Record of Processing Activities (Art. 30 GDPR)

1. How to read this record

This is the record of processing activities under Art. 30 GDPR for Answely. It is not a privacy policy. Its purpose is to show a supervisory authority, a customer who needs to build its own documentation, or the next person who has to answer a question, what is actually processed, where it is held, who receives it and how long it is kept. We publish it because our customers are themselves controllers for the processing in the answer box and need this information for their own record and their own impact assessment.

Three rules governed the drafting.

A statement appears only where code, database schema, configuration or a documented measurement supports it. Where something is not evidenced, a visible placeholder appears instead of a plausible-sounding sentence.
Retention is stated twice: once for what a clean-up run actually deletes, and once for what no run covers (section 6). A retention period that applies to only half of the tables is worse than a named gap.
Functions that are prepared in the code but not switched on are described as prepared and not as being in operation. This applies in particular to the EU fallback provider for the language model and to protected knowledge areas.

Basis of measurement: the basis is the code status of the development environment as of 11.10.2026; tables, fields, clean-up runs, configured retention periods and non-secret configuration were reconciled with the running development environment on 12.10.2026. Answely is not yet in production operation; row counts and data volumes were not measured for this version. Row counts per table and the number of customers and sites on the production system will be added, with the date of measurement, after commissioning.

Deliberately omitted: internal network addresses, host names other than public domains, access credentials, keys and identifiers of individual customers. A published record must not itself become a plan of attack.

Configurable periods: six periods are set by the operator in the administration area. They appear here as placeholders that are replaced by the currently configured value when displayed: 60 (page statistics), 365 (audit log), 90 (error log), 30 (outbox), 1095 (support enquiries) and 30 (database backups on the server).

2. The legal entity, and why this record has two halves

Field	Entry
Legal entity	LW IT Solutions Company Lukas Wójcik, sole proprietorship (jednoosobowa działalność gospodarcza), registered in CEIDG
Address	al. Tadeusza Kościuszki 80/82, lok. 301, 90-437 Łódź, Poland
Tax identifier	VAT ID PL7252266190
Data protection contact	support@answely.com (general, data protection, authorities, support)
Product	Answely – AI answer box for website search (answely.com, answer service api.answely.com, script `answely.js`)
Representative under Art. 27	Not applicable. The legal entity is established in the Union (Poland).
Data protection officer	Not designated. Assessment under Art. 37 in section 9.
Competent supervisory authority	Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa

The same legal entity also operates reactive.chat, MousePlayer, consented.eu and Stats4U. These products have their own records; this record contains only what concerns Answely, including the points at which Answely interacts with reactive.chat and consented.eu.

Answely takes on two different roles vis-à-vis two groups of persons.

Part A (sections 3 and 4) – Art. 30(2). For everything that visitors enter into the answer box on a customer's website, and for the index of customer pages, Answely is a processor (Art. 28 GDPR). The controller is the customer who owns the website. The basis is the data processing agreement.
Part B (section 5) – Art. 30(1). For the website answely.com, the customer account, billing, support, the public quick check, our own demo, logs and backup copies, Answely is itself the controller.
Sections 6 to 8 apply to both halves: retention, automated decision-making and the general description of the technical and organisational measures.
Section 10 lists the gaps whose existence is evidenced. A record is a working tool, not a certificate.

The separation is implemented in the code and has technical consequences: customers (account app) and visitors (answer service) are held in two separate databases (answely_konto and answely respectively), the answer box sets no cookies and assigns no visitor identifier, and visitor data never reach Stripe or billing.

3. Part A – Art. 30(2): processing on behalf of customers

A.0 Parties involved

Field	Entry
Processor	LW IT Solutions Company Lukas Wójcik, address as above, support@answely.com
Controllers	The customers who embed the script `answely.js` on their website or provide content via the push interface, the WordPress plugin or the MCP access. Each controller is identified in the system by its workspace and the keys of its websites; contact details are held in the account app.
List of controllers	Maintained in the system and not reproduced here: the owner per workspace with company name, address and domains is held in the account app. There is no separate retrieval of this list in the administration area (section 10, L11).
Customers of reactive.chat	For sites from reactive.chat (tenant `rc:`), the controller is the respective reactive.chat customer; processing takes place within the framework of the reactive.chat contracts of the same legal entity (A.20). The privacy policy and DPA of reactive.chat expressly name these answers ("Smart Answer") as a service of Answely.
Representative	Not applicable (established in Poland).
Data protection officer	Not designated – section 9.
Technical and organisational measures	Section 8 and TOM. They apply to every processing activity in Part A and are not repeated for each activity.
Instructions	The settings per website in the account app are the customer's documented instructions: "Allow answer cache" on or off, question analysis, consent mode, extensions, excluded paths. For new websites, "Allow answer cache" is off and all extensions are off.

A.1 Answering questions in the answer box

Field	Entry
Purpose	A short, supported answer to a visitor's question from the public content of the customer's website, with links to the sources.
Data subjects	Visitors to customers' websites who enter a question into the search or answer box.
Data leaving the browser	Question (no more than 300 characters), language, address of the current and of the referring page, each without parameters and anchors, for areas the identifier of the selected area, for follow-up questions the previous history of the current box (held only in the browser's memory). Technically unavoidable: the browser's IP address and the user agent when establishing the connection.
What the server does with it	The question is matched against the website's index (embedding with an embedding model of our own, likewise self-hosted, and full-text search). If the supporting evidence is strong enough, a language model formulates an answer from it – our own AI, self-hosted on two own computers that stand in for each other in the event of high load or failure; otherwise a fixed text "no supported answer" is returned without a model call. The answer is streamed.
Where processed	Memory of the answer service on our own server in Łódź. For embedding and answering, the service places a job in its in-memory job exchange; a worker on one of our own AI servers in the internal network in Łódź collects it via a signed request (HMAC) over TLS, performs the computation and returns the result. The server never calls the AI servers itself.
Stored	With "Allow answer cache" off (default for new websites): the question and answer are not stored. They appear in no log of the answer service, the indexer, the worker or the web server. With "Allow answer cache" on: see A.2 and A.7.
Recipients	No third parties. The AI servers are our own hardware, not sub-processors (section 4).
Third country	None.
Deletion period	No storage beyond the duration of the request. The job in the exchange expires as soon as it is completed, aborted or not collected.
AI labelling	Every answer bears a notice under Art. 50 of the AI Act that cannot be switched off; from the Pro plan with the customer's own wording.
No training	Neither page content nor questions nor answers are used for the training or fine-tuning of models; there is no path for this in the code.
Consent mode	With `data-consent="required"`, the browser does not send a single request to Answely before the visitor has consented; the consented.eu consent banner and TCF banners are recognised. If consent mode is switched on only in the account and the embed code lacks the attribute, the box first retrieves its settings (with "Allow answer cache" on, also into sessionStorage) and sends no question until consent is given. Whether the customer requires this is decided by the customer as controller.
Legal basis (determined by the controller)	Typically Art. 6(1)(f) GDPR (answering a question asked by the visitor) or consent; for access to the terminal equipment (sessionStorage, A.5), the national implementation of Art. 5(3) of the ePrivacy Directive.

A.2 Answer cache (only with "Allow answer cache")

Field	Entry
Purpose	Avoid recalculating a repeated identical question (load, response time).
Precondition	The customer has switched on "Allow answer cache" for the website.
Data	Answer text and sources; the key is a hash of website, area, language and question – the question itself is not in the key.
Where	Redis on our own server, with its own access user and prefix per environment.
Deletion period	Answer cache: 24 hours; if the website's index changes (new index version), older entries are no longer used and expire with this period
Recipients, third country	None.
Not cached	Answers from protected knowledge areas (A.18), answers during an ongoing diagnosis (A.19), MCP searches (A.17), quick check (B.13).

A.3 Counters without content

Field	Entry
Purpose	Operation, troubleshooting, quota and daily figures for the customer, without storing content.
Data	Time, truncated IP address (IPv4 without the last octet, IPv6 to /48), website identifier, length of the question, result (answer, no answer, error), duration. Never the question, answer or page address.
Where	Table `sa_zaehler` in the answer service database.
Deletion period	Counters without content: 7 days, hourly clean-up run in the answer service
Customer sees	Only daily figures per website, no individual rows.
Recipients, third country	None.

A.4 Protection against misuse, throttling and overload protection

Field	Entry
Purpose	Limit requests per sender, fend off attacks, protect our own AI capacity against overload.
Data	Hash of the IP address and a random value that changes daily; the IP address itself is not stored for this purpose.
Where	Redis (without Redis, only in the process memory).
Deletion period	Misuse protection hash: no more than 2 minutes. Random value (daily salt): no more than 2 days.
Limits	Throttle: no more than 60 requests per minute and IP across all public endpoints. Independently of this, the service permits only a limited number of simultaneous answers (default six in total, three per website); above that, it responds with HTTP 429; the box then shows a notice to wait briefly and accepts a new question only after the indicated waiting time (Retry-After, no more than 300 seconds, held only in the page's working memory), while the customer's search remains.
Recipients, third country	None.

A.5 Storage in the visitor's browser

Field	Entry
Purpose	Avoid reloading the box settings on every page view and show an answer just given again when navigating back – both only with "Allow answer cache" switched on.
Data	Only with "Allow answer cache": public settings of the box; only for websites connected via reactive.chat, answers including sources as well (the key of an answer entry contains the question asked). With "Allow answer cache" off (the default) and for protected knowledge areas the box stores nothing in the browser. No cookies, no visitor identifier, no requests to third parties.
Where	The browser's sessionStorage – on the visitor's terminal equipment, not at Answely.
Deletion period	Box settings for 5 minutes; answers (only via reactive.chat) for 10 minutes; at the latest when the tab is closed
Conversation history	Only in the memory of the open page; gone on reload or change of area.
Recipients	None.

A.6 Monthly figures per website

Field	Entry
Purpose	Quota and billing of answers per month, warning at 80 % and at 100 %.
Data	Website identifier, month, number of answers. No personal reference to visitors.
Where	Table `sa_kontingent`.
Deletion period	Monthly figures per website: 400 days after the last change; immediately with the website

A.7 Question analysis and rating

Field	Entry
Purpose	Show the customer which questions are asked and which remain without a supported answer, so that it can improve its content.
Precondition	Express opt-in by the customer per website, Pro plan or higher, and "Allow answer cache" switched on. Default: off.
Data	Question masked (email addresses, including in obfuscated notation, telephone numbers, IBAN-like sequences of digits, links and numbers of six or more digits are made unrecognisable before storage), calendar day without time of day, language, result, addresses of the sources cited, duration, a random identifier of the answer, a hash of the normalised masked question as grouping key and – voluntarily – the rating "helpful" or "not helpful". For the rating, the browser sends only a random identifier of the answer and the choice.
Not stored	IP address, browser identifiers, answer text, address of the page on which the question was asked, conversation history.
Grouping	Every night from 02:00 UTC, the indexer forms groups of similar questions. For this purpose, the masked questions are embedded on our own AI servers; the vectors live only in memory. Groups (`ae_fragen_gruppen`) and assignments (`ae_fragen_zuordnung`) are stored.
Customer sees	Only groups of 2 or more questions; never an individual question.
Where	Tables `ae_fragen`, `ae_fragen_gruppen`, `ae_fragen_zuordnung`.
Deletion period	Question analysis entries: 90 days from the calendar day, hourly clean-up run; immediately with the website or at the customer's push of a button
Groups of a run	are replaced as soon as a newer run is available, and are dropped after one week at the latest.
Recipients, third country	None; only if the customer switches on the knowledge gap report are group texts sent by email to the USA (A.8).
Legal basis (determined by the controller)	Typically Art. 6(1)(f) GDPR (improvement of its own content); template for the customer's privacy policy: Template.

A.8 Knowledge gap report by email

Field	Entry
Purpose	Send the customer the most frequent open questions of the previous month on a monthly basis.
Precondition	Opt-in per website in the "Questions" tab, only with question analysis running (A.7). Unsubscribe possible via a signed link in each email without logging in.
Data	Name or domain of the website, monthly total, for each of up to ten groups the text of the group (one masked question as a representative), count and rate. Only groups of 2 or more questions. In the header, the recipient's company logo, retrieved via a signed link from answely.com.
Recipients, third country	Owner of the workspace, in their language. Sent via the outbox (B.9) and the email provider Namecheap Private Email (Namecheap, Inc., USA) as a sub-processor. Third country: USA, basis EU standard contractual clauses in Namecheap's Data Processing Addendum (Art. 46(2)(c) GDPR).
Frequency	No more than one email per website per month, run on the 1st to 3rd of the month at 06:00 UTC; a month without questions sends nothing.
Deletion period	The copy in the outbox: 30 days
Note	The masked group texts thereby leave the database and are held in the customer's mailbox. The masking does not cover names and descriptions in words (DPIA, R2).

A.9 Index of the customer's public pages

Field	Entry
Purpose	The basis from which answers are generated.
Data subjects	Persons named on the customer's public pages (such as contact persons, authors, team members).
Precondition	Domain verification by the customer (home page, DNS record or file `/.well-known/answely.txt`). If it fails for 14 days, the box is switched off.
Retrieval	Only publicly accessible pages of the verified hosts, only via GET, without cookies and access credentials, respecting `robots.txt`, `noindex`, excluded paths and `data-answely-ignore`; no internal or reserved networks, not even after a redirect. Crawler identifier: AnswelyBot.
PDF and OCR	PDFs are converted to text locally. If a PDF contains no extractable text and the customer has switched on OCR, it is recognised locally with Poppler and Tesseract – in a private temporary folder that is deleted afterwards, with time, page and resource limits. No external OCR interface.
Data	Address, title, text, sections and vectors calculated from them (with an embedding model of our own, likewise self-hosted), time of retrieval, technical attributes (ETag, checksum), source type (retrieval, push).
Where	Tables `ae_dokumente`, `ae_abschnitte`, `ae_indexstand`, `ae_indexlauf`; vectors additionally as a cache in the memory of the answer service.
Embedding	Sections are embedded on our own AI servers (job exchange as in A.1).
Deletion period	Pages that disappear or switch to `noindex` drop out at the next run. When the website or the account is deleted, the index is removed within 24 hours; a queue (`ae_loeschungen`) catches up and reports an error after twelve hours. For copies, see A.11 and B.16.
Recipients, third country	None.

A.10 Push interface and WordPress synchronisation

Field	Entry
Purpose	Add content to or remove content from the index without retrieval (from the Pro plan).
Data	Texts sent by the customer with an address on a verified host, title, deletion requests.
Route	Token per website, stored only as a SHA-256 hash; throttling per website; receipt in `ae_push_eingang`, processing by the indexer, thereafter as in A.9.
WordPress plugin	Express opt-in in the plugin; transfers only published, public posts and pages, changes, permalink changes and withdrawals; no execution of shortcodes; the token is held only in the `wp-config.php` of the WordPress installation, never in options, the interface or the browser. Answely sees the content and the technical request from the WordPress server, no visitor IP.
Customer's obligation	The customer imports only content that it is permitted to have answered publicly, and no special categories of personal data (Terms of Use and DPA; DPIA R6). Non-public content belongs exclusively in protected knowledge areas (A.18), once these have been released.
Deletion period	Receipt: deleted after processing, otherwise with the website. Content: as in A.9.

A.11 Index approval: candidate and previous index

Field	Entry
Purpose	Publish a new index only when it is complete and has passed the answer tests (A.12); enable a rollback to the previous version.
Precondition	"Index approval" extension switched on per website, at least one positive test question.
Data	Up to two further copies of the website's public pages, sections and vectors: the candidate and the previous version. They are held under internal keys derived from the site key in the same tables as A.9 and cannot be queried publicly.
Deletion period	Candidate: until the next run. Previous version: until the next successful approval or until the website is deleted – no separate time limit. Removed pages, `noindex` pages and push deletions are propagated to both copies and do not wait for tests.
Approval reports	Technical status in Redis without question and answer texts, no more than 30 days.
Recipients, third country	None.

A.12 Answer tests

Field	Entry
Purpose	Using up to ten test questions of the customer, detect whether a new index or a new setting degrades answers.
Data	Test questions with expected keywords, sources or expected refusal (part of the website's configuration and of the account export). During a run, real answers are generated in memory.
Report	Case numbers, test results, run times, index version and checksums, no question or answer texts; current report and one predecessor.
Deletion period	Test questions until the website is changed or deleted. Reports no more than 30 days from the last run, immediately with the website.
Note to customers	Use public test cases without personal or confidential information.

A.13 Areas, follow-up questions, rule adviser, action and support links

Field	Entry
Purpose	Limit the search to product or documentation areas (up to ten), clarify ambiguous questions with a fixed follow-up question, lead to an approved recommendation via predefined multiple-choice questions, show up to three approved links after a supported answer, refer to support where no answer is found.
Data	Customer's configuration (public). For the visitor: selected area and selection, only in the memory of the box and of the current request.
Copy function	On an express click, the browser copies the question, history and sources to the visitor's clipboard. No transmission to Answely or to the support target; Answely appends nothing to target addresses.
Limit	Areas are not access controls for confidential content. Follow-up questions and the rule adviser do not call a model and do not count against the quota.
Recipients	Only the visitor's click opens a target of the customer; the operator of that target is responsible for the processing there.
Deletion period	No storage at the visitor's end beyond the page.

A.14 Evidence preview and deep search

Field	Entry
Purpose	Show the sections on which an answer is based; search more thoroughly at the visitor's express request.
Data	Public index content and time of retrieval. Deep search: no more than eight extracts, each of 4 000 and together 16 000 characters, same website and same area, no more than one additional model call.
Stored	Nothing additional.

A.15 Success and A/B comparison

Field	Entry
Purpose	Measure whether answers help ("solved" or "not solved", answers displayed, goals reported by the customer) and compare two presentations (A: source links, B: evidence preview).
Precondition	Opt-in by the customer per website; the consent rules of the box also apply to these reports, and a withdrawal prevents further reports.
Data	One signed token per answer with a random answer identifier, comparison group, website, expiry time and configuration fingerprint. The browser holds it only in memory. No questions, answers, page addresses, no visitor identifier, no cookies.
Where	Redis: identifiers for excluding duplicate reports and daily totals per group.
Deletion period	Token valid for no more than 24 hours. Redis entries expire after 30 days.
Customer sees	Only group totals over the last 30 calendar days.

A.16 Live API data

Field	Entry
Purpose	Include a current value (such as opening hours, stock level, status) from a public interface of the customer in the answer.
Data in the request	No visitor data: Answely retrieves a fixed, stored public HTTPS JSON endpoint on a verified host – without the question, without the visitor's IP address or identifier, without access credentials and parameters. No more than two sources, no more than two seconds and 64 KiB per request, public target addresses only.
Recipients	The operator of the endpoint (as a rule the customer itself) sees the technical request from the Answely server.
Stored	No separate cache; value, unit, source and time of retrieval go only into the current answer.

A.17 Public MCP search access

Field	Entry
Purpose	Offer AI clients (such as development environments) a pure text search in the customer's public documentation.
Precondition	Expressly switched on per verified website; default off. Switched off as soon as protected knowledge areas are active.
Data	Search term (no more than 300 characters) and optionally an area; response: no more than five extracts from the public index. No AI computation, no write operations.
Stored	Not as question analysis, not in the answer cache. The protection against misuse from A.4 applies for rate limiting; the web server log remains (B.1).
Recipients	Anyone who knows the access; it is public. Processing in the AI client is that client's responsibility.

A.18 Protected knowledge areas (prepared, not released)

Field	Entry
Status	Prepared and tested in the code; no identity provider connected yet, no confidential customer documents activated. Intended for a later release.
Purpose	Answers from documents that only certain user groups of the customer are permitted to see.
Data	Access token of the customer's host application (JWT RS256 under RFC 9068) with user identifier, client, token identifier and groups.
Processing	Only local verification of signature, time, issuer and audience against fixed, stored public keys; no retrieval of keys or user data from third parties. The contents of the token are not stored and are not given to the language model; the model receives only the question and the permitted sections.
No cache	Answers from protected areas are not cached either on the server or in the browser.
Limit	A protected collection cannot be switched back to public; a new website is intended for that purpose. The protected documents themselves are held in the index (A.9, A.11) with the same retention periods and without additional encryption.

A.19 Customer tools involving customer content

Field	Entry
Answer diagnostics	Private jobs from the account show retrieval, selection, supporting evidence and reasons for refusal for a question of the customer. Results only in the memory of the answer service, no more than two running and 32 retained jobs, abort after 15 minutes of run time and deletion 15 minutes after completion; no storage in the database, Redis or logs; deleting the website ends running jobs.
Answer comparison	The active and new index or two configurations are compared using real answers; as with diagnostics, content only in memory.
Agency templates	Approved design and answer fields and the search glossary can be transferred to other websites of the same workspace; preview for no more than 25 minutes in the account app session, signed approval token ten minutes. No transfer of permissions, tokens or connections.
Documentation copilot	From a content gap, a draft is created from up to five existing passages together with sources; the draft exists only in the response and in the browser, without server-side storage, and is never published automatically.
Search glossary, validity and priority of sources	Configuration of the website; no personal reference to visitors.
Data subjects	Indirectly, persons in the customer's content.

A.20 Sites from reactive.chat (engine `reactivechat`)

Field	Entry
Purpose	Every reactive.chat customer receives Smart Answers (Answely) in addition; answers come from the reactive.chat knowledge base.
Data	Question, visitor address (only with the chat server's proxy key) and the visitor identifier of the reactive.chat widget for handover to the chat. With "Allow answer cache" off, additionally a signed history (question of no more than 300 characters, answer, up to three sources, website, visitor identifier), valid for 24 hours, held only in the browser's working memory.
Recipients	reactive.chat, same legal entity, with its own AI infrastructure. The engine is permitted only for these sites, never for Answely customers.
Storage	In accordance with the rules of reactive.chat; ephemeral mode extends through to the chat server until the visitor sends a follow-up question in the chat: reactive.chat then takes over the question, answer and sources from the signed history once into the stored chat history as the beginning of the conversation; the box points this out beforehand. If the visitor has deleted their data at reactive.chat or the history can no longer be used, the follow-up question starts a new conversation without this history. If "Allow answer cache" is on, there is no signed history: reactive.chat already keeps the search question and answer as a conversation under its rules, and the follow-up question continues it.
Legal basis	Contracts between reactive.chat and its customer; the privacy policy and DPA of reactive.chat expressly name this processing (Smart Answer).

4. Part A – Recipients, sub-processors and third-country transfers

4.1 Infrastructure: no hosting provider

Answely runs on the legal entity's own hardware in Łódź, Poland. The web server (nginx as a switch in front of Apache with PHP-FPM), account app, answer service, indexer, MariaDB and Redis run on our own server behind our own router; Answely connects to the database and Redis only via the local loopback; Answely's database users are permitted only locally. The database server and Redis additionally listen on the server's address in the internal network because other services of the same operator use them; there, the server's firewall lets only one of the AI machines through to the database and nobody through to Redis. The language models are our own AI, self-hosted on our own hardware, and run on two own servers in the internal network in Łódź, with a language model reduced by a third party at a pinned revision; if one is busy or fails, the other takes over. A third machine of our own does not formulate answers; it handles background work such as the embeddings during index runs and the nightly grouping. The embedding runs with an embedding model of our own, likewise self-hosted, on own machines in this network. The servers are shared with other products of the operator; the image component of the model software is switched on, but Answely sends text only. These machines accept no connections: workers on them collect jobs via a signed long poll and return results. A reranker is currently switched off. There is therefore no hosting provider and no AI provider acting as a sub-processor for operations.

4.2 Sub-processors that may receive data from Part A

Sub-processor	Purpose	Location	Safeguard	Data from Part A
Google Ireland Ltd. (Google Cloud Storage)	Off-site backup copy, encrypted on our own server before transfer, of all databases and web directories of the server	Bucket in europe-central2 (Warsaw), Standard storage class, not public	Google Cloud data processing terms as accepted for the cloud project (business account)	Everything held in the databases: index, question analysis, counters, monthly figures, push receipt, configuration – only as encrypted blocks; file and directory names also encrypted; key held only by the operator
Namecheap, Inc., Phoenix, Arizona, USA (Namecheap Private Email)	Sending of emails to customers, receipt of incoming emails to @answely.com	USA	Namecheap's Data Processing Addendum with EU standard contractual clauses (Art. 46(2)(c) GDPR), accepted on 01.08.2026	Above all the knowledge gap report (A.8): masked group texts and company logo; in addition, emails relating to a site and support emails into which the customer itself inserts content

Stripe never receives data from Part A (see B.7).

4.3 Not sub-processors – with reasons

Our own AI servers: our own hardware of the same legal entity, no third party.
reactive.chat: same legal entity; only for sites from reactive.chat (A.20).
consented.eu: our own product of the same legal entity; only recognised by the answer box, not called. If a customer uses consented.eu on its own website, that is its contract with consented.eu; Answely then only reads the signal in the browser and sends nothing to consented.eu.
Let's Encrypt: issues TLS certificates and sees only domain names.
Namecheap as registrar: registration of answely.com and authoritative DNS; only the operator's domain data. (Namecheap Private Email is listed in 4.2 because of the emails.)
GeoIP: the country is determined from a local database file, no geolocation service.
Telegram: only if set up; an internal signal with fixed text without personal data (such as "a component is not responding").

4.4 Prepared, not active: EU fallback provider for the language model

A worker for Scaleway Generative APIs (Paris) has been technically prepared for load peaks and outages. It is not active (the switch eu_freigegeben is set to false); there is no access and no contract. Embeddings would remain on our own server even then. The answer service only starts with AI endpoints that are on an allowlist of endpoints in the EU. A further AI provider will only be used if it processes in the EU, has a data processing agreement with the commitments "no training" and "no storage beyond the processing", is included in the list of sub-processors, and customers have been informed 30 days in advance, with a right to object. Providers outside the EU are excluded. Note from the review of 09.10.2026: Scaleway's data protection information provides for storage of complete HTTP content for up to two weeks for error and abuse analysis; in its current form, this does not meet the commitment "no storage beyond the processing" and must be clarified contractually before any activation.

4.5 Recipients switched on by the customer itself

Live API target (A.16): sees the technical request from the Answely server, no visitor data.
Action and support targets (A.13): receive only what the visitor enters there themselves after their click.
AI clients at the MCP access (A.17): receive extracts from the public index.
Customer's identity provider (A.18): is not called by Answely.

4.6 Third-country transfers in Part A

One: emails to customers are routed via Namecheap Private Email (Namecheap, Inc., USA), on the basis of the EU standard contractual clauses in Namecheap's Data Processing Addendum (Art. 46(2)(c) GDPR). The data from Part A involved are above all the masked group texts of the knowledge gap report (A.8), only if the customer switches it on. Otherwise, questions and answers from the answer box (A.1 to A.7) do not leave the EU; AI processing runs exclusively on servers in the EU. The AI servers are located in Poland, and the off-site backup copy is held in encrypted form in Warsaw. Google Ireland Ltd. is a subsidiary of a US group; any access from there would encounter only encrypted blocks whose key Google does not have.

5. Part B – Art. 30(1): processing under our own responsibility

In all cases the controller is LW IT Solutions Company Lukas Wójcik. Unless otherwise stated, the storage location is our own server in Łódź; each database is additionally held in the backup copies (B.16).

B.1 Web server access log (answely.com, api, cdn)

Field	Entry
Purpose	Operation, troubleshooting, security.
Data subjects	Visitors to answely.com, customers, visitors to customer websites (requests for `answely.js` and the API), users of the MCP access.
Data	Truncated IP address (IPv4 without the last octet, IPv6 to /48), time, method, path without parameters, protocol, status, size, duration, host requested. No browser, no referring page, never question or answer. The web server's error logs contain no client address.
Deletion period	Access log: 7 days (daily rotation, older logs are deleted)
Legal basis	Art. 6(1)(f) GDPR.
Upstream nginx switch	Keeps no access log of its own for Answely (switched off); its error log records critical errors only and has so far been empty (development environment, 12.10.2026). The same setting applies in live operation.

B.2 Application page statistics

Field	Entry
Purpose	Improvement and securing of the offering without cookies and without third-party services.
Data subjects	Visitors to answely.com, logged-in customers.
Data	Truncated IP address (since 07.10.2026; legacy data truncated once), country (determined before truncation), address visited including any parameters, full referring page, browser identifier (user agent) and the browser, device and operating system derived from it, language, for logged-in users the account number.
Where	Table `access_logs` of the account app.
Deletion period	Page statistics: 60 days, daily clean-up run
Legal basis	Art. 6(1)(f) GDPR.

B.3 Consent banner on answely.com

Field	Entry
Purpose	Obtain and evidence consents for non-essential services on answely.com.
Technology	The consented.eu banner (our own product of the same legal entity) is loaded only if a valid property identifier is configured; the loader precedes every other script and can block patterns until consent is given.
Data, cookies, period	Cookie `consented` with the decision in the browser, 12 months; briefly a probe cookie `__ce_probe`, deleted immediately. Record at consented.eu: random consent identifier, selection, banner version, time, hash of the IP address, language, country and region, browser family, mobile device yes/no, domain, hash of the page address, time taken to decide; deleted after 36 months. In live operation, the property for answely.com is published at consented.eu and the banner is delivered.
Application cookies	`bpid` (session) and, only with "Keep me signed in", `bp_remember` for no more than 30 days.
Legal basis	Art. 6(1)(c) GDPR (obligation to provide evidence) or point (f).

B.4 Customer account, workspaces and company logo

Field	Entry
Purpose	Contract: registration, management of websites, team collaboration.
Data subjects	Customers (businesses and consumers), members of workspaces, invited persons.
Data	Email address, first and last name, customer type, country, for businesses company name and address, VAT ID, password only as a hash, language, plan and scheduled plan change, settings, two-factor secret (if set up), time and IP address (not truncated) of the last login, result of the VIES check (B.8). Until the email address is confirmed, the destination within answely.com passed on at registration (such as the checkout of a selected plan); it is deleted upon confirmation or after the confirmation link has expired. Workspaces with members and roles; invitations with email address. Company logo: re-encoded, stored outside the application directory.
Where	Tables `users`, `workspaces`, `workspace_users`, `workspace_invites`, `sites` of the account app; logos in the data directory outside the application tree.
Recipients	Members of the same workspace; Stripe for billing (B.7).
Deletion period	Until the account is deleted, then immediately; the logo is deleted together with the account or when replaced. Invitations not accepted: after their expiry; accepted ones remain until the workspace is deleted (section 6.5). Workspaces with further members pass on deletion to another member – preferably to the longest-standing admin of the workspace, otherwise to the longest-standing member.
Legal basis	Art. 6(1)(b) GDPR.

B.5 Login, sessions, login attempts, two-factor authentication

Field	Entry
Purpose	Account security, displaying and ending sessions.
Data	Per session IP address (not truncated), browser, operating system, device, timestamps, termination; marker for "Keep me signed in" (`remember_tokens`, only as a hash); login attempts with IP address, email address entered and success; a successful login deletes the failed login attempts from the same IP address. Registration attempts with IP address, without email address, in a separate window that a login does not lift. Limiting of login and two-factor attempts per account and per IP address (`auth_attempt_buckets`): only HMAC keys, counter value and expiry time, no email or IP address in plain text.
Where	`login_sessions`, `remember_tokens`, `login_attempts`, `auth_attempt_buckets`.
Deletion period	Login attempts (including registration attempts): 7 days. Limiting entries: after their window has expired (default 15 minutes). Expired markers: daily. Sessions: ended ones 30 days after they end, ones no longer in use 30 days after their last use (section 6.1), otherwise until the account is deleted.
Legal basis	Art. 6(1)(b) and (f) GDPR.

B.6 Records of consent, confirmation of immediate commencement, withdrawals

Field	Entry
Purpose	Evidence of which version of the Terms of Use, Data Processing Agreement, privacy policy and withdrawal notice was agreed to; for consumers, confirmation of immediate commencement, conclusion of the contract and withdrawal via the withdrawal function.
Data	Document, version, occasion, wording, time, IP address, browser; for a withdrawal, time and subscription.
Where	`legal_consents`, `widerrufe`.
Deletion period	As long as the account exists; after deletion of the account, as soon as the record is older than 4 years, i.e. at the latest 4 years after deletion of the account (daily clean-up run).
Legal basis	Art. 6(1)(c) and (f) GDPR.

B.7 Billing, invoices and add-on packages

Field	Entry
Purpose	Contract and tax obligations.
Data	Stripe customer number, plan, billing period; for each invoice number, type, status, amounts, tax status according to Stripe Tax, reverse charge, VAT ID and country as on the invoice, links to the invoice at Stripe; add-on packages of 1 000 answers each with status. Payment data (card, bank account) exist only at Stripe.
Where	`rechnungen`, `ae_pakete`, `stripe_events` (only event identifier, type, status, error text).
Recipients	Stripe Payments Europe, Ltd., Dublin – payments, invoices, Stripe Tax, customer portal. Payment methods card and SEPA direct debit, where applicable BLIK and Przelewy24. Where required by law, invoices to businesses in Poland: National e-Invoicing System (KSeF) of the Ministry of Finance (Ministerstwo Finansów), transmitted via an extension of our payment service provider or manually.
Third country	Stripe Payments Europe may transfer to Stripe, Inc. (USA): EU-US Data Privacy Framework, in the alternative standard contractual clauses. Customer data only, never visitor data.
Deletion period	Invoices: 5 years from the end of the calendar year in which they were created (Art. 86 in conjunction with Art. 70 Ordynacja podatkowa), then deleted in the daily clean-up run, even if the account still exists; upon deletion of the account, the link to the account is removed. Stripe payment events: after 90 days, except those still being processed. Packages: until deletion of the account; checkouts never completed are deemed abandoned after two days and are deleted after 90 days.
Legal basis	Art. 6(1)(b) and (c) GDPR.

B.8 Verification of the VAT ID via VIES

Field	Entry
Purpose	Evidence for VAT-exempt invoices under the reverse charge procedure.
Data	Country and number, our own VAT ID as the requester; result, name and address according to VIES, query number, time (columns in `users`).
Recipients	European Commission (VIES) – independent controller, not a processor.
Deletion period	As long as the account exists.
Legal basis	Art. 6(1)(c) GDPR.

B.9 Transactional emails and outbox

Field	Entry
Purpose	Confirmation, password reset, invitations, index run, quota warnings, payment failure, termination, deletion confirmation, knowledge gap report.
Data	Recipient address, subject, content (contains confirmation and reset links with valid tokens).
Where	Outbox `mail_outbox`.
Recipients	Namecheap, Inc., Phoenix, Arizona, USA (Namecheap Private Email), processor. In development, emails are sent only via a local transport.
Third country	USA (Namecheap): EU standard contractual clauses in Namecheap's Data Processing Addendum (Art. 46(2)(c) GDPR), accepted on 01.08.2026.
Deletion period	Outbox: 30 days; upon deletion of the account, all emails to that address immediately
Legal basis	Art. 6(1)(b) GDPR; knowledge gap report on behalf of the customer (A.8).

B.10 Audit log and error log

Field	Entry
Purpose	Traceability of important events, security, troubleshooting.
Data	Audit log: action, target, details, IP address (not truncated), country, account. Error log: message, context, account.
Where	`audit_logs`, `error_logs`.
Deletion period	Audit log: 365 days. Error log: 90 days.
Legal basis	Art. 6(1)(f) GDPR.

B.11 Support enquiries

Field	Entry
Purpose	Answer enquiries from customers and prospective customers, including without login.
Data	Email address, reason, message, IP address (not truncated), country, browser, page from which the message was written, language, status, account number if logged in.
Where	`support_requests`.
Email	Enquiries by email to support@answely.com and replies by email are routed via Namecheap Private Email (Namecheap, Inc., USA; standard contractual clauses, see B.9).
Signal	Telegram receives only the fixed text "new support enquiry", without content or address.
Support AI	Present in the code: at the push of a button by a human in the administration area, a message can be translated or a draft reply created, on our own AI servers; only the message text, reason and page path are sent to the model, with email addresses and sequences of six or more digits redacted; nothing goes out without human review; the copy (`support_ki`) is deleted together with the enquiry. Not switched on in the development environment (no worker key set, as of 12.10.2026), nor in live operation.
Deletion period	1095 days from the last reply, without a reply from receipt, in the daily clean-up run (configurable, section 6.1); the AI drafts (`support_ki`) are deleted with the enquiry. Enquiries remain even after an account has been deleted until this period expires.
Legal basis	Art. 6(1)(b) and (f) GDPR.

B.12 Websites, domain verification and quota warnings

Field	Entry
Purpose	Management of a customer's websites as the subject matter of the contract.
Data	Domain, additional hosts, name, design, settings, extensions, verification status, opt-ins.
Where	`sites` of the account app and configuration in the answer service (`sa_sites`).
Verification	Re-checked daily at 04:00 UTC; if it fails for 14 days, the box is switched off.
Warnings	Quota at 80 % and at 100 %, checked hourly, by email.
Deletion period	Immediately with the website or the account; in the answer service within 24 hours; the record of the completed deletion (`ae_loeschungen`: site key, workspace, timestamps) remains for one further month thereafter.
Legal basis	Art. 6(1)(b) GDPR.

B.13 Public website quick check ("Check your website")

Field	Entry
Purpose	Show prospective customers without an account how readable their website is for Answely.
Data subjects	Users of the form; persons on the public pages retrieved.
Data	HTTPS address entered, optionally a sample question; HMAC identifier derived from the IP address for rate limiting. Retrieval of no more than three public HTML pages, four sections each, respecting `robots.txt` and `noindex`, without access credentials, no internal networks.
Stored	Nothing permanently: the sample lives only in memory, no storage as index, question analysis or cache. The answer service keeps the result (checked addresses, sample answer, sources) in memory for no more than 2 minutes after completion; it can be retrieved only with an HMAC identifier derived from a random value in the session (`bpid`) of the browser that started the check. Rate-limiting data no more than 2 minutes (one check per sender per minute, three in total per minute). Access log and page statistics (B.1, B.2) remain.
Gap	None open. The former fixed fallback key for the HMAC identifier has been removed; if the application secret is missing or shorter than 16 characters, the account app refuses the quick check (as of 16.10.2026).
Legal basis	Art. 6(1)(b) GDPR (pre-contractual request) or point (f).

B.14 Live demo in the developer documentation

Field	Entry
Purpose	Demonstrate Answely on our own documentation (`/docs`). The demo on the home page is a mock-up without any request to the answer service.
Data	As A.1, but in our own name for our own website.
Default	Demo website with "Allow answer cache" off and without question analysis.
Legal basis	Art. 6(1)(f) GDPR.

B.15 Data export and account deletion

Field	Entry
Purpose	Data subject rights (Art. 15, 17, 20) via self-service.
Export	All data of the account as JSON or CSV, via an allowlist of tables and fields, including websites, configuration, test questions and question analysis; the number of exports per hour is limited.
Deletion	Immediately: account, sessions, markers, packages, emails to that address, workspaces without further members together with their websites; invoices lose their link to the account. In the answer service within 24 hours: index including copies, question analysis, monthly figures, push receipt, reports.
Remains	Counters without content of the websites, which are not deleted early but expire after 7 days (A.3); invoices, records of consent and withdrawals (B.6, B.7); backup copies until they expire (B.16).

B.16 Database backups and off-site encrypted copies

Field	Entry
Purpose	Availability and restoration after an outage or error (Art. 32(1)(c)). No other use.
Data	All databases (account app and answer service) and files, i.e. everything from Part A and Part B including company logos.
Tier 1 – on the server	Nightly at 03:00 UTC, a verified dump of each Answely database; on Sundays a restoration test into a disposable database. Not encrypted, on the same server.
Period tier 1	Database backups on the server: 30 days, cleaned up only after a good new backup
Tier 2 – off-site	Nightly, a copy of all databases of the server and of the entire web directory, encrypted before transfer (rclone crypt, including file and directory names), into a non-public bucket at Google Cloud Storage in Warsaw. Key held only by the operator.
Period tier 2	Off-site copies: daily copies 7 days, weekly copies 364 days.
Preliminary stage of the off-site copy	Before encryption, an unencrypted daily copy consisting of dumps of all databases on the server and a file copy of /var/www including configuration files is created nightly on a local USB drive attached to the server in Łódź; it remains there for no more than 8 days and is then deleted.
Consequence	Deleted data disappear from the live system immediately or within 24 hours, and from the copies only when they expire. In the event of a restoration, data deleted in the meantime are deleted again; for this purpose, the account app reconciles daily any websites in the answer service that it no longer knows. There is no separate technical procedure for this for accounts and the question analysis; they are deleted again to the extent they can be identified.
Legal basis	Art. 6(1)(f) GDPR; for data from Part A within the framework of the DPA (Art. 28(3)(c), Art. 32).

B.17 Monitoring and alerting

Field	Entry
Purpose	Detect outages.
Data	Status of components, response times, daily status (`system_status_logs`, `system_components`); no content, no visitor data.
Recipients	Entry in the Urgent Logs of the administration area, open until ticked off; Telegram only with fixed text without details.
Deletion period	Status rows 400 days.
Limits	A pending deletion that has not been carried out after 12 hours only creates an entry in the operator's error log, not an active alert. A heartbeat to an external service is not set up; the monitoring cannot itself report a total failure of the server. The website and indexer components are switched on in production, not in the development environment.

B.18 formconfirmed form protection (public forms of answely.com)

Field	Entry
Purpose	Protect sign-in, registration, "Forgot password?", "Choose a new password", the support form and the quick check against automated submissions.
Technology	A product of formexposed belonging to the same legal entity, on the same server in Łódź. The script from formconfirmed.com loads only on pages with one of these forms (support: when opened); the browser solves a signed task (proof of work); answely.com presents the token together with the IP address, the trap field, the email address (only for registration, "Forgot password?" and support), for registration the first and last name (in memory only at formconfirmed) and, for support, the message text for checking (`cfg/formconfirmed_lib.php`). Task bound to the form purpose (`expected_purpose`). Time limit 5 s; outage rule of 02.11.2026: unreachable, unclear response or unconfirmed token = reject with "try again", no silent acceptance; "flag" is not an approval.
Data	Token (task, result of the calculation, points in time, trap, browser signals webdriver and real input), IP address, page address, browser identifier, email address, message text; never the password.
Recipients	None outside the legal entity. Rejected or flagged submissions are recorded in the error log (B.10) without the token and without the IP address.
Deletion period	At formconfirmed: hash of the truncated address range with a daily key with the check result at most 1 hour, with the used token about 11 minutes, in the task counter about 1 hour; check results without the hash 30 days; result for the email domain at most 7 days, the address never in plain text; text in memory only (language model on our own AI computers in the EU, without storage or training); campaign detection fingerprints (text, email address, link domains; HMAC, irreversible) 30 days, compared across websites under the own responsibility of the operator of formconfirmed (the same legal entity, Art. 6(1)(f) GDPR); web server log of formconfirmed.com 14 days.
Receipts and state information	Rate limit for "Forgot password?" 3 per hour and 10 per day per address (`auth_attempt_buckets`, HMAC, until the window ends). Receipt per submission (`fc_handler_receipts`: hash of purpose, session attribute, random operation number and email address, state, time) 7 days. Identifier of the formconfirmed check with state and link to the email (`fc_ops_queue`, `fc_ops_mail`) 30 days; only identifier and state can be reported to formconfirmed, signed (`cfg/fc_ops_client.php`, reporting run currently on dev only). Identifier of the check for registration and support request (`fc_rueckmeldungen`) 30 days; feedback to `/v1/feedback` only with identifier and "spam"/"not spam": email confirmed = not spam (automatic), request answered = not spam, request deleted as spam = spam (manual).
Legal basis	Art. 6(1)(f) GDPR (protecting accounts, the support channel and the quick check); in the browser strictly necessary (§ 25(2) no. 2 TDDDG), therefore not via the consent banner.
Limits	Submissions rated "block" are rejected. For "flag", the form requests the second step of formconfirmed (confirm button, new, more demanding task); the submission is accepted only if the repeated check results in "allow", a second "flag" is rejected. reCAPTCHA is not a second check on suspicion; only during a disruption of formconfirmed (unreachable, own configuration, service_unavailable) does a strict Google reCAPTCHA v3 (score at least 0.7) allow the next submission – reCAPTCHA is only loaded then (privacy policy 3.8); people can also be turned away, for example via a VPN or data-centre networks. In the administration area this can be switched to "block only".

6. Retention – what the clean-up runs cover and what they do not

At Answely, retention periods arise in four ways: through the daily clean-up run of the account app, through the hourly clean-up run of the answer service, through the expiry date of entries in Redis or in memory, and through the deletion of a website or an account. Whatever none of these ways covers remains – this is set out in 6.5.

6.1 Daily clean-up run of the account app (03:00 UTC)

A single function contains all retention periods of the account app; a test bench verifies each period using backdated rows.

Table	Content	Period
`access_logs`	page statistics	60 days, configurable
`audit_logs`	audit log	365 days, configurable
`error_logs`	error log	90 days, configurable
`mail_outbox`	outbox	30 days, configurable
`login_attempts`	login attempts	7 days, fixed
`auth_attempt_buckets`	limiting of login and two-factor attempts (pseudonymised)	end of the window, default 15 minutes
`fc_handler_receipts`, `fc_ops_queue`, `fc_ops_mail`	Receipts and state information of the form protection (B.18)	receipts 7 days (additionally hourly), state information 30 days
`remember_tokens`	"Keep me signed in" markers	after expiry
`workspace_invites`	invitations not accepted	after expiry
`system_status_logs`	daily status of components	400 days
`legal_consents`, `widerrufe`	records of deleted accounts	at the latest 4 years after deletion
`ae_pakete`	abandoned checkouts	after 90 days
`support_requests`, `support_ki`	support enquiries including AI drafts	1095 days from the last reply (without a reply, from receipt), configurable
`login_sessions`	ended sessions or sessions no longer in use	30 days after they end or were last used
`rechnungen`	invoices, including those of existing accounts	5 years from the end of the calendar year in which they were created
`stripe_events`	Stripe payment events, except those still being processed	after 90 days

Configurable means: the operator sets the value in the administration area; the legal texts automatically show the value set. A value below one switches off deletion for that table – this is an operating pitfall that has so far been guarded against only by diligence. The default values in the code (page statistics 60, audit log 365, error log 90, outbox 30, support enquiries 1095, backup 14) apply as long as nothing has been set.

In the same status run: the deletion queue for websites (every five minutes, error after twelve hours, completed entries kept for one month as evidence), the daily reconciliation of orphaned websites in the answer service, the re-checking of domain verifications and the knowledge gap report.

6.2 Hourly clean-up run of the answer service

Table	Content	Period
`sa_zaehler`	counters without content	7 days
`sa_kontingent`	monthly figures per website	400 days after last change
`ae_fragen`	question analysis entries	90 days from the calendar day
`ae_fragen_gruppen`, `ae_fragen_zuordnung`	groups and assignments	after one week without a newer run

6.3 Retention periods through expiry in Redis and in memory

Location	Content	Period
Redis	answer cache (only "Allow answer cache")	24 hours
Redis	misuse protection hash	2 minutes
Redis	random value of the throttle	2 days
Redis	approval reports of index approval	30 days
Redis	answer test reports	30 days
Redis	success and A/B: identifiers and daily totals	30 days
Redis	indexer locks and queue	until completed
Memory	job exchange of the AI workers	until completed or timeout
Memory	diagnostics and answer comparison	15 minutes after completion
Memory	quick check sample; quick check result	end of the check; result no more than 2 minutes after completion
Memory	vectors of the question analysis grouping	end of the run
Browser	only with "Allow answer cache": box settings and answers	5 and 10 minutes respectively

6.4 Deletion together with a website or an account

Deleting a website in the account app calls the answer service. There, the following are removed in a single operation: configuration, monthly figures, question analysis with groups, documents and sections of all three index versions (active, candidate, previous), index runs, push receipt, reports of the answer tests and of index approval; running diagnostics are ended. If the service does not accept the deletion immediately, it is placed in the queue; the target is deletion within 24 hours, and an error is reported after twelve hours. Deleting an account triggers the same for every website of its workspaces without further members.

The counters without content (A.3) are not deleted with the website; they expire after 7 days in the hourly clean-up run.

6.5 Not covered – data without a time limit

The following data are not covered by any clean-up run. They remain until the account or the website is deleted, or beyond.

Data	Table	What actually happens	Assessment
Accepted invitations with email address	`workspace_invites`	No run; deleted only with the workspace.	minor, add a period
Last login with full IP address	`users`	Overwritten at every login; remains until the account is deleted.	acceptable, last value only
Records of live accounts	`legal_consents`, `widerrufe`	Remain as long as the account exists.	intended
Result of the VIES check	`users`	Remains as long as the account exists.	intended
Configuration and test questions	`sites`, `sa_sites`	Until the website is deleted.	intended
Index and copies	`ae_dokumente`, `ae_abschnitte`, `ae_indexstand`, `ae_indexlauf`	Until the website is deleted; the previous index until the next approval.	intended, but without an upper time limit (DPIA R13)
Content of legal texts, blog, CMS	`cms_pages`, `blog_posts`, `legal_versions`	Indefinite.	no personal data of third parties
Deployment log	`deploy_runs`	Indefinite.	operator only
Template leftovers	`objects`, `demo_rows`	Not used by Answely and empty (12.10.2026); `objects` is deleted with the workspace.	no data

6.6 Backup copies – the long tail

The retention periods in 6.1 to 6.4 apply to the live system. Each database is additionally held in the dumps on the server (30 days, unencrypted), as an unencrypted daily dump on a USB drive at the server (no more than 8 days) and in the off-site, encrypted copies in Warsaw (daily copies 7 days, weekly copies 364 days). Data deleted in the live system continue to exist there until the respective copy expires – in the worst case for just under a year. During this time they are neither used nor read; only a restoration would bring them back, and in that case deletions made in the meantime must be repeated. All deletion commitments in our legal texts therefore refer to the live system; the backup copies are expressly excluded.

7. Automated decision-making, profiling and evaluation

Answely makes no decisions within the meaning of Art. 22 GDPR, neither in relation to visitors nor in relation to customers.

Answers: the box answers questions; it decides nothing about the visitor. Whether an answer is shown depends solely on the strength of the supporting evidence in the index, not on the person.
No profiles: no visitor identifier, no cookies, no linking across pages or days. The question analysis groups questions, not persons. Success and A/B compare groups of answers; the comparison group is assigned randomly per box and lives only in the page's memory.
Throttling and overload: too many requests from one address or too much load lead to HTTP 429 – the box asks the visitor to wait a moment and accepts questions again only after the waiting time, while the customer's search remains. This is a technical limitation without legal effect.
Form protection: formconfirmed assesses individual submissions to public forms (B.18). If the result is "block" or "flag", only this submission is rejected; it can be repeated or sent by email to support@answely.com. This is a technical safeguard without legal effect; no profile of persons is created, and the reputation relates to a truncated address range under a daily pseudonym.
Domain verification and quota: if verification fails for 14 days or the quota is exhausted, the box on the website concerned is switched off. This concerns the contract with the customer; the customer is warned in advance and can intervene at any time.
Labelling: every answer is labelled as AI-generated (Art. 50 AI Act). Details: AI Act.

8. Technical and organisational measures (Art. 32) – general description

The full description is provided in the TOM. In summary:

Data protection by default: "Allow answer cache" off, question analysis off, all extensions off, MCP off; no cookies and no visitor identifier in the script; truncated IP addresses in counters, the web server log and page statistics.
No content in logs: question, answer, context and history appear in no log of the answer service, the indexer, the AI workers or the web server.
AI exclusively in the EU: the answer service only starts with AI endpoints on the allowlist; today this is exclusively our own job exchange, from which workers on our own AI servers collect jobs.
Worker principle: the AI servers accept no connections; every retrieval and every return is signed with HMAC and runs over TLS. Unregistered workers are rejected.
Access: server access via SSH, from outside with a key only, with a password only from private networks (since 16.10.2026); administration area with two-factor authentication; admin interface of the answer service only on the local loopback with a token that is compared in constant time; push tokens only as a hash.
Separation: separate databases for the account app and the answer service, a separate Redis user with a prefix per environment, an index per website, answers only from the index of the website on which the question is asked, CORS only for verified hosts; development and production separated.
Integrity of answers: obligation to provide supporting evidence, sources visible, links only https to hosts of the website, output only as text, AI labelling protected against being hidden.
Availability: nightly verified dumps with a weekly restoration test, off-site encrypted copy, monitoring with alerting (without an external heartbeat; pending deletions only in the error log, see B.17); if the AI machines fail, the box disappears and the customer's website remains usable.
Deletion: clean-up runs in accordance with section 6, each period verified by a test bench with a clock set forward; a further test bench reconciles the figures in the legal texts with the code.
Organisation: one-person operation; only the owner has access to production data. Breaches are documented and reported to customers no later than 48 hours after becoming aware of them.

8.1 Measures that demonstrably do NOT exist

A record that lists only what exists conceals what is missing and therefore still needs to be checked. The following do not exist today:

No encryption at rest on our own server: databases, Redis, logos and the dumps on the server are stored unencrypted on the storage medium. The daily copy on the USB drive at the server before transfer is also unencrypted (database dumps and a file copy of /var/www including configuration files, and therefore also application credentials; no more than 8 days). Only the off-site copy is encrypted.
No TLS between the application and the database or Redis: both run on the same machine via the local loopback; the risk is thereby limited, but not zero.
No data centre: the servers are operated in-house in closed premises in Łódź. Only the owner has access; the room is locked and under video surveillance, and no other persons have access.
AI capacity only on own hardware at one location: the answers are generated by two own AI servers in the same network at the same location, shared with other products of the operator; there is no reserve with a different language model. If both fail, there are no answers. The EU fallback provider is prepared but not active. A load test on 09.10.2026 with 480 requests per minute over 300 seconds was not passed (86.3 % of requests rejected, predominantly HTTP 429).
No log of who viewed which customer data in the administration area; the audit log records changes, not read accesses.
No upper time limit for the previous index in index approval (A.11).
No designation of a data protection officer (section 9).
No tested masking of names and descriptions in words in the question analysis; only patterns are masked (A.7).
No row counts from production operation in this record (section 1).

9. Data protection officer – assessment under Art. 37 GDPR

No data protection officer has been designated. Art. 37(1) binds controllers and processors alike; the question is therefore Answely's own.

Art. 37(1)	Test	Result
point (a)	Public authority or body	Not applicable; private sole proprietorship.
point (b)	Core activities require regular and systematic monitoring on a large scale	Not met. The core activity is answering questions from public content. There is no visitor identifier, no cookies, no linking of requests across pages or days and no profiles. Question analysis is an opt-in and stores no IP address and no identifier.
point (c)	Core activities consist of large-scale processing of special categories (Art. 9, 10)	Not met. Special categories are not processed in a targeted manner; they may happen to appear in the free text of a question (DPIA R1), but are not stored in the default mode.

Result: as things stand, there is no legal obligation to designate a data protection officer. This assessment must be made anew if Answely releases protected knowledge areas, takes on customers from the health or legal sector with question analysis, or if the number of visitors grows significantly; otherwise it is reviewed at least annually. In our assessment, there is no further obligation under Polish law (Art. 37(4)): the Polish Personal Data Protection Act of 10.05.2018 only determines which public bodies fall under Art. 37(1)(a). No external data protection advice was obtained. The approval of this assessment is recorded in the data protection impact assessment, section 10.2.

10. Known gaps

No.	Gap	Effect	Next step
L1	Support enquiries without a deletion period, with full IP address	completed 16.10.2026: deletion 1095 days after the last reply, including AI drafts (6.1)	Check the configured value in live operation
L2	Sessions without a deletion period, with full IP address	completed 16.10.2026: ended sessions and sessions no longer in use are deleted 30 days after they end or were last used (6.1)	–
L3	Invoices are not deleted after expiry of the retention obligation	completed 16.10.2026: deletion 5 years after the end of the calendar year in which they were created, even if the account still exists (6.1)	–
L4	Deleted data remain in encrypted weekly copies for up to 364 days	long residual period	disclose in all legal texts; procedure after restoration
L5	Dumps on the server and the daily copy on the USB drive (including file copy and configuration files) unencrypted; no encryption at rest	Theft of the storage medium exposes everything	Examine storage encryption
L6	Contact address for data protection	completed 11.10.2026, changed 18.10.2026: support@answely.com	incorporated into all legal texts
L7	Email provider	completed 11.10.2026: Namecheap Private Email (USA), Data Processing Addendum with standard contractual clauses, accepted on 01.08.2026	–
L8	Google Cloud contract status not documented	completed: Google Cloud data processing terms as accepted for the cloud project (4.2)	–
L9	Logging of the nginx switch	checked 12.10.2026: no access log in the development environment, error log critical only	apply the setting to live operation
L10	HMAC identifier in the quick check with fallback key if the secret is missing	completed 16.10.2026: fallback key removed, without the secret the account app refuses the quick check	Set the secret in live operation
L11	No retrieval of the list of controllers	Art. 30(2)(a) met only indirectly	Export button in the admin area
L12	Classification of reactive.chat sites not conclusively checked	completed: the privacy policy and DPA of reactive.chat name Smart Answer as a service of Answely (condition B6 of the DPIA)	–
L13	Capacity under peak load not demonstrated	Box fails under load	additional EU capacity, new load test
L14	SSH login with password permitted	completed 16.10.2026: from outside with a key only, with a password only from private networks	–
L15	Monitoring without external heartbeat; pending deletion without active alert	failure or stuck deletion goes unnoticed	set up heartbeat, alert on pending deletion
L16	Database and Redis also listen in the internal network	larger attack surface, limited only by the firewall	bind locally only, as far as other services allow

11. Maintenance of this record

Lukas Wójcik, owner, is responsible for maintaining this record.
Review at least annually and before any change to AI providers, fallback endpoints, storage locations, sub-processors, new extensions or retention periods.
Every new function that stores data or moves data to a new location requires an entry here and an assessment in the data protection impact assessment before release.
The retention periods that also appear in the privacy policy are checked against the code by the legal text test bench with every change.
Dated versions are retained in the project's version control.

Version 1.6 – as of 06.11.2026

How can we help?