data. We share it only with providers that help us run the service (hosting, AI, email, payments, invoicing, usage measurement), under a written contract and only as needed. The full list is on the Sub-processors page. We also give data to authorities when the law requires it, and to the systems you connect when you approve an action.
Access by our team: authorised members of the Advisable team, bound by confidentiality, may view a business's account and chats when needed for support, security or investigating a problem, and ask questions from within the account to reproduce a problem. Signing in to your account for support is logged. In it they can also add or remove members and invitations and add seats, which are charged to the business's card; they cannot add, delete or share connections.
Transfers outside the EEA
The application, the database and the AI model are in the EU (Germany and Ireland). Some providers (Cloudflare, Resend, Microsoft, Supabase) may also process data in the USA, and GoCardless in the United Kingdom, which has an adequacy decision. In those cases we rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
How long we keep data
- Account, connections and content: for as long as the account exists. You can delete a chat or a file at any time; deleting a chat also deletes the files created in it. Deleting a connection deletes its access details.
- After a trial or subscription ends: we keep it so you can continue. If you ask us to delete the account or the business, we delete it within 30 days.
- Invoices and billing records: as long as tax law requires.
- Aggregate usage figures: up to 400 days. SMS delivery reports (Apifon connection): 90 days.
- Tool-use records and our team's sign-ins: for as long as the account exists, for security and investigating problems.
- Contact messages: as long as needed to reply and continue working together.
- Read-only shared links: expire after 30 days or when you revoke them.
Security
All traffic uses HTTPS. Connection access details are encrypted with AES-256-GCM and the key exists only on the server. Passwords are stored with bcrypt. Every request that changes data is checked for its origin, sign-in attempts are rate-limited and requests to internal networks are blocked. Writes to systems need your confirmation. If a breach affects you, we inform you as the law requires.
Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time. Email welcome@advisable.ai and we reply within one month. For data we process on behalf of a business, contact that business first; we will help it respond. You can also complain to the Greek Data Protection Authority.
Children
The service is for businesses and adults. We do not knowingly collect children's data.
Changes
When something material changes in this policy, we tell you by email or in the application. The date of the last update is at the top of this page.