Before you use Answely on your website, your legal department will want to know who processes your visitors' data, where, for how long and on what legal basis. The answers are in the following documents. They are public, and none of them requires signing in. Forward this page; the review can begin immediately.
1. The documents
| Document | What it governs |
|---|---|
| Data Processing Agreement | Art. 28 GDPR: subject matter, instructions, confidentiality, sub-processors, notification of breaches, deletion, audits |
| Technical and organisational measures | Art. 32 GDPR: access protection, encryption, separation, backups, deletion, monitoring |
| Sub-processors | Who besides us handles data, for what purpose, where they are located and on what legal basis |
| Record of processing activities | Art. 30 GDPR: every processing operation with purpose, legal basis, recipients and time limit |
| Data protection impact assessment | Art. 35 GDPR: risks of the answer box, mitigations and the points that are still open |
| Privacy Policy | What we process as controller about you as a customer and about visitors to answely.com, and what happens in the answer box |
| Template for your privacy notice | Ready-made paragraphs about the answer box for insertion into your own notice |
| Terms of Use | The contract: plans, quotas, AI labelling, obligations, liability, termination, changes |
| AI Act | Where Answely uses AI, roles under the Regulation, labelling, evidence, metrics and limits |
| Data Act | Switching providers, export, jurisdiction of the infrastructure, interfaces |
| Access and deletion | How customers and visitors exercise their rights |
| Report abuse and illegal content | Point of contact and notice procedure under the Digital Services Act |
| Complaints | How we handle complaints |
| Right of withdrawal | Right of withdrawal for consumers |
| Imprint | Provider information |
Languages. All documents are available in English, German and Polish. For the Terms of Use, the DPA and all other contractual documents, the English version is binding; the German and Polish versions are translations provided for information. This does not apply to consumers: for them, the version in the language in which the contract was concluded is binding (clause 32.10 of the Terms of Use).
2. How the DPA is concluded
There is no form to print, sign and return. The Data Processing Agreement is concluded upon acceptance of the Terms of Use at registration (clauses 3.1 and 4 of the Terms of Use, clause 1 of the DPA). Anyone who needs a signed PDF version for their own records will receive one on request.
Acceptance is recorded in such a way that it can be evidenced later:
- The exact version. We store the wording of each accepted document once, together with a SHA-256 hash of that wording, not just a date. Even years later it can be shown which text applied.
- When and from where. Time, IP address, browser identifier and the language version displayed at acceptance on registration. When consumers request the immediate start before a payment, we likewise record the version of the withdrawal notice displayed and the wording of the tick box, with time, IP address, browser identifier and language version.
- By which route. Registration or, for consumers, the request for the immediate start before each payment.
- Linked to the account. The registration and the record are written in a single step; an account without a record cannot come into existence.
After the account is deleted, the record is removed once the respective acceptance is 4 years old, i.e. no later than 4 years after deletion. As long as the account exists, it is part of the data export in the account.
At registration, we record the versions of the Terms of Use, the DPA and the Privacy Policy; the sentence next to the checkbox names all three documents. This also evidences which wording of the DPA applied. Anyone who joins a workspace by invitation and does not yet have an account registers and consents in the same way; anyone who already has an account consented when registering it.
3. What happens in the event of a change
- Terms of Use and DPA. We change them with at least 30 days' notice and announce the change by email to the account address. If you do not agree to amended Terms of Use, you may object in text form before they take effect. The contract then continues on the previous terms until the end of the current billing period and then ends; on the Free plan it ends when the change takes effect (clause 27 of the Terms of Use, for consumers clause 32.6). For the DPA, clause 14 of the DPA applies. Changes required by law may take effect at shorter notice, changes solely to your benefit without notice.
- Sub-processors. We give at least 30 days' notice of any addition or replacement. You may object on data protection grounds and, if we cannot find a solution, terminate with effect from the date of the change (clause 8.2 of the DPA).
- AI providers. A further AI provider will only be considered if it processes in the EU, does not train and does not store beyond the processing; here too, notice of at least 30 days in advance applies.
- Prices. The charges displayed at the time of the order apply (clause 9.1 of the Terms of Use). We announce an increase for a running subscription at least 30 days in advance by email; it never applies to a period already paid for, and until it takes effect you can cancel with effect from the end of the current period (clause 9.13).
- Versions. Each document states its version and date at the end.
There is no notice in the account that displays a change until it has been acknowledged, and no renewed recording of the acknowledgement as at registration; notification is given by email.
4. Where the data is actually located
Answely runs on own hardware in Łódź, Poland. There is no hosting provider between you and us, and the AI runs exclusively on servers in the EU that we operate ourselves. Only two data flows go to the USA: customers' billing data via Stripe and emails via Namecheap. Questions and answers from the answer box leave the EU in only one case: as masked groups in the knowledge-gap report, if you switch it on.
| What | Where | Who |
|---|---|---|
| Website answely.com, customer account, databases, answer service | own server in Łódź, Poland | LW IT Solutions Company (operator) |
| Language model and embedding model | our own AI, self-hosted on own servers in the same internal network in Łódź; two of them generate the answers | operator; no external AI service |
| Encrypted off-site copies (daily copies 7 days, weekly copies 364 days) | Google Cloud Storage, Warsaw region | Google Ireland Ltd. as sub-processor; keys held only by the operator |
| Unencrypted daily copy (dumps of all databases on the server and a file copy of /var/www including configuration files) before transfer, no more than 8 days | storage device at our own server in Łódź | nobody except the operator |
| Customers' payments and invoices | Ireland, transfer to the USA | Stripe Payments Europe, Ltd.; never visitor data |
| Emails to customers, including the optional knowledge-gap report, and incoming emails to @answely.com | USA, on the basis of the EU standard contractual clauses | Namecheap, Inc. (Namecheap Private Email) as sub-processor |
| Domain answely.com and DNS | USA | Namecheap, Inc. as registrar; domain data only |
| Short-lived answer box data in the browser | visitor's browser (sessionStorage) | no one but the visitor |
Details including safeguards and the status of each agreement are set out in the list of sub-processors. It also states what is still open. A list containing only good news would never have been checked.
5. Your visitors, your responsibility
For the questions that visitors enter into the answer box on your website, you are the controller and we are your processor. For you, this means:
- Information. You mention the answer box in your privacy notice; the template provides the paragraphs.
- Legal basis and consent. You determine the legal basis. If the law applicable to your website requires consent, use the consent mode and deploy the modified embed code with
data-consent="required"; the box then makes no request until consent is given. If you switch the mode on only in the account, the box still retrieves its settings beforehand. - Your content. Answers are generated only from your content. Exclude pages that should not be answered, and import via the push interface only content that may be answered publicly.
- Settings are instructions. Whether answers are cached, whether question analysis runs and which additional features are active is decided by you in the account. For new websites, "Allow answer cache" is switched off.
- Requests from visitors. If requests from your visitors reach us, we forward them to you and support you. Because nothing is stored in the default setting, there is usually nothing that can be attributed to individual visitors.
- AI labelling. The notice that answers are AI-generated cannot be switched off. You must not conceal it.
6. Questions and gaps
If your legal department finds a gap or a contradiction, let us know: support@answely.com. The open points of the impact assessment are stated in the document itself, and this overview is maintained.
Provider: LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82, lok. 301, 90-437 Łódź, Poland.
Version 1.0 – as of 18.10.2026