Where your knowledge goes, and where it does not
Written from what the code does rather than from what a policy would like to say. Every statement here corresponds to something in the product; where a fact belongs to a provider, it says so.
Every table holding company data is protected by row-level security in the database itself, keyed to which company you belong to. A mistake in our code returns nothing rather than somebody else's data.
A PDF, Word file or text you drop into the Company Brain is read on your own machine. Only the extracted text is sent, and the original is never uploaded, so there is nothing to delete later.
A visitor reading an answer is counted with an identifier that lives in the tab and dies with it. No cookie, no advertising ID, no third-party tag. We can tell you how many people read an answer, never who.
The language models run under business terms that exclude training on customer content. Your knowledge is sent to answer your questions and write your answers, and for nothing else.
Provider keys, the database's privileged key and the Stripe secret never reach a browser. Card details never reach us at all: payment happens on Stripe's own pages, and every Stripe event is signature-checked before it changes anything.
Every page, hub and API call is served over TLS, and the site tells browsers to use nothing else.
Every record and every answer can be exported whenever you want. Close the account and the company data is deleted; ask for a copy, a correction or a deletion and a person answers within 30 days, usually within days.
Reading records hold no identifier. Form submissions hold what was typed and nothing inferred. Conversations with the Answer Agent are kept to show you what your market asks, and only on your own workspace.
Sub-processors
The only services involved in running AnswerLink. Each one sees the minimum its job requires.
Everything you put into AnswerLink: your company knowledge, your answers, and the details of people who filled in a form on your hub.
Requests to the application and to your hub, including IP addresses in ordinary server logs.
The confirmed knowledge relevant to a question, and the text of the answer being written. Never the details of people who filled in a form. Under business terms that exclude training on it.
The same as above. Only one provider is used at a time.
The billing name, email address, billing address and VAT number of a paying workspace, and the card — which AnswerLink never sees; checkout and the card on file live on Stripe's own pages.
The subjects and questions a workspace scans, as search queries. No personal data and nothing from the Company Brain.
The email address of an account holder, for sign-in links, the weekly note and a scan report somebody asked for.
Nothing is sent. AnswerLink reads your search performance and stores it against your account.
Tools on the marketing site
The marketing pages of answerlink.io use three tools to see how the site is used. They never touch the application or a customer's hub, and stay off until you accept them in the cookie banner.
Pages visited and events on them, after consent. Consent Mode keeps it off until then.
Scrolls, clicks and session replays on the marketing pages, after consent.
Your consent choice, so the banner does not ask again.
Questions and answers
Where is the data stored?
On Supabase, which runs on AWS. Which region a workspace's data lives in is a property of the project, and we state it in writing on request so that it appears in your records as a fact rather than a paraphrase.
Is there a data processing agreement?
Yes. M.R. Enterprise B.V. acts as processor for the company data in your workspace and as controller for your account details. The agreement, with the processor list on this page, is sent on request.
Do you have a certification?
Not yet, and the page does not pretend otherwise. The providers underneath — Supabase, Netlify, Stripe, Anthropic, OpenAI — publish their own attestations, and ours builds on theirs.
What happens in an incident?
We tell affected customers by email as soon as we know what happened and what it touched, and report to the Autoriteit Persoonsgegevens where the law requires it. Security concerns go to hello@answerlink.io and reach a person.
Can a visitor on my hub be identified?
No. The hub sets no cookie and keeps no identifier that survives the tab. Somebody who fills in a form is stored with exactly what they typed, in your workspace, and nowhere else.
A free scan of your own site: one visibility reading, eight checks, and what each one becomes once your answers are published.