Data Processing Agreement

This agreement governs how LW IT Solutions Company Lukas Wójcik processes personal data on behalf of its customers by means of the Answely service (Article 28 GDPR). It describes not only obligations but also what the service actually does and where its limits lie. Where something has been prepared but is not yet in operation, this is stated expressly.

1. Parties, conclusion and order of precedence

This agreement is concluded between the customer who holds an account with Answely (the "Controller" or "Customer") and LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82, lok. 301, 90-437 Łódź, Poland, VAT ID PL7252266190 (the "Provider" or "Processor").

It is concluded upon acceptance of the Terms of Use, of which it forms part, and applies to every website that the Customer creates in its account. On request, the Provider will additionally make it available as a signed PDF file. A separate signature is not required for it to be effective; Article 28(9) GDPR permits electronic form.

Insofar as the processing of personal data on behalf of the Customer is concerned, this agreement takes precedence over the Terms of Use and all other arrangements. Annexes 1 to 3 form part of it: the description of the processing, the technical and organisational measures and the list of sub-processors.

2. Definitions

Controller: the Customer, who determines the purposes and means of the processing on its website – in particular whether and how it embeds the answer box and which features it switches on.
Processor: the Provider, who processes the data in accordance with Annex 1 on behalf of and on the instructions of the Customer.
Visitor: a person who accesses a website of the Customer and uses the answer box, or whose browser loads the script answely.js.
Answer box: the box displayed by the script answely.js on the Customer's website, which answers a question with an AI-generated, labelled answer based on the content of that website.
Index: the searchable version of the Customer's content stored by the Provider (pages, sections, vectors calculated from them).
Site: a website created in the account, with its own key, its own settings and its own index.
Personal data processed on behalf of the Customer: all data under Annex 1 that can be attributed to an identified or identifiable natural person.
Sub-processor: any third party engaged by the Provider to process data on behalf of the Customer.

3. Subject matter, roles and scope

3.1 What is done on behalf of the Customer

Answely answers questions that visitors ask on the Customer's website with a short, AI-generated answer that is based solely on supporting sections of the Customer's content and links to its sources. For this purpose, the Provider builds an index of this content, receives questions, searches for matching sections, has a language model formulate an answer from them and delivers it to the visitor's browser.

Nature of the processing: collection, recording, organisation, storage (only to the extent stated in Annex 1), retrieval, use, transmission to the visitor's browser, restriction and erasure. Categories of data subjects: visitors to the Customer's websites and persons named in the Customer's content. The details for each feature are set out in Annex 1.

In the default setting of a new Site, questions and answers are not stored. Any further storage arises only because the Customer switches on a feature; Annex 1 states for each feature whether it stores data and for how long.

3.2 What is not covered by this agreement

The Provider is itself the controller for the following processing operations; they are governed by the Privacy Policy and not by this agreement:

the customer account, the members of a workspace, login, billing, invoices and support,
the answely.com website, including its page statistics and the public website quick check ("Check your website"), which anyone can use without an account,
the answer box in Answely's own developer documentation,
the logs and backups, insofar as they concern data of the customer account.

3.3 Origin of the data

Data reach the Provider by four routes, all of which lead into the same processing:

from the visitor's browser via the embedded script answely.js (questions, language, page addresses, ratings),
by retrieving publicly accessible pages on the domains whose ownership the Customer has verified (index),
through transmissions that the Customer itself triggers: the push interface, the WordPress plugin, test questions, glossary, rules and areas stored in the account,
through public AI clients, if the Customer expressly enables MCP search access.

3.4 AI processing: exclusively on servers in the EU, no training

The language model and the embedding model run exclusively on servers in the EU: on the Provider's own hardware in Łódź, Poland, in the same internal network as the service's server. The machines running the language models are never called by the service; they collect jobs via an encrypted connection signed with a secret and return the results. No third-party AI service is involved in the processing.

For technical reasons, the service starts only if every configured AI endpoint is on an allowlist of servers in the EU. A fallback provider for the language model has been technically prepared but is not in operation; it could only be used under the conditions of section 8.3.

Personal data processed on behalf of the Customer are not used to train or to fine-tune models. There is no route within the service for such training.

3.5 Sites from reactive.chat

Customers of reactive.chat, another service of the same Provider, receive answers of the same kind ("Smart Answers"). For these Sites, the answers come from the reactive.chat knowledge base, and the processing is governed by the contracts that the Customer has concluded with reactive.chat. This agreement applies to them only on a supplementary basis. The privacy policy and the data processing agreement of reactive.chat expressly name these answers ("Smart Answer") as a service of Answely.

4. Instructions

The Provider processes the data only on documented instructions from the Customer, unless required to do so by Union or Member State law to which the Provider is subject; in such a case, the Provider informs the Customer of that legal requirement before processing, unless that law prohibits such information.

The instructions consist of this agreement, the Terms of Use and the settings that the Customer selects in the account. These include, in particular, "Allow answer cache", consent mode, question analysis and its delete button, exclusions from the index, the extensions of each Site, the design of the box and the deletion of Sites and of the account. Each setting takes effect as an instruction from the time at which it is saved.

The Customer gives further instructions in text form to support@answely.com. If the Provider considers an instruction to be unlawful, it informs the Customer without undue delay and may suspend its execution until it is confirmed or amended.

5. Obligations of the Customer

Legal basis: The Customer ensures that the processing on its website has a legal basis, typically its legitimate interest in answering questions or consent.
Information to visitors: The Customer informs visitors in its privacy policy. Suitable template texts for each setting are available under Template text for the privacy policy.
Consent where required: If the law applicable to its website requires consent before access to the terminal equipment, the Customer uses consent mode (data-consent="required"). Answely reads the consent signal; it does not obtain consent itself.
Content: The Customer is responsible for the content from which answers are generated. It excludes from the index any pages containing personal data that not every visitor should learn of (exclusion paths, noindex, data-answely-ignore).
Push and WordPress: Via the push interface and the WordPress plugin, the Customer only submits content that it may have answered publicly, i.e. to any visitor. It warrants this with each transmission.
Protected areas: The Customer may submit non-public content only via protected knowledge areas, once these have been enabled for it (Annex 1, section Q), and only in such a way that it is answered exclusively to authorised users. The Customer is responsible for granting the authorisations.
No special categories: The Customer does not submit special categories of personal data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR) to the index, whether via retrieval or via push, WordPress or uploaded files.
Test questions and settings: Test questions, glossary, rules and live data sources do not contain any personal or confidential information; they are public test cases and configuration.
AI labelling: The Customer does not remove or conceal the notice that an answer is AI-generated (Article 50 of the AI Act (EU) 2024/1689). From the Pro plan upwards, it may adapt the wording, but may not switch off the notice.
Access credentials: The Customer keeps push tokens, keys and access credentials to its account secret and revokes them if they may have fallen into the wrong hands.

6. Obligations of the Provider

Bound by instructions and purpose limitation: The Provider processes the data only for the purposes set out in Annex 1 and not for its own purposes – not for advertising, not for profiling, not for training models.
Confidentiality: Persons who have access to the data are bound by confidentiality. The service is currently operated by the owner himself; other persons will be given access only once they have been bound to confidentiality.
No content in logs: Questions and answers do not appear in any log of the service, of the indexer, of the AI machines or of the web server. They are not read editorially.
Data protection by default: New Sites start without storage of questions and answers, without question analysis and without any of the optional features in Annex 1. The script does not set any cookies and does not generate any visitor identifier.
Assistance: The Provider assists the Customer with requests from data subjects (section 10) and with its obligations under Articles 32 to 36 GDPR. For a data protection impact assessment, it makes its own assessment of the service available (Data Protection Impact Assessment).
Notification: The Provider informs the Customer without undue delay if, in its opinion, an instruction infringes data protection law, and if a supervisory authority approaches it concerning the Customer's data.
Point of contact: Data protection matters arising from this agreement can be addressed to the Provider at support@answely.com.

No data protection officer. No data protection officer has been designated. In the Provider's assessment, none of the cases set out in Article 37(1) GDPR applies: the Provider is a sole proprietorship; Answely's core activity consists of answering individual questions asked by visitors themselves without any visitor identifier, not of regular and systematic monitoring of individuals on a large scale, and it does not consist of processing special categories on a large scale. The assessment, with its reasons, is set out in section 9 of the record of processing activities. If this changes, a designation will be published here and notified to the supervisory authority.

7. Security of processing

The Provider implements technical and organisational measures appropriate to the risk in accordance with Article 32 GDPR. These include, among other things, transport encryption on every public route, answers only for hosts with verified ownership, separate keys and indexes per Site, truncated IP addresses in counters and logs, misuse protection without storage of the IP address, mandatory two-factor authentication for the administration area, signed connections of the AI machines and encrypted storage of off-site copies.

The measures – including those that deliberately do not yet exist – are set out in full and kept up to date in the technical and organisational measures (Annex 2). The Provider may adapt them to the state of the art, provided that the level of protection does not decrease.

8. Sub-processors

8.1 General authorisation and list

The Customer grants the Provider general written authorisation to engage sub-processors. The current list, with purpose, data categories, location and legal basis, is available under Sub-processors (Annex 3).

No third party is involved in answering a question itself: the script sends data exclusively to the Provider's own infrastructure, and the language model runs on the Provider's own hardware. Personal data processed on behalf of the Customer reach third parties in only two cases:

A nightly off-site copy of all databases of the server – and therefore also of the index, question analysis and the Sites' settings – is held by Google Ireland Limited (Google Cloud Storage, Warsaw region). It is encrypted on the Provider's own server before transfer, including the file and directory names; the keys are held only by the Provider. Google cannot read the content but remains a sub-processor – encryption is a safeguard, not a change of role.
Emails from the Provider to the Customer are sent via Namecheap Private Email (Namecheap, Inc., Phoenix, Arizona, USA); emails from the Customer to addresses at @answely.com are also received via the same provider. Personal data processed on behalf of the Customer are contained above all in the monthly knowledge gap report, which the Customer can switch on: it contains groups of masked questions from question analysis and the Customer's company logo. In addition, emails relating to a Site, such as notices concerning quota or domain verification, or support requests into which the Customer itself inserts content, may contain personal data processed on behalf of the Customer. Namecheap is therefore a sub-processor; the basis is its Data Processing Addendum incorporating the EU standard contractual clauses (section 9).

8.2 Notice and objection

The Provider informs the Customer at least 30 days before a new sub-processor begins processing or an existing one is replaced, by email to the account address. Within this period, the Customer may object on legitimate data protection grounds. If the objection cannot be resolved, the Customer may terminate the affected service with effect from the date of the change; amounts already paid for the period thereafter will be refunded on a pro rata basis, as set out in section 14.3 of the Terms of Use.

The Provider imposes on each sub-processor by contract the same data protection obligations as are set out in this agreement and is liable to the Customer for their compliance as for its own acts.

8.3 A further AI provider only under five conditions

A provider for language models or embeddings outside the Provider's own hardware will only be used if all of the following conditions are met:

It processes exclusively in the EU.
It has concluded a data processing agreement with the Provider that excludes training and fine-tuning with the data and does not permit storage beyond the processing of the individual request.
It is on the list of sub-processors.
Customers were informed 30 days in advance in accordance with section 8.2 and were able to object.
Its endpoint is on the technical allowlist of servers in the EU, without which the service does not start.

No such provider is currently in operation. A fallback provider established in France has been prepared; its activation is technically blocked until the contract, location and storage conditions have been clarified.

8.4 Counterparties determined by the Customer itself

Some features connect Answely to systems determined by the Customer itself: its WordPress installation, public data sources for live data, destinations of its action and support links, AI clients that query its public MCP access and – once enabled – its login provider. These counterparties are not sub-processors of the Provider. The connection arises only if the Customer switches on the feature; the contractual relationship with them exists between the Customer and the respective operator. Annex 1 describes which data flow in this context; visitors' data are not sent automatically to any of these counterparties.

9. International transfers

Personal data processed on behalf of the Customer are processed in the EU: on the Provider's own hardware in Poland and, for the encrypted off-site copy, in a storage facility in Warsaw. The AI processing takes place exclusively on servers in the EU (section 3.4); questions and answers from the answer box do not leave the EU in the process.

A transfer to a third country of personal data processed on behalf of the Customer takes place only via the email provider: emails from the Provider to the Customer – above all the knowledge gap report with groups of masked questions, if the Customer switches it on – and emails from the Customer to addresses at @answely.com are sent via Namecheap Private Email (Namecheap, Inc., USA). The basis is Namecheap's Data Processing Addendum incorporating the EU standard contractual clauses (Article 46(2)(c) GDPR), accepted on 01.08.2026. The Customer takes this into account before switching on the knowledge gap report and, where applicable, mentions it in its own privacy policy; without the report, visitors' questions do not leave the EU.

The Customer's billing data, which are sent to a payment service provider with a group company in the USA, relate to the customer account and not to personal data processed on behalf of the Customer (see Privacy Policy).

10. Rights of data subjects

Taking into account the nature of the processing, the Provider assists the Customer in responding to requests under Articles 15 to 22 GDPR. If the Provider receives a request directly from a visitor, it forwards it to the Customer without undue delay and does not respond to it itself unless the Customer instructs it to do so.

One limitation is stated openly: Answely does not assign any identifier to visitors and does not store any complete IP address. In the default setting, therefore, there are no data that can be attributed to an individual visitor. Question analysis also stores questions without an IP address and without an identifier; a question can therefore generally only be found by its wording. Under Article 11 GDPR, the Provider is not required to obtain additional information solely in order to identify a person.

What the Customer can do itself: delete question analysis entries using a button, exclude pages from the index or withdraw them via the push interface, delete a Site or the account, and download all of the account's data as a JSON or CSV file.

11. Personal data breaches

If the Provider becomes aware of a personal data breach affecting the Customer's data, it notifies the Customer without undue delay, and no later than 48 hours after becoming aware of it, at the account's email address. The notification contains, to the extent known, the information required under Article 33(3) GDPR: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken and proposed, and a contact point. Anything not yet known at the time of the first notification is provided by the Provider subsequently as soon as it becomes known.

The Provider documents each breach, including the facts, its effects and the remedial action taken, and provides this documentation to the Customer together with the notification. Notification to the supervisory authority and communication to visitors remain the responsibility of the Customer; the Provider assists it in this.

Reporting address for security incidents: support@answely.com

12. Retention, return and deletion

12.1 Time limits during ongoing operation

The time limits for each feature are set out in Annex 1. They expire automatically and are not triggered manually. Each time limit is stored in the code and verified by tests with a clock set forward.

12.2 Deletion of a Site or of the account, end of the contract

If the Customer deletes a Site or its account, processing ends immediately: the box no longer answers for that Site. The Provider removes the index, question analysis, test reports, index copies and all other data of that Site from the live system within 24 hours. A queue catches up on deletions that the service cannot accept immediately and writes an error to the Provider's log after 12 hours.

Beforehand, the Customer can download its data itself in the account (JSON or CSV). The Provider is not obliged to return the data in any other form; the content of the index originates from the Customer's website in any case. Upon termination of the contract, the same applies as for the deletion of the account. Longer retention takes place only insofar as required by Union law or Polish law; this is currently not the case for personal data processed on behalf of the Customer.

12.3 Backups, with figures

Data deleted from the live system remain in backup copies until these expire. This is stated here rather than glossed over, because it is the longest time for which a deleted record can survive anywhere:

The Provider's own backups on the server: 30 days, rolling.
Unencrypted full copy (dumps of all databases on the server and a file copy of /var/www including configuration files) on a USB drive at the server in Łódź, from which the off-site copy is made: at most 8 days.
Off-site, encrypted copies with Google Cloud Storage in Warsaw: daily copies 7 days, weekly copies 364 days.

Deleted data may therefore be contained in the off-site copies for up to 364 days after deletion – encrypted, with keys held only by the Provider. Targeted deletion within a copy does not take place: a copy is a sealed image of a point in time, and opening, altering and resealing it would deprive it of this property.

Backup copies serve exclusively for restoration after a loss. They are not searched, not analysed and not disclosed. If a copy is restored, the Provider deletes again the data that were deleted after the date of the copy, to the extent they can be identified. For Sites, this is done by the daily reconciliation of the account app, which deletes Sites in the service that the account no longer knows; there is no separate technical procedure for this for accounts and the question analysis. A restore takes place only following a loss; if it occurs, the Provider informs the Customers concerned.

13. Evidence and audits

The Provider makes available to the Customer all information necessary to demonstrate compliance with the obligations under Article 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Customer or by an auditor mandated by the Customer who is bound by confidentiality.

Evidence is provided primarily by this agreement, the technical and organisational measures, the list of sub-processors, the data protection impact assessment and written answers to reasonable questions. The Customer may require an on-site audit if these documents are insufficient, if a supervisory authority requires it or if a breach under section 11 has affected its data. It gives at least 30 days' notice of the audit in text form; in the event of a breach, a reasonably shorter period is sufficient. One on-site audit without cause per calendar year is free of charge; an audit due to a breach is always free of charge. Beyond that, the Customer bears the costs insofar as they exceed the usual scope.

In the case of an on-site audit, it should be noted that the service runs on the Provider's own hardware at a non-public location at which other services of the same Provider are also operated. The Provider may require the audit to be carried out in such a way that data of other customers and other services are not disclosed.

External penetration tests are not currently commissioned, and there are no certifications. This is stated here expressly so that silence is not read as meaning the opposite. Mandatory audit rights under Article 28(3)(h) GDPR and the powers of the supervisory authorities remain unaffected.

14. Term, amendments, governing law and language version

Term: This agreement applies for as long as the Provider processes data on behalf of the Customer, including the period until the backup copies expire in accordance with section 12.3.
Amendments: The Provider gives at least 30 days' notice of amendments to this agreement by email; section 8.2 applies accordingly. Amendments that only increase the level of protection or only add factual information take effect upon their publication.
Governing law and jurisdiction: This agreement is governed by Polish law, including the GDPR. The place of jurisdiction for merchants is Łódź; mandatory provisions in favour of consumers remain unaffected.
Severability: If any provision is invalid, the remainder remains effective; the invalid provision is replaced by the statutory provision, in particular Article 28(3) GDPR.
Language version: This English version is the binding version in the event of discrepancies between the language versions; the German and Polish versions are translations provided for information.

Annex 1 – Description of the processing

1.1 Common to all features

Controller: the Customer to whom the Site belongs.
Data subjects: visitors to the Customer's websites; persons named in the Customer's content; in the case of protected areas, the Customer's authorised users.
Location: servers in the EU – the Provider's own hardware in Łódź, Poland; off-site encrypted copy in Warsaw, Poland. Exception: emails to the Customer, in particular the knowledge gap report, via Namecheap Private Email in the USA (section 9).
Special categories: not intended. If a visitor enters such data in a question, they are processed only to answer it and are not stored when "Allow answer cache" is switched off. Under section 5, they must not enter the index.
Duration: for the term of the contract, with the time limits stated for each feature; thereafter deletion in accordance with section 12.
Default: All features from section B onwards can be switched on per Site and are switched off for new Sites, unless stated otherwise.

A. Answer box (core feature)

Subject matter: answering a question that a visitor enters in the search or the box on the Customer's website.
Nature: receipt of the question, matching against the index, formulation of the answer by the language model, delivery to the browser with source links; counting without content; misuse protection.
Purpose: visitors receive a supported answer from the Customer's content. If there is no supporting source, the box says so instead of guessing.
Types of data: question (no more than 300 characters), language, address of the current page and of the referring page without parameters and anchors, IP address (only as a hash for misuse protection and in truncated form in counters and logs), technical details of the request.
Stored when "Allow answer cache" is switched off (default): question and answer not at all; they are held only in working memory during processing and on the encrypted route to the AI machines.
Stored when "Allow answer cache" is switched on: the answer, including its sources, under a hash of the question; the cache holds it for 24 hours.
In the visitor's browser: no cookies; only when "Allow answer cache" is switched on, the box's settings in sessionStorage for 5 minutes. The box keeps answers in the browser only for Sites from reactive.chat (section R), there for 10 minutes.
Counters without content: time, truncated IP address, Site identifier, length of the question, result, duration; the counters are deleted after 7 days.
Misuse protection: a hash of the IP address and a random value that changes daily, which lives for no more than 2 minutes.
Daily salt: the random value itself lives for no more than 2 days.
Web server access log: truncated IP address, time, path without parameters, status, size, duration, host – without question and answer; it is deleted after 7 days.
Monthly figures per Site: number of answers per month without any personal reference, for quota and billing; retained for 400 days.
AI labelling: every answer is visibly labelled as AI-generated (Article 50 AI Act); the notice cannot be switched off.

B. Consent mode

Subject matter and purpose: the Customer can set the box to operate only after the visitor has given consent (data-consent="required").
Nature: the script reads the signal of the Customer's consent management tool in the browser (consented.eu and TCF, among others, are recognised). If data-consent="required" is in the embed code, it does not send any request to Answely before consent is given, not even for the box settings. If the mode is switched on only in the account, the box first loads its settings and only holds back the question.
Types of data: none in addition; Answely does not send anything to the provider of the consent management tool.

C. Index by retrieval of public pages

Subject matter: building and maintaining the index from the public pages of the domains whose ownership the Customer has verified.
Nature: retrieval via GET without cookies or access credentials, respecting robots.txt and noindex; splitting into sections; calculating vectors on the Provider's own AI machines; storage. PDF files are read; if they contain no text, optical character recognition extracts it locally on the server, without any third-party service, in a private temporary folder that is deleted afterwards.
Purpose: the basis of every answer.
Types of data: content of the public pages, including the persons named there (for example contact persons), sections, vectors, addresses.
Data subjects: persons named in the Customer's content.
Duration: until the page is removed or excluded or the Site is deleted; after deletion of the Site, within 24 hours.

D. Push interface (from the Pro plan)

Subject matter: the Customer transmits content from its systems directly to the index instead of having it retrieved.
Nature: acceptance via a token per Site, which is stored by the Provider only as a hash; only for addresses on hosts with verified ownership; further processing as in section C.
Purpose and instruction: keeping the index up to date. The Customer only submits content that it may have answered publicly, and no special categories (section 5).
Types of data and duration: as in section C.

E. WordPress plugin synchronisation

Subject matter: the Answely plugin in the Customer's WordPress installation reports published content, changes, changed permalinks and withdrawals via the push interface.
Nature: express opt-in in the plugin; only published, publicly visible content; no execution of shortcodes. The push token is held only in the Customer's wp-config.php, never in the database, the user interface or the browser.
Types of data: public content and the technical server request of the WordPress installation; no data of visitors to the WordPress site.
Note: the Customer clarifies special cases such as members' areas or noindex before switching on the feature. Before being uninstalled, the plugin processes its pending deletion jobs so that withdrawn content also leaves the index.
Duration: as in section C.

F. Question analysis, ratings and knowledge gap report (from the Pro plan)

Subject matter: the Customer sees which questions are asked on its website and which remain without a supported answer.
Prerequisite: opt-in by the Customer for the Site, Pro plan or higher, "Allow answer cache" switched on.
Nature: an entry is stored for each answer; email addresses, telephone numbers, IBAN-like sequences of digits, links and long numbers are masked before storage; similar questions are grouped at night using the embedding model on the Provider's own AI machines, with the vectors for this held only in working memory.
Types of data: masked question, calendar day without time of day, language, result, addresses of the pages cited, duration and – if the visitor selects "helpful" or "not helpful" – their rating together with a random identifier of the answer. Not stored: IP address, browser identifiers, answer text, address of the page on which the question was asked.
Output: the Customer sees only groups comprising at least two questions, never individual questions.
Duration: question analysis entries are deleted after 90 days, checked hourly; immediately together with the Site or at the push of a button by the Customer.
Knowledge gap report: on a separate opt-in per Site, the owner of the workspace receives no more than one email per month containing the same groups as in the account, with an unsubscribe link. It is sent via the Provider's email provider, Namecheap Private Email in the USA (sections 8.1 and 9); the masked group texts therefore leave the EU. The outbox holds the email for retries.
Limitation: the masking recognises patterns, not meaning. Names, diagnoses or addresses written out in words remain legible. The Customer therefore switches on question analysis only if its visitors have been informed about it.

G. Product and documentation areas, action and support links

Subject matter: up to ten areas to which the Customer can restrict the search; action and support links offered by the box.
Nature: the identifier of the selected area is sent with the question. Links open only when clicked; Answely appends neither the question nor the conversation history to their address. If no answer is found, the visitor can copy the question, conversation history and sources in their browser and hand them over to support themselves; nothing is transmitted to Answely in the process.
Limitation: areas are not an access control for confidential content.
Duration: areas and links remain as settings until the Site is changed or deleted.

H. Answer tests

Subject matter: up to ten test questions with expected keywords, sources and refusals, stored by the Customer.
Nature: after changes to the index or the configuration, or at the Customer's request, the test questions are answered and evaluated; the test answers are not stored permanently.
Types of data: the test questions as settings; reports with case numbers, results, run times, index version and checksums, without question and answer texts.
Duration: test questions until the Site is changed or deleted; the current report and one predecessor for no more than 30 days from the last test run, immediately upon deletion of the Site.

I. Public MCP search access

Subject matter: public AI clients can search the Site's enabled index.
Nature: pure text search without a language model; no actions, no uploads. Requests are limited by the existing misuse protection.
Types of data: the client's search query and excerpts from the public index. Search queries are stored neither in question analysis nor in the cache; the web server access log applies as in section A.
Limitation: the access is public. It is not available while protected areas are switched on. What the AI client does with the excerpts is the responsibility of the operator of the client.

J. Targeted follow-up questions, rule advisor, source preview and deep search

Subject matter: features with which the box asks follow-up questions, gives a recommendation based on the Customer's rules, shows its sources or searches in greater depth.
Nature: follow-up questions and rules are the Customer's configuration; the visitor's selection lives only in the working memory of the box and of the current request. The source preview shows the sections actually used, with the time at which they were retrieved. At the visitor's express request, deep search adds no more than eight excerpts from the same Site.
Types of data and duration: as in section A; no visitor profile and no additional storage is created.

K. Index release with candidate and previous index

Subject matter: a new index is published only once it passes the answer tests; the previous state is retained for a rollback.
Nature and types of data: up to two further copies of the Site's public pages, sections and vectors. Deletions and withdrawals are applied to both copies. Technical release reports without questions and answers are held in Redis for no more than 30 days.
Duration: the candidate until the next run; the previous state until the next successful release or until the Site is deleted – it has no time limit of its own.

L. Documentation copilot

Subject matter: a draft for a missing documentation page, based on existing sections and an editorial question from the Customer.
Nature: the draft is generated in the response to the account and lives only in the Customer's browser; the Provider does not store it and does not publish anything.
Types of data: public sections of the index, the Customer's question.

M. Live API data

Subject matter: the box displays a current value (for example availability or opening hours) from a public data source of the Customer.
Nature: the Provider's server retrieves no more than two fixed, configured public HTTPS JSON endpoints on hosts with verified ownership, with no more than 2 seconds and 64 KiB per request, without access credentials and without parameters.
Types of data: the endpoint sees only the server's technical request; the question, IP address or identifier of the visitor are not passed on. The value is sent to the box together with the retrieval time and is not cached.

N. Success and A/B comparison

Subject matter: the Customer sees whether answers are reported as "solved" or "not solved" and whether its own goals are achieved; optionally comparing two presentations.
Prerequisite: opt-in by the Customer; in consent mode, the same rules apply as for the box; withdrawal of consent prevents further reports.
Nature and types of data: a random identifier of the answer, comparison group, Site, expiry time and a checksum of the configuration in a signed token, which is valid for no more than 24 hours and is held in the browser only in working memory. No questions, answers, page addresses, cookies or profiles.
Duration: identifiers for excluding duplicate reports and daily totals for no more than 30 days in Redis; the report in the account shows only totals per group.

O. Answer diagnosis and answer comparison

Subject matter: the Customer can have it shown how an answer to its own question is generated, or compare answers from the active index and a new index.
Nature: private jobs in the account; results only in working memory, for no more than 15 minutes after completion, without storage in a database, Redis or logs. Deleting the Site terminates running jobs.
Types of data: the Customer's questions, sections of the index, generated answers.

P. Search glossary, validity and priority of sources, agency templates

Subject matter: synonyms per language, validity periods and precedence for sources, templates for design and answer behaviour within a workspace.
Types of data: purely the Customer's configuration; templates do not carry over any rights, tokens or connections.
Duration: until the Site is changed or deleted.

Q. Protected knowledge areas (prepared for later release)

Status: technically prepared; at present, no login provider is connected and no protected area is in operation. This Annex will be supplemented before release.
Subject matter: answers from non-public content only for users authorised by the Customer.
Nature: the Customer's website passes on an access token from its login provider. The service verifies the signature, validity period, issuer, audience and groups locally using fixed, configured public keys, without contacting the provider. The information in the token is not stored and is not passed to the language model; the model receives only the permitted sections and the question. Answers from protected areas are cached neither in the cache nor in the browser.
Instruction: the Customer submits non-public content only via protected areas and grants the authorisations itself (section 5). Content that has once been protected cannot be made public again.
Types of data and duration: the protected content as in section C; the index time limits apply.

R. Sites from reactive.chat

Subject matter: answers of the same kind for reactive.chat customers, from their knowledge base.
Nature and types of data: question and language; for the handover to the chat, additionally the visitor's address and the identifier already assigned by the reactive.chat chat widget. If "Allow answer cache" is off, a signed history of question, answer and up to three sources is added, valid for 24 hours and held only in the visitor's browser; only when the visitor sends a follow-up question in the chat is it passed to reactive.chat and stored there as the beginning of the conversation; if the visitor has deleted their data at reactive.chat or the history can no longer be used, the follow-up question starts a new conversation without this history. If "Allow answer cache" is on, there is no signed history: reactive.chat already keeps the search question and answer as a conversation under its rules, and the follow-up question continues it. Only what the settings in reactive.chat provide for is stored.
Basis: the contracts with reactive.chat (section 3.5).

Overview of time limits

Questions and answers in the default setting: no storage.
Answer cache (only with "Allow answer cache"): 24 hours.
Browser (only with "Allow answer cache"): settings 5 minutes; answers only for Sites from reactive.chat, 10 minutes.
Counters without content: 7 days.
Misuse protection: hash 2 minutes.
Web server access log: 7 days.
Monthly figures per Site: 400 days.
Question analysis: 90 days; in the report only groups comprising at least two questions.
Test reports and release reports: no more than 30 days.
Success and A/B: daily totals no more than 30 days, tokens no more than 24 hours.
Answer diagnosis: no more than 15 minutes after completion, only in working memory.
Index, copies and settings: until the Site is deleted, then within 24 hours.
The Provider's own backups on the server: 30 days.
Unencrypted full copy on the USB drive at the server: at most 8 days.
Off-site encrypted copies: daily copies 7 days, weekly copies 364 days.

Annex 2 – Technical and organisational measures

See Technical and Organisational Measures. They form part of this agreement in their respective published version.

Annex 3 – Sub-processors

See Sub-processors. Changes to this list are governed by section 8.2.

Version 1.0 – as of 18.10.2026

How can we help?