Privacy policy

Who we are

Hook & Plug is a brand of Shipalu LLC, 8401 Mayland Dr, Ste A, Richmond, VA 23294, United States. Contact us at [email protected] about anything in this policy.

For your account, we decide how your data is used (we are the controller). For the content of your website and your visitors’ searches and questions, we process data on your behalf to run the service for your site (we are your processor). If you need a data processing agreement, email us.

What we collect

Your account

• Your email address, used to sign you in (by emailed link; we have no passwords) and to send service emails such as usage warnings.
• A session cookie on app.hookandplug.com that keeps you signed in for up to 30 days. We store only a one-way hash of it.
• Your plan and usage: counts of items, searches and AI answers, and what the AI processing cost us.
• Billing details, handled by Stripe once paid plans are live.

Your website’s content

• The published, public posts, pages and text PDFs you choose: their title, address, text and category names. Drafts, private and password-protected content, and pages marked “noindex”, are never sent.
• PDFs: we read the text and do not keep the file. We store the text in passages, with page numbers, to answer questions.
• Your site’s address, its public key, the AskMyPages version and when it last synced.

Your visitors

• Search terms typed into your site’s search box, to return results. Identical searches are cached for 60 seconds; search terms are not stored with anything that identifies a visitor.
• Questions typed into the chat, to write an answer. A conversation is kept for 30 minutes so follow-up questions work, then deleted. An answer to a first question may be cached for 24 hours so the same question costs nothing next time.
• To limit how many questions one visitor can ask per day, we keep a one-way hash of the visitor’s network address for one day. We do not store the address itself.
• The AskMyPages plugin sets no cookies on your site. The chat remembers the current conversation in the visitor’s browser tab (session storage), which is cleared when the tab closes.

hookandplug.com

The website uses no analytics or advertising trackers. Our servers do not keep access logs of page visits; error logs contain no visitor content.

How we use it

• To provide search and answers for your site, and nothing else.
• To enforce plan limits, prevent abuse and keep the service secure.
• To bill you and to contact you about your account.

Your content and your visitors’ questions are never used to train AI models, by us or by our AI provider. We do not sell data or use it for advertising.

Who processes it for us

• OpenAI (United States): turns text into search vectors, writes answers, and checks questions and answers for harmful content. OpenAI does not train on data sent through its API and may keep it for up to 30 days to monitor abuse.
• OVH (United States): our server, database and encrypted backups.
• Cloudflare: network delivery and protection. Every request passes through it.
• Resend: sends sign-in and account emails.
• Stripe: payments, once paid plans are live.
• Microsoft 365: our email, if you write to us.

These providers may process data outside your country, including in the United States, under their own data protection commitments.

How long we keep it

• Your site’s content: while the site is connected. Disconnecting deletes its passages and search data from our live systems straight away.
• Your account: until you ask us to delete it. Usage records are kept for billing and tax as the law requires.
• Backups: encrypted nightly database backups are kept for up to 12 months, then overwritten. Deleted data disappears from them as they roll over.

Your rights

You can ask to see, correct, export or delete your personal data, or object to how we use it, by emailing [email protected]. Visitors to a site that uses AskMyPages should contact that site’s owner first; we will help them respond. Depending on where you live, you may also complain to your data protection authority.

Security

Data travels encrypted. Each connected site signs its requests with its own key, which never leaves the site; we keep only the public half. Every customer’s data is kept separate in our database, and backups are encrypted.

Children

Our service is for website owners and is not directed at children. We do not knowingly collect children’s personal data.

Changes

We will update this page when our practices change, and tell account holders by email about significant changes.