Document: AI Data Processing — One-Pager
Product: AskMike.AI (askmike.tools) — Ask Mike
Company: AskMike.AI, an MCubed company | Contact: info@mcubedbi.net
Not a warranty schedule unless expressly incorporated into an Order Form after verification
1. Purpose
This one-pager explains, in plain language, how Ask Mike handles data when AI-assist features are used. It does not create contractual commitments beyond the MSA/DPA unless expressly incorporated into executed contracts.
2. What can go to the model (OpenAI API)
When an Authorized User uses AI Features, the following may be sent to the model provider (currently OpenAI API; see Subprocessors):
- User prompts and instructions
- Selected context the product attaches (e.g., CRM fields, notes, collection status snippets, analytics summaries — as designed by the feature)
- Conversation / thread turns needed for the feature to work
- System / developer instructions defined by Ask Mike to shape behavior
Customer / Admin control: Limit what users paste into prompts; use product scoping where available; avoid special-category or unnecessary personal data in free-text fields.
App infrastructure is Vercel + Neon Postgres; model inference is via OpenAI API.
3. What stays in the application database (Neon)
Typically retained in Ask Mike’s application database (multi-tenant Postgres), subject to product design and retention settings:
- Account, tenant, and user records
- CRM / collections / analytics business records Customer stores in the app
- Saved prompts, AI conversation history, or “assist” artifacts the product persists for the user/tenant
- Configuration, roles, audit metadata as implemented
- Operational logs retained by Ask Mike (see Section 6)
These records are not automatically the same as what OpenAI retains under its API policies.
4. No-training default for OpenAI API (vendor policy — not an MCubed warranty)
Stated as vendor policy awareness, not as a Provider warranty:
- OpenAI’s API data-usage policies have historically provided that, by default, data sent via the API is not used to train OpenAI models for the broader public training sets, subject to OpenAI’s then-current terms and any enterprise agreements.
- Policies change.
- AskMike.AI / MCubed does not independently warrant OpenAI’s training practices. Any contractual “no training” commitment to Customer must be expressly written into an Order Form or Schedule.
AskMike.AI does not claim Zero Data Retention (ZDR) or Modified Abuse Monitoring (MAM). See the OpenAI MAM / ZDR checklist.
5. Abuse monitoring / logging: default vs. MAM goal
| Topic | Current posture |
|---|---|
| OpenAI default | API providers commonly retain limited data for abuse monitoring / trust & safety for a period defined by the vendor, unless an enterprise configuration (e.g., Modified Abuse Monitoring / MAM, Zero Data Retention, or successor programs) applies. |
| Ask Mike goal | Pursue enterprise configurations (MAM / ZDR or successor) if/when eligible and enabled on the Provider OpenAI org. |
| Current claim | Abuse-log default is the conservative assumption. MAM/ZDR are not claimed. |
6. Retention inside Ask Mike
- Saved prompts / AI threads: retained for the life of the tenant account or until user/admin deletes, subject to backup cycles and legal holds
- Business CRM/collections data: retained per Customer’s use and account lifecycle; export/delete per DPA on termination
- Provider operational / security logs: retained for a limited period for security, debugging, and abuse prevention
- Backups: rolling retention per infrastructure provider (Neon/Vercel-related)
7. What is not claimed
AskMike.AI / MCubed does not claim:
- SOC 2, ISO 27001, HIPAA, FedRAMP, PCI DSS, or similar certifications (none claimed; see Security certifications)
- Zero Data Retention or Modified Abuse Monitoring as currently enabled
- That no Customer Data ever leaves the Ask Mike database when AI Features are used
- That AI outputs are accurate, unique, non-infringing, or suitable for automated credit/collections decisions without human review
- That OpenAI (or any model vendor) policies are Provider warranties
- EU/UK transfer mechanisms or Data Privacy Framework membership beyond what is attached in the DPA
- That the product is designed for special-category health data, children’s data, or similar regulated sets without a further addendum