Access and deletion

Access and deletion

This page describes how you can obtain access to your data at Answely, download it and have it deleted – and where this reaches its limits. It forms part of our Privacy Policy.

There are three groups of people whose data may be held by Answely, and the route is different for each:

• Customers, i.e. anyone who has an Answely account. We are the controller for this data, and you can do almost everything yourself in the account.
• Visitors to our customers' websites who have asked a question in an answer box. The customer is the controller for this data; we process it only on the customer's behalf.
• Individuals who are named on a customer's public pages and whose information therefore appears in that website's search index. Here too, the customer decides what is in its index.

Requests reach us at support@answely.com. We reply within one month (Art. 12(3) GDPR); if, exceptionally, we extend this period due to complexity, we will inform you within the first month, stating the reasons.

1. For customers: download it yourself

Under "Settings → Your data" you can download everything we store about your account. This is your right of access under Art. 15 GDPR and at the same time your right to data portability under Art. 20 GDPR – with one click instead of a request.

How it works: You re-enter your password and choose the format – JSON (one file) or CSV (a ZIP with one table per section and the complete JSON file alongside). We require the password because the file contains IP addresses, devices and your support requests; an open session on someone else's computer should not suffice for this. For the same reason, the download is only possible from the form, not via a link. For security reasons, this is possible at most three times per hour. Every export is recorded in your activity log – including in the export itself, so that you can see that it took place.

What is included:

• Your account: name, email address, company and tax details (including the result of the VAT ID verification), language, plan and billing status, time of registration and of the last sign-in with its IP address, whether two-factor sign-in is switched on.
• Your company logo, if uploaded (as an image file in the ZIP).
• Your workspaces with your role. For workspaces you own, additionally the websites: settings, domain verification, configuration of the answer box (including test questions, product and documentation areas, and action and support links), usage in the current month and the daily figures for the last seven days.
• The question analysis of your websites, if switched on, as shown on the "Questions" page: totals, groups of similar questions (masked), content gaps, cited pages, history. Individual questions are not included here either.
• Your devices and sessions, your sign-in attempts, your activities in the account, your page views on answely.com, your support requests.
• Which emails we sent you and when – without the content, because it contains confirmation links, some of which are still valid.
• Your consents to legal texts (document, version, time), your add-on packages, your invoices (number, amounts, period, link) and, where applicable, your withdrawal declarations.

What is not included, and why:

• The index of your websites. These are the public pages of your own website; you already have them.
• Data of other members of your workspaces (names, addresses). That is their data.
• Websites from workspaces of which you are only a member. The owner of a workspace is responsible for it; the owner receives them in their own export.
• Access by our support staff ("view as customer") is included – you should know that it took place – but without the IP address and browser of the support person.
• Password, recovery and sign-in tokens, the two-factor sign-in secret. These fields are never included in an export.
• Payment methods. Card and bank account details are held by Stripe, not by us. You will find your invoices as documents and your payment methods in the Stripe customer portal under "Billing".

If you need something that is not in the export, or information in another form (for example the purposes, recipients and storage periods under Art. 15(1) GDPR in a letter), write to us.

2. For customers: delete it yourself

You can delete four things, each in its own place in the account:

• The question analysis of a website: in the website's "Questions" area with "Delete questions". All collected questions and groups of this website are removed immediately; the website itself remains. You can switch off question analysis in the same place.
• A website: in the website's "Settings" tab. To confirm, you type in the domain. For this you need the role of owner or admin in the workspace.
• A workspace: as owner, in the workspace settings. All its websites are deleted in the process.
• Your account: under "Settings → Delete account", after re-entering your password.

When you delete your account, the following happens, in this order:

• A running subscription is first ended at Stripe, with immediate effect. If this fails, your account remains in place and you receive an error message – otherwise a subscription would continue that could no longer be attributed to any account. We refund the amount paid in advance for the remaining paid period pro rata (clause 9.12 of the Terms of Use).
• Workspaces you own are transferred to another member, if there is one: preferably to the longest-standing admin, otherwise to the longest-standing member. A team's work does not belong to the person who created the workspace. The new owner finds the transfer in their log; their plan limits apply from then on.
• Workspaces without other members are deleted together with all their websites.
• Your account, your memberships, sessions and markers, your add-on packages, your company logo and any emails to your address still stored are removed.
• You receive a deletion confirmation by email in the language of your account. If it was not you, please reply to it.

3. What a deletion actually removes

At Answely, deleting a website means first flagging it for deletion in the answer service, then deleting it there, then in the account. If the answer service is not reachable at that moment, the website nevertheless disappears from your account immediately, and the flag remains in a deletion queue. A background job retries it every five minutes. If a deletion is still pending after 12 hours, this is recorded in the error log for the operator at every further attempt – so that the commitment of within 24 hours has some margin. In addition, a daily job checks whether the answer service still holds websites that the account no longer knows, and deletes them; it stops and reports instead of deleting an unusually large number of websites at once.

The following table shows, per data type, what disappears and when.

Data type	When it disappears
Account, memberships, sessions, markers, add-on packages, company logo	immediately
Settings and configuration of the website, test questions, areas, links	immediately in the account, in the answer service within 24 hours
Index of the website: documents, sections, vectors, index runs, including documents imported via push or WordPress	within 24 hours, as a rule immediately
Earlier or proposed index states (index approval)	together with the index
Question analysis of the website with ratings	together with the index; before that, at any time with "Delete questions"
Monthly quota figures	together with the index
Test reports of the answer tests, success and A/B totals	together with the index
Cached answers (only if "Allow answer cache" is switched on)	expire, after 24 hours at the latest
Counters without content (truncated IP address, no question)	are not deleted early but expire after 7 days
Emails to your address still stored	immediately; the deletion confirmation itself after the outbox retention period
Your page views on answely.com	after the retention period of the page statistics
Entries in the activity log	after the retention period of the audit log
Sign-in attempts with your address	after 7 days
Support requests	remain even after the account has been deleted; deleted 1095 days after the last reply (without a reply, after receipt), together with any AI drafts for them
Invoices	are retained, without link to the account, for 5 years from the end of the calendar year in which they were created (Art. 86 in conjunction with Art. 70 Ordynacja podatkowa); deleted automatically afterwards
Record of your consent to legal texts and withdrawal declarations	are retained; removed once the declaration is 4 years old, i.e. no later than 4 years after deletion
Encrypted off-site copies	until they expire (see below)
Unencrypted daily copy at the server before transfer	no more than 8 days

On the individual time limits: we delete the page statistics after 60 days, the audit log after 365 days, the outbox after 30 days. We delete sign-in attempts after 7 days. The entry recording the account deletion itself remains in the audit log, without link to your account – someone who has left should not retroactively never have existed.

Why some things remain. We are required to retain invoices under Polish tax law (Art. 6(1)(c) GDPR). We need the record of which text, in which version, you agreed to and when in order to defend against or substantiate claims arising from the contract (Art. 17(3)(e), Art. 6(1)(f) GDPR); four years corresponds to the limitation period, rounded up. These records contain no content from your websites. What Stripe stores regarding payments is governed by Stripe's obligations; details are set out in Stripe's privacy policy.

Backups. The database backups on our own server still contain deleted data for up to 30 days and are then deleted.

In addition, every night we store an encrypted copy of all databases and files of our server at Google Cloud Storage in Warsaw. It is encrypted on our server before it leaves it, including file and directory names; only the operator holds the key. For these off-site copies: daily copies 7 days, weekly copies 364 days. Before a daily copy (dumps of all databases on the server and a file copy of /var/www including configuration files) is encrypted and transferred, it is created on a storage device attached to our server in Łódź; there it remains unencrypted for no more than 8 days and is then deleted.

To be candid, this means: what you delete today disappears from live operations immediately or within 24 hours, but may under certain circumstances remain, encrypted, in an off-site weekly copy for up to just under a year. We use these copies for nothing other than restoration after an outage. We do not restore a copy in order to recover deleted data. If we have to restore a copy in an emergency, we delete again any data deleted in the meantime, to the extent they can be identified; for websites, the daily reconciliation does this automatically. There is no separate technical procedure for this for accounts and the question analysis.

4. For visitors to our customers' websites

Where your request goes. For questions you entered into the answer box on a customer's website, the customer who owns the website is the controller. The customer decides whether and what is stored; we process this data only on its instructions (Art. 28 GDPR). Please contact the customer – its contact details are in its privacy notice. If you write to us instead, please name the website; we will forward your request to the customer without undue delay and support it in replying. We will not decide on it, because that decision is not ours to make.

Why there is often nothing to find. Answely does not know who you are. The answer box sets no cookies, creates no visitor identifier and does not ask for a name or email address. This is intentional – and it has a consequence that we would rather tell you here than only after you have written to us: without an identifier, a question asked cannot be attributed to any person. Under Art. 11 GDPR, we are not obliged to collect additional data solely in order to identify you; if you yourself cannot provide information that allows attribution, the rights of access and erasure cannot be exercised on this basis.

What does exist nevertheless:

• Counters without content: time, truncated IP address, website, length of the question, result and duration – never the question or the answer. The entries are deleted after 7 days.
• Question analysis, only if the customer has switched it on: the question, in which email addresses, telephone numbers, account-like digit sequences, links and long numbers are made unrecognisable before storage, the calendar day without time, language, result and, where applicable, your rating – without IP address and without an identifier of your browser. The customer only sees groups of similar questions. Question analysis entries are deleted after 90 days, and the customer can delete them at any time before then.
• Cached answers, only if the customer has switched on "Allow answer cache": under a hash of the question, without reference to you; they expire after 24 hours.
• In your own browser, the answer box keeps, only with "Allow answer cache" switched on, its settings for no more than 5 minutes in the session storage (sessionStorage) of the website visited, and answers for no more than 10 minutes only for websites connected via reactive.chat; for protected knowledge areas, nothing. It belongs to you: if you close the tab, it is deleted.

If you know the exact wording of a question you asked and the website, the customer can look for a matching group in its question analysis and have it deleted; the simplest solution is usually for the customer to delete the entire question analysis of its website. If you wrote information about yourself into a question that should not have been stored, tell the customer exactly that.

Objection. You object to the processing of your questions with the customer. Most effective: do not ask questions containing personal information. On websites that load Answely only after your consent, your browser sends nothing to us without that consent.

5. For individuals named on our customers' websites

So that the answer box can answer, Answely reads the public pages of a customer's website and creates a search index from them. If you are named on such a page – for example as a contact person, author or in an article – this information is also in the index, and an answer may cite it. Answely does not include anything that the website does not show publicly: pages with noindex, pages blocked by robots.txt, exclusion paths and elements with data-answely-ignore are skipped.

Who is responsible. The index is maintained on behalf of the customer; the customer decides what content its website shows and what of it may enter the index. Your claims to erasure or rectification are therefore to be directed to the operator of the website. Once the content has been corrected on the website itself, the index follows.

How information is removed from the index. The customer has several ways of doing this:

• remove the page from the website or change the content there;
• mark the page with noindex or block it in robots.txt;
• mark the relevant section with data-answely-ignore;
• enter an exclusion path for the page in the account;
• delete a document imported via the push interface there; a post that the customer withdraws in WordPress (draft, private, trash or deleted) is removed from the index by the WordPress synchronisation on its next run;
• as a last resort, delete the website in Answely – its entire index is then removed within 24 hours.

The first four ways take effect with the next successful index run: depending on the setting, it runs automatically daily or weekly, and the customer can trigger it immediately at any time. The run removes pages that can no longer be found at its end. If the customer has switched on index approval, the new state only becomes active upon the customer's approval. Answers already cached that cite the information expire after 24 hours at the latest.

We help. If you cannot reach the operator or the operator does not respond, write to us with the address of the page and the information concerned. We will forward your concern to the customer and help it implement it. If content is manifestly illegal, please use Report abuse; we can then also suspend the answer box of that website ourselves.

6. The limits, stated plainly

• No identifier, no attribution. Answely collects so little about visitors that, as a rule, an individual question cannot be attributed to anyone. This is the consequence of data minimisation, not a way of evading your request.
• The truncated IP address is no substitute. It does not single out anyone, and we do not link it with questions; we therefore cannot provide access "by IP address".
• Counters wait out their time limit. They contain no questions and expire after 7 days; they are not deleted individually, not even together with the website.
• Off-site copies last longer. Deleted data may remain, encrypted, in the off-site weekly copies for just under a year. They are not read and not restored, except in an emergency – and then deletion is carried out again.
• The index follows the website, not the other way round. As long as information is publicly shown on the website and not excluded, it will be included again in the next run. The permanent solution lies on the customer's website.
• We cannot reach what the customer has copied itself. Exports, reports and screenshots that a customer has taken from its account are outside Answely.
• Invoices and records of consent are retained for the stated periods – as required by law or for evidential purposes.

7. Complaint

If you are not satisfied with our reply, you may lodge a complaint with a data protection supervisory authority, in particular in the Member State in which you live or work. The authority competent for us is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

Version 1.0 – as of 18.10.2026