Product Schedule — Olyteck Ask
Last updated: 19 June 2026
This Schedule sets out the product-specific particulars for Olyteck Ask and forms part of the Olyteck Data Processing Agreement. The framework (processor obligations, security measures, audit, transfers, change procedure) is in the master DPA; this page is the authoritative, version-dated list of the facts that differ between products.
1. Processing
Purpose: EU-hosted private AI that fills security questionnaires, RFPs / tenders and audits from the customer's own documents, inside Word and Excel.
Data minimisation: Customer documents are processed to generate answers; no customer content is used to train third-party models (each AI sub-processor publishes a no-training-on-API-data stance).
AI / LLM: Uses LLM sub-processors under no-training API terms. The active model is selectable by the customer.
2. Categories of personal data
- Customer-uploaded documents and the text extracted from them
- Conversation / answer history
- Account, workspace and billing data
3. Retention
| Data | Retention window |
|---|---|
| Account data | While the tenant is active, plus 30 days after deletion |
| Conversation history | Per-plan: 30 days (Free / Starter), 365 days (Pro and Enterprise, negotiable) |
Billing records are kept 10 years (French accounting law); audit logs 24 months — see master DPA §7.
4. Sub-processors
Each is bound by a written contract imposing data-protection obligations equivalent to the master DPA. This list is authoritative and version-dated.
| Sub-processor | Service | Region |
|---|---|---|
| Microsoft Ireland Operations Ltd. | Authentication (Entra ID); Microsoft Graph data is read where connected provider DPA → |
EU (Ireland) |
| Scaleway SAS | EU hosting (application, database, backups) | France (PAR1) |
Mistral AI no training on API data |
LLM text generation (Mistral Small / Large, when selected) provider DPA → |
EU (France) |
OpenAI no training on API data |
LLM text generation (when selected) — no training on API data provider DPA → |
US (SCCs) |
Google Ireland Ltd. no training on API data |
LLM text generation (Gemini, when selected) — no training on paid API data provider DPA → |
EU (Ireland) / Global |
Anthropic no training on API data |
LLM text generation (Claude, when selected) — no training on API data provider DPA → |
US (SCCs) |
| Stripe Payments Europe, Ltd. | Card payment processing & billing (Stripe Checkout / Tax) provider DPA → |
EU / Ireland |
5. Changes to this Schedule
Any addition or replacement of a sub-processor that materially handles Customer personal data is posted here at least 30 days before it takes effect, so the Customer can review and object on reasonable grounds. Customers may subscribe to e-mail notifications, or raise an objection, by emailing [email protected]. See the master DPA §6 for the full procedure, and the Trust Center for the company-wide view.