Privacy Policy

1. What this is about

Answely adds a short, AI-generated answer to the search on websites, with links to the pages on which it is based. This policy describes which personal data are processed in this context and around the service, for what purposes, on what legal basis, for how long, who other than us gets to see them and what rights you have. It also describes what we do not do and where the limits of what we can promise lie.

1.1 Controller

• LW IT Solutions Company Lukas Wójcik
• al. Tadeusza Kościuszki 80/82, lok. 301
• 90-437 Łódź, Poland
• VAT ID PL7252266190, registered in the Polish business register CEIDG
• Email for data protection enquiries and support: support@answely.com

Answely is a service of LW IT Solutions Company Lukas Wójcik ("we", "us"), a sole proprietorship under Polish law. The same legal entity also operates reactive.chat, MousePlayer, consented.eu and Stats4U; where these services play a part in Answely, this is stated expressly below.

1.2 Two roles, three parts

We process data in two different roles – as controller and as processor. This policy deliberately keeps them apart and is divided into three parts for this purpose:

Part	What	Our role	Your point of contact
A	the website answely.com including the quick check, developer documentation and support form	controller	us
B	the customer account: registration, websites, index, workspaces, billing	controller (for the content of customer websites in the index: processor)	us
C	the answer box on our customers' websites	processor under Art. 28 GDPR	the customer on whose website you ask

If you ask a question in an Answely answer box on a company's website, that company is the controller. There, we act on its instructions and on the basis of a data processing agreement (DPA). Part C nevertheless explains exactly what happens technically, because you should know, regardless of who is legally responsible.

1.3 Principles that apply throughout

• Our own hardware. Answely does not run with a hosting provider but on servers that we operate ourselves in Łódź, Poland (section 2).
• AI only with us and only in the EU. Answely's AI processing – language model, embedding and re-ranking of results – runs exclusively on servers in the European Union, currently exclusively on our own AI computers in Łódź. No external AI service sees questions, answers or the content of customer websites.
• No training. Neither the content of our customers' websites nor questions nor answers are used for the training or fine-tuning of models. There is no path for this in the code.
• No advertising, no sale. We do not sell, rent or exchange data, do not create advertising profiles and do not embed any third-party advertising or analytics services on answely.com.

2. Where Answely runs

2.1 Our own servers in Łódź

The web server, account application, answer service, databases and cache run on our own server in Łódź behind our own router. The language model and the embedding model are our own AI, self-hosted on our own hardware: they run on our own servers in the same internal network at the same location, which we also use for other services of our own; Answely passes them text only. Answers are generated by two of these computers; if one is busy or fails, the other takes over. A further computer of our own does not formulate answers but handles background work such as the embeddings during index runs and the nightly grouping. The AI computers are never called by the server: they collect jobs via a signed connection and return the result. They have no access point reachable from outside. A model for re-ranking results has been prepared but is currently switched off.

Because we operate the hardware ourselves, there is no hosting provider acting as a sub-processor for operations. We also state the downside: the databases and cache on the server are currently not encrypted at rest. They are protected by the physical security of the site, access restrictions and the measures set out in the technical and organisational measures.

2.2 Databases and network

Answely uses two databases (account application and answer service) and a cache with its own access credentials and separate areas for each environment. The database and cache are reachable only from the server itself. Every connection to answely.com, api.answely.com and cdn.answely.com is encrypted with TLS; the certificates are issued by Let's Encrypt, which learns only the domain names for this purpose.

2.3 Off-site backup copy

Every night, a copy of all databases on the server and of the application files (which also include the company logos from Part B) is encrypted on our own server – including the file and directory names – and then transferred to a non-public storage area at Google Cloud Storage in Warsaw (region europe-central2). Only the operator holds the key; Google does not receive it and sees only encrypted blocks. What this means for the erasure of your data is set out openly in section 9.

3. Part A – The website answely.com

3.1 Web server access log

For every request to answely.com, api.answely.com and cdn.answely.com, our web server logs one line: the truncated IP address (IPv4 without the last octet, IPv6 truncated to the first 48 bits), the time, the method and path of the request without parameters, the status code, the size and duration of the response and the host requested. Browser, operating system and referring page are not included, nor are questions and answers from the answer box. The logs are deleted after 7 days. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and uninterrupted operation of the service, in particular the detection of attacks and errors.

3.2 Page statistics without cookies

For our own page statistics, the application stores for each page view: the truncated IP address (IPv4 without the last octet, IPv6 truncated to the first 48 bits), the country derived from the address before truncation, the address visited including any parameters, the referring page, the browser identifier (user agent) and the browser, device type and operating system derived from it, and the language, and, for logged-in customers, the account number. We determine the country using a database file on our own server, not via an external service. The full IP address is not stored and is not displayed in the administration area. No cookies are set and no third-party services are embedded for the page statistics. The entries are deleted after 60 days. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is understanding which pages are used and detecting misuse.

3.3 Cookies, browser storage and consent banner

answely.com itself sets only strictly necessary cookies:

Name	Purpose	Duration	Legal basis
bpid	keeps you logged in, protects forms against forgery (CSRF) and links a quick check result (3.4) to your browser	until the browser is closed or until logout	strictly necessary
bp_remember	only if you choose "Keep me signed in" when logging in: recognition of your login, for no more than 30 days	no more than 30 days	strictly necessary, at your request
consented	stores your decision in the consent banner	12 months	strictly necessary in order to respect your decision

We do not need consent for strictly necessary storage on your device (Art. 5(3) of the ePrivacy Directive, implemented in Poland in telecommunications law and in Germany in Section 25(2) TDDDG). We base the associated processing on Art. 6(1)(b) GDPR (account) or Art. 6(1)(f) GDPR (security, respecting your decision). The formconfirmed form protection (3.7) sets no cookies and stores nothing in your browser.

Consent banner. A consent banner from consented.eu is loaded on answely.com. consented.eu is a service of the same legal entity and runs on the same infrastructure in Łódź; no third party is involved. For this purpose, your browser establishes a connection to consented.eu, during which, as with any request, your IP address and browser information are transmitted. Your decision is stored in your browser as the cookie consented for 12 months and, as evidence, logged at consented.eu with a random consent identifier, the selection made, the banner version, the time, a hash of the IP address, language, country and region, browser family, whether a mobile device was used, the domain, a hash of the page address and the time taken to decide. These records are deleted after the period of 36 months set at consented.eu. To check the domain, the banner briefly sets a probe cookie __ce_probe and deletes it again immediately. You can change your decision at any time via the "Cookie settings" link in the page footer.

What the banner enables on answely.com: answely.com currently loads no services requiring consent – no analytics, advertising or social media scripts. The banner is there so that such a service, should one ever be added, is loaded only after your consent; it would then be named here. At present the banner lists only the consent service itself, as strictly necessary.

3.4 Public website quick check ("Check your website")

Under "Check your website" you can test, without an account, how well Answely would work with a website. At your express request, the quick check retrieves no more than three publicly accessible HTML pages of the HTTPS website entered, plus its robots.txt and, where available, sitemap.xml. It respects robots.txt and noindex; areas behind a login, internal networks and addresses containing access credentials are excluded. If you enter a sample question, our own language model in the EU answers it from this sample. The sample, the question and the answer are not stored permanently as an index, question analysis or answer cache; they exist only in the working memory of the answer service. It keeps the result (checked addresses, sample answer and sources) available for no more than 2 minutes after completion so that your browser can collect it; only the browser session that started the check can retrieve it (via a random value in your session, cookie bpid, from which an HMAC identifier is derived). To limit repeated checks, the application uses an HMAC identifier derived from the IP address that is not disclosed publicly; the rate-limiting data live for no more than 2 minutes. The access logs and page statistics described in 3.1 and 3.2 remain in place.

The website checked learns from the requests that our server has read its pages, but not who gave the instruction. Enter only addresses whose checking you can take responsibility for, and do not enter any personal or confidential information in the sample question. The legal basis is Art. 6(1)(b) GDPR (performance of your request) or Art. 6(1)(f) GDPR (protection against misuse). Submitting the quick check is additionally checked by the formconfirmed form protection (3.7).

3.5 Live demo in the developer documentation

In the developer documentation under /docs you can try out Answely on a public demonstration source of our own. There, we ourselves are the controller, but technically exactly what Part C describes happens: the question goes to the answer service, is answered with our own language model in the EU and is not stored. The demo website is configured so that "Allow answer cache" and question analysis are switched off. Only the content-free counters, the short-lived hash for protection against misuse and the access log remain, with their retention periods as set out in Part C. The legal basis is Art. 6(1)(f) GDPR (demonstration of the service at your request).

The same applies to the search at the top of the navigation on answely.com: there, Answely itself answers your questions about Answely from the pages of answely.com, with the same settings. Your question is not stored, "Allow answer cache" and question analysis are switched off, and the box stores nothing in your browser.

3.6 Support form

If you write to us using the support form – with or without an account – we store your email address, the reason you selected, your message, the page from which you wrote, the interface language, for logged-in customers the account number, as well as your IP address, the country derived from it and the browser identifier. The full IP address serves to detect and limit mass or abusive submissions; the form accepts only a limited number of messages per hour from each address. When a new enquiry arrives, the operator receives a signal via Telegram consisting of a fixed sentence without any information from your message. In addition, the formconfirmed form protection checks the submission (3.7).

We retain support enquiries for as long as is necessary for handling them and for evidencing what was asked and answered. We delete a support enquiry 1095 days after the last reply to it, or, if it has not been answered, 1095 days after it was received; any AI drafts for it are deleted with it. This period is based on the three-year limitation period for claims connected with business activity (Art. 118 of the Polish Civil Code). An AI aid for translation and for draft replies has been prepared for the support inbox, which would likewise run on our own AI computers; it is currently not switched on. The legal basis is Art. 6(1)(b) GDPR insofar as you are or wish to become a customer, otherwise Art. 6(1)(f) GDPR (answering your enquiry, protecting the channel).

3.7 Form protection without a captcha (formconfirmed)

The forms for signing in, registration, "Forgot password?" and "Choose a new password", the support form (3.6) and the quick check (3.4) are additionally protected against automated submissions by formconfirmed. formconfirmed is a product of formexposed and belongs to the same legal entity as Answely; it runs on the same servers of our own in Łódź (Poland, EU). No third party is involved.

The script for it comes from formconfirmed.com. It is loaded only on pages that contain one of these forms, and for the support form only when you open it. It fetches a signed task that is bound to the purpose of the form (for example "sign-in") and that your browser solves in the background (a proof of work) and places the result in the form as a single-use check token. The token contains the task, the result of the calculation, the points in time from which the time taken to fill in the form follows, and whether a field invisible to people (a trap for programs) was filled in, and simple browser signals: whether the browser reports that it is automated (webdriver) and whether there was real input such as key presses, mouse movements or touches – without their content. When fetching it, your browser transmits to formconfirmed.com, as with every request, your IP address, your browser identifier and the address of the page. In addition, simple figures on typing and pointing are included (number of key presses, average interval and regularity of keystrokes, whether something was pasted, number of pointer movements) and the number of indications of a remotely controlled browser – no keys, no content, no timeline. From the browser identifier and the headers of the request, formconfirmed also recognises whether the task was fetched by a program instead of a browser.

When you submit the form, answely.com presents the token together with your IP address and the content of the invisible trap field to formconfirmed for checking and, for registration, "Forgot password?" and the support form, your email address (not when signing in), for registration your first and last name, and for the support form the text of your message; never your password or any other details. formconfirmed checks the name in memory only for whether it looks like a random string of characters, and does not store it. For the email address, formconfirmed checks whether its domain belongs to a provider of throwaway addresses and whether it can receive email (a DNS lookup of the MX record); the message text is checked by a spam pre-filter (for example for collections of links and typical spam phrases), where needed supplemented by a language model on our own AI computers in the EU that is meant to recognise advertising, link lists or phishing; the text is neither stored nor used for training, and the result feeds into the assessment ("flag" or "block") as a recommendation. The address itself is never stored in plain text; only the result for its domain is kept in a cache for at most 7 days. The text itself is checked in memory only and is not stored (for campaign detection see below). For the assessment, formconfirmed also considers whether the request comes from a known data-centre network, whether the task and the submission come from the same network (the task is bound to the truncated address range from which it was fetched) and what reputation this address range has across several websites protected by formconfirmed. For this, formconfirmed forms a hash of the truncated address range (IPv4 without the last octet, IPv6 only the first 48 bits) with a key that changes daily (a pseudonym); the IP address itself is not stored. It keeps this hash with the check result for at most one hour, with the used token for about eleven minutes and in the counter of fetched tasks for about one hour; the check results themselves (result, score, reasons, domain) are kept without the hash for 30 days. As with every request, the web server log of formconfirmed.com records the full IP address and the browser identifier for 14 days. The form protection sets no cookies, stores nothing in your browser and does not create a fingerprint of your device. Whether the IP address is on the public Spamhaus DROP list of criminal networks is checked locally by formconfirmed; nothing is transmitted to Spamhaus.

Campaign detection: To recognise spam waves sent to many websites, formconfirmed forms fingerprints (hashes with a secret key) from the text of your message, your email address and the domains of links in it, which cannot be turned back into the original, and compares them for 30 days across all websites that use formconfirmed. The text, the address and the IP address themselves are not part of this; very short texts do not get a text fingerprint. If the same or an almost identical message, the same address or the same link domain arrives frequently on other websites or has been reported there as spam, the result can be "flag" or "block". The operator of formconfirmed is itself responsible for this cross-website comparison – the same legal entity as Answely. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is the joint defence against spam across many websites. You can object to this on grounds relating to your particular situation (Art. 21 GDPR), for example at support@answely.com.

If the result is "block", the submission is rejected. If it is "flag" – for example because the request comes from a data centre or an automated browser, the email address belongs to a throwaway provider or the form was submitted unusually quickly – it is not accepted straight away in these forms: a button appears in the form with which you confirm that you are sending it yourself. Only after this click does your browser fetch a somewhat more demanding task, and the submission is checked again; it is accepted only if the result is then "allow", otherwise it is rejected. You can try again or write to us at support@answely.com. If formconfirmed cannot be reached, your browser reports that it cannot reach formconfirmed, or the token cannot be clearly confirmed, the submission is not silently accepted. In the event of such a disruption we ask you to submit the form once more; only then does Google reCAPTCHA check it instead (3.8). If this check is not passed with high confidence either, the submission is rejected; you can try again later or write to us at support@answely.com. A rejected or flagged submission is recorded in the error log of Answely (4.2) without the token and without the IP address.

Independently of formconfirmed, Answely itself limits how many reset links are sent to one address via the "Forgot password?" form (at most 3 per hour and 10 per day); counting uses a pseudonymous key (HMAC) without the address in plain text, which is deleted when the time window ends. So that a form submitted twice does not trigger a second link, Answely stores a receipt for each submission: a hash of the form purpose, a session attribute, a random operation number and the email address, together with the state and the time; the address itself is not contained in it. Receipts are deleted after 7 days. For a confirmed token, Answely also notes the identifier of the check assigned by formconfirmed and – if an email is then created – its link to that email. From this, formconfirmed can be told, with a signature, whether the accepted operation was carried out (accepted, email queued, accepted by the mail server, failed) – only identifier and state, no address and no content. This state information is deleted after 30 days. For an accepted registration or support request, Answely also keeps the identifier of the check for 30 days. If you confirm your email address or we answer your request, we report "not spam" to formconfirmed under this identifier; if we delete a request as spam, we report "spam" – without address, name or content. formconfirmed uses this feedback to improve the assessment for our forms.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting accounts, the support channel and the quick check against automated submissions. In the browser, the form protection only processes what is strictly necessary to submit the form you are using (Art. 5(3) of the ePrivacy Directive, in Germany § 25(2) no. 2 TDDDG); it is therefore not controlled via the consent banner (3.3). There is no transfer to a third country.

3.8 Fallback check during a disruption of the form protection (Google reCAPTCHA)

Only if formconfirmed is disrupted (3.7) does Answely use Google reCAPTCHA v3, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for the next submission of that one form. In normal operation reCAPTCHA is neither loaded nor is Google contacted.

During a disruption your browser loads a script from www.google.com or www.gstatic.com. reCAPTCHA evaluates your IP address, information about your browser and device, the page visited and your behaviour on the page, and may use cookies or similar technologies for this. Answely only receives a score between 0 and 1 from Google and accepts the submission only with a high score (at least 0.7). The result is recorded in the error log of Answely (4.2) without the token and without the IP address. Google also processes the data for its own purposes under its own terms and is responsible for this itself; Google may transfer data to Google LLC in the USA (8). Google privacy policy: https://policies.google.com/privacy, terms: https://policies.google.com/terms.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to protect sign-in, registration, the password forms, the support form and the quick check against automated submissions even while our own form protection is disrupted, instead of blocking them for everyone. Access to your device serves solely to submit the form you are using (Art. 5(3) of the ePrivacy Directive; in Germany § 25(2) no. 2 TDDDG).

4. Part B – The customer account

4.1 Registration and account

For the account we process your email address, first name and last name, whether you are booking as a business or as a private individual, your country, for businesses the company name and address, VAT ID (if provided) and, if you wish, a company logo, your language and settings, and your password exclusively as a hash. Upon registration, we record which version of the Terms of Use including the Data Processing Agreement and of this policy you agreed to (time, IP address, browser). The legal basis is Art. 6(1)(b) GDPR (contract) and, for the record of consent, Art. 6(1)(c) and (f) GDPR. The registration form is additionally checked by the formconfirmed form protection (3.7).

An uploaded company logo is checked, re-encoded as a PNG and reduced in size. In the process, metadata such as EXIF information including the location where the picture was taken are removed. It is stored outside the application's public directory and appears in the account and in the header of the knowledge gap report (4.4).

4.2 Login, sessions and security

For each login we store a session with IP address, browser, operating system and device type so that under "Settings" you can see (country, browser and operating system – not the address) and end where you are logged in. On the account itself we record the time and IP address of the last login. We delete ended sessions 30 days after they end, and sessions no longer in use 30 days after their last use. We store failed and successful login attempts for 7 days in order to detect attacks on passwords. Likewise, we store every registration attempt for 7 days with the IP address, without an email address, in order to limit mass registrations. In addition, the application limits login and two-factor attempts per account and per IP address under pseudonymised keys (HMAC), without the email or IP address in plain text; these entries are deleted once their time window (default 15 minutes) has expired. Two-factor authentication is mandatory for our own administrator accounts. Signing in and the forms "Forgot password?" and "Choose a new password" are additionally checked by the formconfirmed form protection (3.7).

Important events in the account (such as login, changes to settings, deletions) are recorded in the audit log together with the IP address; it is deleted after 365 days.

Technical errors are recorded in the error log, which is deleted after 90 days. The legal basis is Art. 6(1)(b) and (f) GDPR.

4.3 Workspaces, members and roles

Websites belong to workspaces. You can invite other persons by email; pending invitations expire. Depending on their role, members see the websites, settings, reports and billing details of the workspace, but only they themselves see their own account data. Anyone who sends an invitation passes the invited person's email address on to us and should inform that person accordingly. Agency templates transfer approved design and answer fields as well as the search glossary between websites of the same workspace, never access credentials, permissions or interface connections. The legal basis is Art. 6(1)(b) GDPR and, for invited persons, Art. 6(1)(f) GDPR.

4.4 Emails

We send transactional emails (address confirmation, password reset, change of email address, invitations, transfer of a workspace, quota warnings, payment failure, contract and withdrawal confirmation for consumers, acknowledgement of and replies to support enquiries, deletion confirmation) via Namecheap Private Email (Namecheap, Inc., Phoenix, Arizona, USA). Via the same provider we receive emails to addresses under @answely.com, such as support@answely.com; your message and our reply are stored there. Because Namecheap is based in the USA, this is a transfer to a third country (section 8). A copy of each email is kept in our outbox for no more than 30 days so that a failed delivery can be retried. Because it contains confirmation and reset links, this period is deliberately short.

You receive the knowledge gap report only if you switch it on for a website (from the Pro plan, only while question analysis is running): once a month an email to the owner of the workspace with the most frequent question groups and the groups without a supported answer from the previous month, in the form also shown in the account (groups of similar, masked questions), with your company logo in the header. Every email contains a link to unsubscribe without logging in. This report is also sent via Namecheap Private Email; the masked group texts it contains therefore leave the EU (section 8).

4.5 Websites, domain verification and index

For each website you create, we store the domain, additional hosts, design and settings of the answer box. We verify that the domain belongs to you by retrieving your home page, a DNS record or a file under /.well-known/answely.txt – only then do we retrieve your website. For the index, we read exclusively publicly accessible pages of your website, never areas behind a login, and we respect robots.txt. We store the content of these pages, their sections and the vectors calculated from them until the website is deleted; thereafter they are completely removed from the live system within 24 hours (for backup copies, see section 9). You remain responsible for personal data on your pages and can exclude paths from the index or mark areas with data-answely-ignore.

For the content in the index, we are your processor: persons named on your public pages may appear in answers given by the box. You yourself switch on the following ways of bringing content into the index:

• PDF documents are read as well; if a PDF contains no extractable text, we recognise it using optical character recognition (OCR) exclusively on our own server, without any external service, in a private working folder that is deleted afterwards.
• Push interface (from the Pro plan): you yourself send us texts with an address on a verified host. We store the access key only as a hash.
• WordPress synchronisation via our plugin (after being expressly switched on): only published, public content, its changes and withdrawals are transferred; the access key is stored only in your wp-config.php.

Via Push and WordPress you may only import content that you are permitted to have answered publicly, and no special categories of personal data (Art. 9 GDPR). Non-public content belongs exclusively in protected knowledge areas (5.9).

If index approval is switched on, a new version is first created as a candidate and is published only after it has passed answer tests; the previous version is retained so that it can be restored. As a result, up to two further copies of your public pages may exist. The previous version remains until the next approval or until the website is deleted; removed pages and deletions are immediately applied to these copies as well. The technical approval reports contain no questions or answers and are deleted after no more than 30 days.

Further information that you yourself store and that remains until the website is changed or deleted: search glossary (synonyms), validity periods and priorities of sources, editorial answers, targeted follow-up questions and rules of the rule adviser, addresses of public live data sources. Do not use any personal information for these that is not to be answered publicly. The legal basis for administration is Art. 6(1)(b) GDPR.

4.6 Answer tests, diagnostics and tools in the account

Optionally, you can store in the website settings public product or documentation areas, approved action and support links, and up to ten of your own test questions with expected keywords, sources and refusals. This information remains stored until the website is changed or deleted and forms part of the account export. Use public test cases without personal or confidential information for this purpose. The test questions are processed after changes to the index or configuration or at your manual request. The answers generated from them are not stored permanently. A test report contains case numbers, test results, run times, index version and checksums, but no question or answer texts. The current report and one predecessor are retained for no more than 30 days from the last test run; when the website is deleted, they are removed immediately. Keyword and source checks do not replace a substantive review of the answer.

Answer diagnostics and answer comparison show you, for a question you have entered yourself, which sections were found, selected and given to the model and why an answer was refused. For this purpose, the question, the supporting evidence and the answers exist only in the service's memory and in the response to your account; they are discarded no more than 15 minutes after completion and are not logged. The documentation copilot creates a draft for a new help page from existing public passages; the draft exists only in the response and in your browser, we do not store it, and nothing is published automatically.

4.7 Payment and invoices

We bill paid plans and add-on packages via Stripe (card, SEPA direct debit and, depending on the country, other payment methods such as BLIK or Przelewy24). Payment data (card, bank details) exist only at Stripe; we do not see them. We store your Stripe customer number, the plan, the billing period and, for each invoice, the number, amounts, tax status, VAT ID and country as stated on the invoice. Stripe calculates the VAT (Stripe Tax) and provides a customer portal. We retain invoices and billing records for 5 years from the end of the calendar year in which they were created (Polish tax law, Art. 86 in conjunction with Art. 70 Ordynacja podatkowa) – including after an account has been deleted, in which case without any link to the account. After that, we delete the invoices automatically, even if the account still exists; what Stripe itself retains is governed by Stripe's own obligations. The legal basis is Art. 6(1)(b) and (c) GDPR. Where required by law, we transmit invoices to businesses in Poland via the National e-Invoicing System (Krajowy System e-Faktur, KSeF) of the Polish Ministry of Finance – via an extension of our payment service provider or manually (Art. 6(1)(c) GDPR).

If, as a business, you provide a VAT ID, we verify it via VIES, the European Commission's interface. In doing so, we transmit your number and our own VAT ID. We store the result: valid or not, name and address according to VIES, time and query number. Only a confirmed number is passed on to Stripe. The legal basis is Art. 6(1)(c) GDPR (evidence for the VAT-exempt invoice under the reverse charge procedure).

As a private individual, before each payment you expressly request that performance of the service begin immediately (right of withdrawal; this request is not a waiver). We record this confirmation in the same way as the consent given upon registration (version of the withdrawal notice, wording, time, IP address, browser), as well as the conclusion of each contract (subscription or add-on package, for the withdrawal period of that contract) and any withdrawal made via the withdrawal function (time, subscription or add-on package; here without IP address and browser). If you cancel a subscription to switch provider, we record the time of the declaration and the end of the subscription. The legal basis is Art. 6(1)(b) and (c) GDPR.

4.8 Downloading and deleting your data yourself

Under "Settings" you can download all data of your account yourself (as a JSON file or as CSV tables) and delete your account yourself. Upon deletion, we immediately remove your account, your add-on packages and your own workspaces without further members, together with their websites; the index of these websites is removed from the live system within 24 hours. Workspaces in which other members work pass to another member – preferably to the longest-standing admin, otherwise to the longest-standing member – and continue to exist. Invoices (4.7) and the record of your consent to the legal texts are retained, the latter at the latest 4 years after deletion. Entries in the page statistics, audit log, error log and login attempts are not removed early but expire with their periods in section 10; support enquiries remain until they are deleted (3.6). You receive a deletion confirmation by email. Deleted data remain in the encrypted backup copies until those copies expire (section 9).

5. Part C – The answer box on our customers' websites

Our customers integrate Answely into the search on their website. If you ask a question there, a short, AI-generated answer with links to its sources on that website appears in addition to the search results.

5.1 Who is responsible

The controller is the customer who owns the website. The customer decides whether and how the box works and which of the optional functions described in this Part are switched on, and informs you in its own privacy policy. We are its processor, process the data only on its instructions and do not use them for any purposes of our own. Everything in this Part that is described as "optional" is switched off for new websites.

5.2 What leaves your browser

Whether an input is sent is decided by the script answely.js in your browser – in the default setting only if it looks like a question. The following are sent in encrypted form to api.answely.com: the question (no more than 300 characters), the language, and the address of the current page and of the referring page, both without parameters and anchors (on search pages these often contain the search term). Our server additionally strips parameters and anchors. The script sets no cookies, creates no visitor identifier and loads no fonts, images or scripts from third parties; it is loaded from our own server cdn.answely.com.

Depending on the settings, the following are added:

• Follow-up question: if you ask a follow-up question in the box, your browser also sends up to three previous rounds of this conversation (question and answer text) so that the answer knows the context. These are not stored either.
• Area: if a product or documentation area is selected, its identifier.
• Protected knowledge area: an access token of the website on which you are logged in (5.9).
• Rating and success: if you give a rating, a random identifier of the answer and your choice (5.4, 5.7).

5.3 How the answer is generated

The question is matched against the index of the customer's website; a language model on our own AI computers in Łódź uses this to formulate an answer that is based only on supported sections of that website. AI processing takes place exclusively on servers in the EU. If there is no supporting evidence, the box replies that it has no supported answer to the question. Every answer is visibly labelled as AI-generated (Art. 50 of the AI Act (EU) 2024/1689); this notice cannot be switched off, but its wording can be adjusted from the Pro plan. An answer may be incomplete or incorrect; the linked sources are authoritative.

If the customer has stored an editorial answer for a question, this appears instead of an answer formulated by the model.

5.4 What is stored

The customer decides for each website whether answers are stored ("Allow answer cache"). For new websites it is switched off.

• Switched off (default setting): the question and answer are not stored. They exist only in memory during processing and on the encrypted path to our AI servers. Your browser does not store anything either in that case.
• Switched on: so that a repeated question does not have to be recalculated, we store the answer together with its sources under a hash of the question in a cache for 24 hours. If the website's index changes, older entries are no longer used and expire with their period. Your browser keeps the box settings in sessionStorage for no more than 5 minutes, and answers only for websites connected via reactive.chat (5.5, 5.10).
• Question analysis (only if the customer switches it on for its website, from the Pro plan and only with "Allow answer cache" switched on): for each answer we store the question, in which email addresses, telephone numbers, IBAN-like sequences of digits, links and long numbers are made unrecognisable before storage, the calendar day (without time of day), the language, whether a supported answer was found, the addresses of the pages cited, the duration and – if you use one of the "helpful" or "not helpful" buttons – your rating; for this, your browser sends only a random identifier of the answer and your choice. Your IP address, identifiers of your browser, the answer text and the address of the page on which you asked are not stored. The customer sees only groups of similar questions of two or more questions, never individual questions. If the customer additionally switches on the monthly knowledge gap report, some of these masked group texts are sent to the customer by email via a provider in the USA (section 8). Question analysis entries are deleted after 90 days.

To group similar questions, the masked questions are converted at night on our own AI computers into vectors that are created only in memory. The customer can itself delete the question analysis completely at any time; it is deleted immediately together with the website.

In both cases:

• Counters without content: for each request we store the time, the truncated IP address, the website identifier, the length of the question, the result and the duration – never the question or the answer. The entries are deleted after 7 days. From these, the customer sees only daily figures.
• Protection against misuse: in order to limit requests per sender, we generate a hash from your IP address and a random value that changes daily; the hash lives for no more than 2 minutes, the random value for no more than 2 days. The IP address itself is not stored for this purpose.
• Access log: as in 3.1 – truncated IP address, without question and answer, 7 days.
• Monthly figures: for quota and billing purposes, we count the number of answers per website per month, without any personal reference; the monthly figures are deleted after 400 days.
• Service logs: they contain path, status and duration, never the question, the answer, the page address or the conversation history.

5.5 In the browser

The box sets no cookies and uses no persistent local storage. Only with "Allow answer cache" switched on does it store data in your browser's sessionStorage, which is cleared anyway when the tab is closed: the box settings for 5 minutes; for websites connected via reactive.chat (5.10), answers for 10 minutes as well. The script itself deletes expired entries. The entry for an answer contains the question in the key as well as the answer and sources. For websites with a protected knowledge area, nothing is stored in the browser. A withdrawal of consent in consent mode immediately deletes all entries of the box.

The box reports technical events (such as "answer ready", duration, number of sources, "rated") to the page on which it is running as an event in the browser, without the question and answer. Answely does not send these events anywhere. Whether the website passes them on to its own tools is decided by, and is the responsibility of, the customer.

5.6 Areas, action links and support handover

If a product or documentation area is selected, its identifier is sent with the question and the search is limited to the associated public sources. When the area is changed, the box starts a new conversation history. These areas are not access controls for confidential content.

Action and support links are defined by the website operator. Only a click opens the target; Answely does not automatically append either the question or the conversation history to its URL. If no answer is found, you can, if you wish, expressly copy the question, history and sources in your own browser and hand them over to support yourself. Nothing is transmitted to us in the process. The operator of the target is responsible for the subsequent processing there.

5.7 Optional functions for extended answers

The customer switches these functions on individually for each website; unless switched on, they do not exist.

• Targeted follow-up questions: if a question matches stored terms, the box offers options to choose from (such as a product version). Your selection supplements the search in the box's memory; no profile is created.
• Evidence preview: the box shows the sections of the website actually cited, with the time at which we retrieved them. This is public content from the index; no new data about you are created.
• Deep search: at your click, the answer includes additional neighbouring sections of the same website, no more than eight extracts, with no more than one model call.
• Rule adviser: several multiple-choice questions lead to a recommendation, approved by the customer, with a source. Your selection is not stored.
• Live API data: Answely retrieves fixed public data sources of the website operator (such as stock levels) and displays a value with the time of retrieval. Our server retrieves the source itself; neither your IP address nor your question nor any identifier is passed on in the process.
• Success measurement and A/B comparison: the box can ask whether your concern has been resolved and, at the customer's request, compare two presentations. For this purpose, each answer is given a random one-time identifier and a comparison group in a signed token that is valid for no more than 24 hours and is held only in the box's memory. From this, we count only totals per website, group and calendar day (shown, resolved, not resolved, goal achieved). These daily totals and the identifiers used to prevent duplicate reports expire after no more than 30 days. They contain no questions, answers, page addresses or IP addresses; the customer sees only group totals. If consent mode applies, nothing is reported without consent.

5.8 Optional public MCP search access

The website operator can expressly enable MCP access, which is switched off by default. It provides public AI clients with a pure text search in the approved website index. The access performs no actions, uploads no new content and generates no model answers. Search queries are not stored as question analysis or in the answer cache. The existing protection against misuse is used to limit retrievals. The technical access logs described in 3.1 remain in place. The access is public; confidential content must not be made available through it. Processing in the AI client used falls within that client's area of responsibility.

5.9 Protected knowledge areas

A protected mode has been prepared for content that only logged-in users of a website are permitted to see. The website then gives the box an access token (a signed token from its own login system). We verify it locally on our server against the stored public key, without querying any external service, and derive from it only which documents may be searched. The information in the token is not stored and is not given to the language model; protected answers are not cached either by us or in the browser. No login system is currently connected for any website; this section will be supplemented before a first activation.

The customer may import non-public content exclusively via such a protected area. The customer is responsible for the selection of content, the permissions of its users and their login.

5.10 Websites connected via reactive.chat

Customers of reactive.chat receive the answer box as part of their contract. For these websites, the answers come from the reactive.chat knowledge base; in this case the question, the IP address and the visitor identifier of the reactive.chat widget are passed to reactive.chat so that a conversation can continue in the chat. If "Allow answer cache" is off, your browser additionally receives with the answer a signed history consisting of your question, the answer, up to three sources, the website and the visitor identifier; it is valid for 24 hours and is held only in the working memory of the page. If you then send a follow-up question in the chat, this signed history (search question and answer, with the sources) is passed to reactive.chat and stored there once as the beginning of the conversation, like the rest of the chat; the box points this out before sending. If "Allow answer cache" is on, reactive.chat already keeps the search question and answer as a conversation under its rules, and the follow-up question continues it. If you have deleted your data at reactive.chat or the history can no longer be used, the follow-up question starts a new conversation without this history. The rules of the privacy policy and the data processing agreement of reactive.chat, which is also operated by us, then apply; the privacy policy of reactive.chat describes these answers in its section "Smart Answer".

5.11 Consent mode

The customer can configure the box so that it only works after your consent. In that case, your browser does not send a single request to Answely before consent – not even the retrieval of the settings – and stores nothing in the browser. This requires the customer to use the modified embed code with data-consent="required"; without it, the box first retrieves its settings and then sends no question until consent is given. In that case – consent mode set only in the account, embed code without data-consent="required" – the box, with "Allow answer cache" switched on, stores its settings in sessionStorage even before consent (5.5). The box recognises consents from consented.eu, from consent tools based on the IAB TCF standard and from a signal from the website itself. If you withdraw consent, the box closes, makes no further requests and deletes its entries in the browser.

5.12 Legal basis and your rights in Part C

The legal basis is determined by the customer; typically it is Art. 6(1)(f) GDPR (answering questions on the basis of the content of its website) or your consent. For requests relating to Part C, please contact the customer; if you write to us, we will forward your request to the customer and support it. What we can and cannot find in that context is set out in 11.8.

5.13 What we do not do

• We set no cookies in the box, create no visitor identifier and do not recognise you across pages, websites or days.
• We do not store your question as long as "Allow answer cache" is switched off, and never together with your IP address.
• We do not write questions, answers or conversation histories to logs.
• We do not pass questions on to external AI services, advertising networks or other customers.
• We do not train any models with your questions or the content of the websites.
• We do not show the customer individual questions, only groups in the question analysis.
• We do not make any decisions about you using the box.

5.14 The limitations, honestly

• The AI can be wrong. An answer may be incomplete, out of date or wrong, even if it is based on pages of the website – for example because a condition is abbreviated. The linked sources are always authoritative.
• Free text can contain anything. You decide what you write in the search field. Please do not enter health data, account numbers, names of third parties or other confidential information. Even if nothing is stored, the question is processed.
• The masking in question analysis is incomplete. It recognises email addresses, telephone numbers, IBAN-like sequences of digits, links and long numbers. It does not recognise names, addresses written out in words or a diagnosis. That is why question analysis is an opt-in by the customer, shows only groups and deletes after 90 days.
• Website content. If something about a person appears on a public page of the customer, it may appear in an answer. This is the responsibility of the customer, who can exclude pages.
• No protection through areas. Product and documentation areas organise content; they hide nothing.
• Backup copies. Whatever has been deleted remains in the encrypted backup copies until they expire (section 9).

6. Legal bases at a glance

Processing	Legal basis	Legitimate interest, where point (f)
Web server access log	Art. 6(1)(f)	operation, security, troubleshooting
answely.com page statistics	Art. 6(1)(f)	improvement of the offering, detection of misuse
Cookies bpid and bp_remember	Art. 6(1)(b), storage strictly necessary	–
Consent banner and record	Art. 6(1)(c) and (f)	evidencing and respecting your decision
Quick check	Art. 6(1)(b) and (f)	performance of your request, limitation of misuse
Live demo /docs and search in the navigation	Art. 6(1)(f)	demonstration and answer at your request
Support form	Art. 6(1)(b) or (f)	answering, protecting the channel
formconfirmed form protection	Art. 6(1)(f)	protecting accounts, support and the quick check against automated submissions; campaign detection: joint defence against spam across many websites
Account, websites, index, workspaces	Art. 6(1)(b)	–
Invitations to third parties	Art. 6(1)(f)	collaboration in the workspace
Sessions, login attempts, audit log	Art. 6(1)(b) and (f)	protection of accounts
Transactional emails, knowledge gap report	Art. 6(1)(b)	–
Record of consent, withdrawal, request for immediate start	Art. 6(1)(c) and (f)	evidencing the conclusion of the contract
Payment, invoices, VIES	Art. 6(1)(b) and (c)	–
Off-site backup copy	Art. 6(1)(f)	restoration after a loss
Answer box (Part C)	determined by the customer, usually point (f) or point (a)	from the customer's perspective

7. Recipients and sub-processors

Within our company, only the operator has access to the systems. Outside the company, data are received by:

• Google Ireland Ltd., Dublin, Ireland (reCAPTCHA): only as a fallback check during a disruption of the form protection (3.8); Google is responsible for its own processing, not a processor.
• Google Ireland Ltd., Dublin, Ireland (Google Cloud Storage, Warsaw region): storage for the nightly backup copy, which is encrypted beforehand (2.3, section 9). Sub-processor on the basis of the Google Cloud data processing terms; Google cannot read the content.
• Stripe Payments Europe, Ltd., Dublin, Ireland: payment processing, invoices, tax calculation and customer portal for customers (4.7). Stripe never receives data of visitors to our customers' websites.
• Namecheap, Inc., Phoenix, Arizona, USA (Namecheap Private Email): sending of transactional emails and the knowledge gap report as well as receipt of emails to addresses under @answely.com (4.4). In doing so, Namecheap processes the name, email address and content of the messages. Processor on the basis of Namecheap's Data Processing Addendum; for the transfer to the USA see section 8. Namecheap is also the registrar and DNS provider of answely.com; for this purpose it receives only domain data, no data of customers or visitors.
• European Commission (VIES), Brussels: only for businesses with a VAT ID, verification of the number (4.7). Not a processor but an independent controller.
• Customers as controllers for Part C: they see counters as daily figures, monthly figures, if they so wish groups from the question analysis and totals from success measurement, never individual questions with a personal reference.
• Authorities, where we are legally obliged to disclose data, for example tax authorities in relation to invoices.

The following are not sub-processors, and why:

• our AI servers: we operate them ourselves in Łódź.
• a hosting provider: there is none; the servers are our own.
• consented.eu: a service of the same legal entity that runs on the same server in Łódź as Answely.
• Telegram: receives only a signal with fixed wording, without personal data.
• Let's Encrypt: learns only domain names.
• A geolocation service: we determine the country using a database file on our own server.
• formconfirmed: our own form protection (3.7), a product of formexposed, belongs to the same legal entity and runs on the same server in Łódź as Answely.
• reCAPTCHA in normal operation: Google reCAPTCHA is only loaded during a disruption of the form protection (3.8); we do not use other comparable third-party services on Answely.

A further AI provider for the language model (for example as a fallback in the event of overload) has been technically prepared but is not active. It would be used only if it processes in the EU, contractually undertakes neither to use content for training nor to store it beyond the processing, is included in the list of sub-processors, and customers have been informed 30 days in advance and were able to object. Technically, the service only starts with AI addresses that are on an allowlist for EU locations. Providers outside the EU are excluded.

The current list is available under Sub-processors.

8. Transfers to third countries

Personal data leave the EEA in three cases:

• Fallback check during a disruption (3.8): Google may transfer reCAPTCHA data to Google LLC (USA), on the basis of the EU-US Data Privacy Framework (Art. 45 GDPR).

• Payments: Stripe Payments Europe may transfer customers' billing data to Stripe, Inc. (USA), on the basis of the EU-US Data Privacy Framework and, in the alternative, the EU standard contractual clauses (Art. 45 and 46 GDPR).
• Email: our emails to customers and prospective customers and incoming emails to addresses under @answely.com are routed via Namecheap Private Email (Namecheap, Inc., USA). The basis is Namecheap's Data Processing Addendum with the EU standard contractual clauses (Art. 46(2)(c) GDPR), accepted on 01.08.2026. This concerns the name, email address and content of the messages and, in the case of the knowledge gap report, also masked group texts from the question analysis.

AI processing is not affected by this: it takes place exclusively on servers in the EU. Questions and answers from the answer box do not leave the EU. The only exception is the knowledge gap report, if the customer switches it on: it contains groups of masked questions and is sent to the customer by email via Namecheap. Other data of visitors to our customers' websites (IP addresses, counters, answers) never leave the EU. The formconfirmed form protection (3.7) does not transfer anything to a third country either.

9. Backup copies and what they mean for erasure

One retention period outlasts all the others, which is why it is stated here and not only in the technical documentation. Every night, a copy of all databases and application files is created, encrypted on our server and transferred to Warsaw (2.3). It also contains the data from Parts B and C that were in the system at the time of the copy: accounts, websites, index, question analysis, counters.

Off-site copies: daily copies 7 days, weekly copies 364 days.

Before a daily copy (dumps of all databases on the server and a file copy of /var/www including configuration files) is encrypted and transferred, it is created on a storage device attached to our server in Łódź; there it remains unencrypted for no more than 8 days and is then deleted.

In addition, the server keeps its own verified database backups for 30 days for rapid restoration.

Whatever is deleted in the live system – immediately or within 24 hours – therefore remains in the encrypted copies until they expire, at the latest 364 days after deletion. Nothing is selectively removed from a copy: it is a sealed image of a point in time, and altering it would defeat its purpose. The copies serve exclusively for restoration after a loss and are not used for anything else. If a copy is restored, we delete the data deleted in the meantime again before the system goes back into operation. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is being able to restore your data and ours after an outage. In our assessment, your right to erasure (11.3) is safeguarded during this time by the encryption and the exclusive purpose of restoration.

10. Retention periods at a glance

Data	Retention period
Web server access log (truncated IP)	7 days
Application page statistics	60 days
Login attempts	7 days
Audit log	365 days
Error log	90 days
Outbox	30 days
Sessions in the account	30 days after they end or were last used, at the latest until the account is deleted
Account data, websites, design, settings	until deletion, then immediately
Index of a website including candidate and previous version	until the website is deleted, then within 24 hours
Test questions and additional search settings	until the website is changed or deleted
Answer test reports	no more than 30 days from the last test run, immediately upon deletion of the website
Technical approval reports of index approval	no more than 30 days
Answer diagnostics, answer comparison	no more than 15 minutes after completion, in memory only
Answer box: counters without content	7 days
Answer box: misuse protection hash	2 minutes; random value 2 days
Answer box: answer cache (only with "Allow answer cache" on)	24 hours
Answer box in the browser (only with "Allow answer cache" on)	settings 5 minutes; answers 10 minutes, only when connected via reactive.chat
Monthly figures per website (without personal reference)	400 days
Question analysis (opt-in only, questions masked)	90 days
Success measurement: daily totals per group	no more than 30 days
Success measurement: token of an answer	no more than 24 hours
Quick check: rate-limiting data	no more than 2 minutes
Quick check: result	no more than 2 minutes after completion, in memory only
Limiting of login and two-factor attempts (pseudonymised)	end of the time window, default 15 minutes
Support enquiries	1095 days from the last reply (without a reply, from receipt)
formconfirmed form protection (3.7)	hash of the truncated address range: with the check result at most 1 hour, with the used token about 11 minutes, in the task counter about 1 hour; check results without the hash 30 days; result for the domain of the email address at most 7 days (the address never); text in memory only; web server log of formconfirmed.com 14 days; campaign detection fingerprints 30 days; at Answely, identifier of the check for registration and support request 30 days
Receipts, rate limit and state information of the form protection (3.7)	receipts 7 days; rate limit until the end of the time window, at most 1 day; state information 30 days
Record of consent, withdrawals	at the latest 4 years after deletion of the account
Result of the VIES check	as long as the account exists
Invoices and billing records	5 years from the end of the calendar year in which they were created, then deleted automatically
Cookie consented in the browser	12 months
Banner consent record at consented.eu	36 months
Off-site encrypted copies (Google Cloud Storage)	daily copies 7 days, weekly copies 364 days
unencrypted daily copy at the server before transfer	no more than 8 days

Summarised as a list:

• Web server access log (truncated IP address): 7 days.
• Application page statistics: 60 days.
• Login attempts: 7 days.
• Audit log: 365 days.
• Error log: 90 days.
• Outbox: 30 days.
• Answer box: counters without content 7 days.
• Question analysis (only with the customer's opt-in, questions masked): 90 days.
• Sessions in the account: 30 days after they end or were last used.
• Support enquiries: 1095 days from the last reply.
• formconfirmed form protection: hash of the truncated address range at most 1 hour, check results 30 days, result for the domain of the email address at most 7 days, campaign detection fingerprints 30 days.
• Receipts for "Forgot password?": 7 days; state information of the form protection: 30 days.
• Invoices: 5 years from the end of the calendar year in which they were created.
• Record of consent to the legal texts, confirmation of immediate commencement and withdrawals: at the latest 4 years after deletion of the account.
• Database backups: 30 days, rolling.
• Off-site encrypted copies: daily copies 7 days, weekly copies 364 days (section 9).

11. Your rights

You have the following rights vis-à-vis the respective controller. For Parts A and B, that is us; write to support@answely.com. For Part C, it is the customer on whose website you asked (5.12). We respond without undue delay and at the latest within one month; in the case of complex or numerous requests, this period may be extended by a further two months, of which we will inform you within the first month (Art. 12(3) GDPR). Exercising your rights is free of charge. In order not to disclose data to the wrong person, we answer requests concerning an account to the email address stored in it or ask for confirmation from within the account.

11.1 Access (Art. 15)

You can find out whether and which data we process about you, for what purpose, for how long and to whom they are disclosed, and obtain a copy. Customers will find almost everything in the account export under "Settings".

11.2 Rectification (Art. 16)

We rectify incorrect information. You change your name, address, company, language and logo yourself in the account; we can only change information on invoices already issued by means of a corrective invoice.

11.3 Erasure (Art. 17)

You can request that we erase your data insofar as there is no obligation to retain them. You delete your account yourself (4.8). Only invoices and records of consent are then retained, for the periods stated; for backup copies, see section 9.

11.4 Restriction (Art. 18)

If you contest the accuracy of data or have objected, you can request that we only store them until the matter has been clarified.

11.5 Data portability (Art. 20)

You receive the data that you provided to us for the contract in the account export in a commonly used, machine-readable format (JSON or CSV).

11.6 Objection (Art. 21)

You can object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds, such as defending against an ongoing attack. We do not carry out direct marketing.

11.7 Withdrawal of consent (Art. 7(3))

You can withdraw consent, for example given in the consent banner, at any time with effect for the future, in the banner via "Cookie settings".

11.8 Visitors to the answer box: what we can find (Art. 11)

The answer box does not know you: it assigns no identifier, and stored questions in the question analysis are kept without IP address and without time of day. We are therefore usually unable to link your request to any stored information. Under Art. 11 GDPR we are not obliged to collect additional data solely in order to identify you. If you tell us or the customer the website, the day and the exact wording of your question, the customer can have the question analysis searched for it or delete the question analysis in its entirety.

The truncated IP addresses in counters and logs disappear after 7 days in any case.

11.9 Complaint (Art. 77)

You have the right to lodge a complaint with a supervisory authority. The authority competent for us is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland. You may also contact the supervisory authority of your habitual residence or place of work.

Instructions for access and erasure are provided separately under Access and deletion.

12. Obligation to provide data

You do not have to provide any information in order to visit answely.com or to ask questions in the answer box; only the connection data are technically necessary. For an account we need your email address, name, country and customer type, and for paid plans additionally the billing information required by tax law. Without this information we cannot conclude a contract. The VAT ID and a company logo are voluntary; without a valid VAT ID, we issue an invoice including VAT.

13. No automated decision-making

We do not make any automated decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR), and we do not create profiles for advertising purposes. The answer box answers questions; it decides nothing about you. Success measurement and A/B comparison evaluate presentations, not persons. Rate limiting rejects further requests from an address until the end of the current minute if it makes too many; this is a technical safeguard, not a decision about you. Likewise, the result of the form protection (3.7) only decides on the individual submission; you can repeat a rejected submission or send your request to support@answely.com.

14. Children

answely.com and the customer account are aimed at businesses and adult private individuals; we do not knowingly collect data from children. Anyone who creates an account warrants that they have full legal capacity (clause 1.6 of the Terms of Use). Anyone can use the answer box on customer websites; because it does not recognise anyone, it does not know their age either. Precisely for this reason, it stores nothing in the default setting.

15. Security

We protect data by means of technical and organisational measures pursuant to Art. 32 GDPR, including transport encryption, hashed passwords, mandatory two-factor authentication for administrators, separated tenants, rate limiting, an administration interface that is not reachable from outside, AI computers that collect jobs only with a signature and are never addressed by the answer service, and encrypted backup copies with regular restoration tests. Details: Technical and organisational measures.

No measure makes a system invulnerable. If we become aware of a personal data breach, we notify the supervisory authority within 72 hours in accordance with Art. 33 GDPR and inform you if there is a high risk to you; if it concerns Part C, we inform the customer without undue delay.

16. Data protection officer

No data protection officer has been designated. We do not consider a designation under Art. 37(1) GDPR to be required: we are not a public authority; our core activities do not consist of large-scale regular and systematic monitoring of individuals – the answer box assigns no identifier and does not link visits – nor of large-scale processing of special categories of personal data. This assessment is documented in the record of processing activities and is repeated in the event of material changes. Enquiries are answered by the owner at the address given above.

17. Changes to this policy

We adapt this policy if the service or the legal situation changes, for example if an optional function is added or a sub-processor changes. The current version is always available on this page, with the version number and date at the bottom. We notify customers of material changes affecting them by email; we announce changes of sub-processors to customers in advance in accordance with the DPA. Where this policy exists in several languages, this English version is the binding version in the event of discrepancies; the German and Polish versions are translations provided for information. This does not apply to consumers: for them, the version in the language in which they concluded the contract is binding.

18. Contact and version

LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82, lok. 301, 90-437 Łódź, Poland, VAT ID PL7252266190. Data protection enquiries: support@answely.com.

Further documents: Data processing agreement, Technical and organisational measures, Sub-processors, Template for your privacy policy, AI Act, Legal documents.

Version 1.7 – as of 06.11.2026