Privacy notice.
Last updated 29 October 2026
This notice explains what Ask All Four does with personal data. The data controller is Forthwith Ltd, a company registered in England and Wales, company number 17485635, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. We handle personal data under the UK GDPR and the Data Protection Act 2018.
What we collect
| Data | Why | Lawful basis |
|---|---|---|
| The business name, category, location and domain you type in | To run the check and produce your report | Legitimate interests, or performance of a contract if you subscribe |
| Your email address | To unlock the full report, and to send your weekly monitoring emails | Legitimate interests for the report; contract for subscriber emails |
| Your IP address | To limit how many free checks one network can run, and to keep the service up | Legitimate interests |
| The results of your checks | To show you the report, and to compare this week against last | Legitimate interests, or contract if you subscribe |
| A Stripe customer reference | To link your subscription to your payments | Performance of a contract |
We do not collect special category data, and we do not ask for anything we do not need. We never receive your card details - those go straight to Stripe.
What we send to the AI assistants
Two different steps send data outside our servers, and they differ in what they reveal about you. Both are worth understanding before you run a check.
Drafting your questions
To write questions your buyers would actually ask, we fetch the text of your public homepage and send it to a language model through OpenRouter. This identifies your business, because your homepage does.
Asking the four assistants
When we then ask the four assistants, we send only the question and the country or town the asker is in. We deliberately do not tell them your business name - naming you would change the answer and make the measurement worthless. This is a methodological requirement that happens to be good for your privacy.
These providers may process your data in the United States. Where they do, we rely on their standard contractual clauses and the UK addendum. Providers may retain inputs for a period under their own policies to detect abuse.
Who else handles your data
| Processor | Where | What for |
|---|---|---|
| Contabo GmbH | Germany / Netherlands (EU) | Hosts the service and its database. |
| Cloudflare, Inc. | United States | DNS and network protection for the website. |
| Stripe Payments Europe, Ltd. | Ireland, with transfers to the United States | Takes and processes payments. We never see or store your card details. |
| Resend (Plus Five Five, Inc.) | United States | Delivers the emails we send you. |
| OpenRouter, Inc. | United States | Routes our questions to the AI assistants below. |
| Explee | United Kingdom | Finds contact details for, and sends, the outreach emails described under “If an email came from our campaign with Explee”. |
| OpenAI, Anthropic, Google and Perplexity | United States | The four assistants we ask. What reaches them is described under “What we send to the AI assistants”. |
We do not sell your data, and we do not share it for anyone else's marketing.
How long we keep it
- Free checks and their results: up to 12 months, so you can return to your report link.
- Subscriber records and weekly results: for as long as you subscribe, and 12 months afterwards, so a returning customer's history still means something.
- Billing records: six years, as UK tax law requires.
- Email addresses from unlocked reports: 24 months, unless you ask us to delete them sooner.
Emails we send
If you subscribe, the weekly monitoring emails are part of the service you bought, not marketing. Every email carries a one-click unsubscribe, and unsubscribing ends the emails. If we ever send marketing, it will be on the basis permitted by the Privacy and Electronic Communications Regulations and you will be able to opt out of it separately.
If we contacted you and you have never used this site
We sometimes email a business to show it what the four assistants said about it. If that is how you found us, this section is the one that applies to you, and the law requires us to tell you all of it without being asked.
| What we hold | Where it came from |
|---|---|
| Your business name, town and website | OpenStreetMap, which publishes it as open data |
| A contact address - either a named one such as sarah@, or a general one such as info@ or events@ | Your own public website, and only ever an address published there on your own domain. We never buy contact data from a broker and never guess an address from someone's name |
| Your company number, registered name and company type | Your own website, and the Companies House public register |
| What the assistants said when asked about your category | Generated by us, by running the same check this site sells |
We use it to send you one email about what we found, and at most one short follow-up about a week later if you have not replied. Our lawful basis is legitimate interests - ours in finding customers, yours in knowing that AI assistants are answering questions about your market. We only contact limited companies and LLPs, and we confirm that at Companies House before writing, because the Privacy and Electronic Communications Regulations treat them differently from sole traders.
To stop hearing from us, reply to the email with "no". You do not have to give a reason and we will not ask for one. We keep your domain on a suppression list afterwards - that list is the only thing we keep, and we keep it precisely so that we never contact you again. Everything else we hold about you is deleted. You can also object or ask for deletion at any time by emailing [email protected], including before we have contacted you at all.
We do not sell this data, we do not share it with anyone else, and we do not use it to build a profile of you or to make any automated decision about you.
If an email came from our campaign with Explee
From October 2026 we have also used Explee (explee.com), an outreach service, to email founders and directors of UK businesses for us. The section above describes our own outreach. The Explee campaign works differently, and this is how:
- Where your details came from. Your name, job title, company and work email address came from Explee's business database and the contact-data providers it uses. Those providers may work out a work address from your name and your company's domain, then check that it accepts mail.
- Who sent it. Explee sends from its own mailboxes, under sender names it assigns. The email is from us, Ask All Four (Forthwith Ltd), and replies come to us.
- Why. Our lawful basis is legitimate interests - ours in finding customers, yours in knowing what AI assistants say about your market. We aimed the campaign at businesses with staff and excluded sole traders, because the Privacy and Electronic Communications Regulations treat sole traders as individuals. Unlike our own outreach, we did not check each company at Companies House first.
- To stop it. Reply "no" and neither we nor Explee will email you again. We add your domain to our suppression list so that stays true. You can also email [email protected] to object, or to ask what we hold about you.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or give it to you in a portable form. Email [email protected] and we will respond within one month. You can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you told us first so we can put it right.
Cookies
We do not use advertising or analytics cookies, and there is no tracking pixel in our emails. Stripe sets its own cookies on its checkout pages, which are governed by Stripe's privacy policy.
To see where people stop on the free check, the home page tells us which steps a visit reached: the page was seen, stayed open for ten seconds, was scrolled, the website box came into view, was tapped, typed in, sent. Each visit gets a random number that lasts only as long as that page is open, along with the name of the ad that brought it, if any. Nothing is stored on your device, no cookie is set, and no IP address or other detail about you is kept with it. We keep these records for 12 months.
Analytics
No analytics are used. The site does not load an analytics script, and it does not record page views, referring sites, browsers or locations. The free-check steps above are a separate record on our own server, not an analytics service.
Security
The site is served over HTTPS. Access to the server is restricted, and payment details never reach it. No system is perfectly secure, and if a breach affects your rights we will tell you and the ICO as the law requires.