Privacy Policy

1. Controller and contact

Hesselbom Tech AB, organization number 559450-0372, of Berguven 8, 436 53 Hovås, Sweden, is the controller for the personal data described in this policy. Questions and requests may be sent to viktor@asosuite.com.

2. Data we process

Account and authentication data

We process your email address, account identifier, authentication status, account creation and update times, and security-related account events. AWS Cognito manages authentication. The website stores authentication tokens in secure, HTTP-only cookies so the dashboard can maintain your session.

API keys and usage

We store a cryptographic hash and visible prefix of each API key, its name, approved scopes, status, creation time, optional expiry, usage count, and last-used time. A dashboard-created secret is displayed once. For browser-assisted agent login, the secret is delivered in a verifier-encrypted envelope that expires with the temporary ten-minute authorization record and is not displayed in the browser. We also process request identifiers, endpoint usage, credit reservations, completed usage, restorations, balances, and account status.

API input and output

We process search terms, storefronts, platforms, app identifiers, request parameters, generated results, cache status, timestamps, and related popularity evidence. These inputs are not intended to contain personal data. Please do not use names, contact details, confidential information, or sensitive personal data as search terms.

Technical and security data

Our infrastructure and hosting providers may process IP addresses, timestamps, user-agent information, request routes, response status, diagnostic events, and security signals. Sentry is configured to remove authorization data, cookies, request bodies, user details, query strings, and keyword-bearing fields from captured application events.

Website and conversion analytics

We use PostHog Cloud EU to understand how people find and use the website and whether they progress through account creation, API activation, checkout, purchase, and refund events. We also use Meta Pixel and the Meta Conversions API for advertising attribution, audience measurement, and registration, checkout, and verified-purchase conversions. This may include page paths, referring sites, campaign parameters, browser and device information, IP address and user agent, coarse location derived from network information, automatically captured clicks and form interactions, advertising-cookie identifiers, an opaque account identifier after sign-in, conversion-deduplication identifiers, credit-pack details, and transaction amounts and currencies. We do not send either service account email addresses, API keys, App Store search terms, app identifiers submitted to the API, payment-card details, authentication codes, or Polar checkout identifiers.

Payments, support, and legal requests

When billing is enabled, we process Polar customer, checkout, order, and webhook identifiers; purchase amount, currency, tax, credits purchased, payment status, receipt or invoice references, and refund information. We send Polar your account identifier, email address, checkout metadata, and source IP address so Polar can identify the customer, detect country and currency, calculate tax, prevent fraud, and fulfil the transaction. Polar receives payment-card and payment-method data directly; ASO Skill does not store full card details. If you contact us or exercise a legal right, we process your message, contact details, order reference, and our response.

3. Why we use data and our legal bases

We do not currently use your account email for promotional marketing. If we introduce optional marketing, we will provide the required notice and choice before doing so.

4. Apple requests and cached keyword data

To answer relevant API calls, ASO Skill sends search terms, app identifiers, storefront, platform, and technically necessary request information to Apple services. We do not intentionally send your ASO Skill email address, payment information, or API secret to Apple. Apple processes information under its own terms and privacy practices.

ASO Skill stores the latest cached responses and related popularity observations so that repeated requests can be answered more quickly and fallback scores can improve. Different data types have different refresh intervals. Cache freshness is not the same as storage retention: some keyword evidence may remain after a response becomes stale because it supports future calculations.

5. Service providers and other recipients

We use the following categories of recipients:

• Amazon Web Services (AWS) for API hosting, compute, databases, authentication, parameters, logging, and infrastructure monitoring. The primary API region is Stockholm, Sweden.
• Vercel for hosting and delivering the ASO Skill website and dashboard.
• Polar Software, Inc. as merchant of record for checkout, payment processing, transaction-tax compliance, fraud prevention, refunds, receipts, invoices, and payment records.
• Sentry for sampled application-error and performance monitoring.
• PostHog Cloud EU for website, product, funnel, and conversion analytics hosted in Frankfurt, Germany.
• Meta Platforms for advertising attribution, audience measurement, audience building, and deduplicated browser/server conversion reporting through Meta Pixel and the Meta Conversions API.
• Apple as the upstream provider receiving applicable search and popularity requests.
• Professional advisers, authorities, courts, or counterparties where reasonably necessary to comply with law, protect rights, or complete a corporate transaction.

Some providers act as processors on our instructions, while others—including payment networks and Apple for their own services—may act as independent controllers for some processing.

6. International transfers

The primary API infrastructure is in Sweden and PostHog analytics data is hosted in Germany. Meta, Vercel, Polar, Sentry, Apple, and parts of AWS may process data in countries outside Sweden or the European Economic Area. Where GDPR transfer restrictions apply, we rely on the safeguards made available by the relevant provider, such as an adequacy decision, the EU–US Data Privacy Framework where applicable, or the European Commission’s standard contractual clauses, together with supplementary measures where required.

7. Retention

We keep personal data only for as long as reasonably needed for the purpose for which it was collected, including:

• Account profiles and active API-key records while the account is open. Revoked-key metadata may be retained for security and audit purposes.
• Short-lived authentication cookies for their configured session lifetime.
• Credit and API-usage records for metering, customer support, abuse prevention, reconciliation, and legal claims.
• Payment, invoice, tax, refund, and accounting records for the period required by applicable law.
• Operational logs and Sentry events according to configured provider retention periods and only while useful for security and reliability.
• PostHog analytics events according to the configured PostHog retention period and only while useful for product and commercial analysis.
• Meta Pixel identifiers and conversion events according to Meta's configured retention and advertising-account settings.
• Meta checkout matching context in our core database for up to seven days, after which DynamoDB expires it automatically.
• Cached API results according to service lifecycle settings. Related keyword-popularity evidence may be retained longer and overwritten or removed when no longer needed to support the Service.
• Support, complaint, and withdrawal correspondence while the matter is handled and afterward where needed for consumer compliance or legal claims.

When data is no longer needed, we delete or anonymize it unless continued retention is required or permitted by law.

8. Security

We use measures intended to protect data, including encryption in transit, managed encryption at rest, least-privilege access, hashed API-key storage, protected authentication cookies, infrastructure access controls, rate limiting, monitoring, and backups or point-in-time recovery where appropriate. No online service can guarantee absolute security.

9. Your rights

Depending on the circumstances, GDPR gives you rights to information, access, correction, deletion, restriction, data portability, and objection. Where processing is based on consent, you may withdraw consent without affecting earlier lawful processing. You may object at any time to direct marketing.

Some rights are subject to exceptions—for example, we may need to retain invoices or information necessary to establish or defend a legal claim. To exercise a right, email viktor@asosuite.com. We may ask for information needed to verify your identity.

You may lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or with another competent data-protection authority.

10. Account deletion

You may request account deletion at viktor@asosuite.com. We will remove or anonymize information that is no longer required, revoke active API keys, and explain any information we must retain. Closing an account does not automatically erase records that applicable accounting, tax, consumer, security, or legal-claims rules require us to keep.

11. Cookies

The website uses cookies that are technically necessary for sign-in security and account sessions, including OAuth state, verifier, access, ID, and refresh-token cookies. PostHog stores a persistent anonymous analytics identifier in first-party cookies and local storage so we can recognize repeat visits and connect a visitor's journey to account and purchase events. Meta Pixel sets advertising and attribution cookies so Meta can measure visits and conversions, associate them with advertising interactions, and build audiences. Analytics and advertising measurement start when the website loads.

12. Children

ASO Skill is not directed to children. You must be at least 18 to create an account or purchase credits. If you believe a child has provided personal data, contact us so we can investigate and delete it where appropriate.

13. Changes

We may update this policy as the Service or law changes. We will identify the current version and effective date here and provide reasonable notice of material changes.