Privacy Policy
What personal information Web Answerly handles, why, who else sees it, where it goes, how long we keep it, and what you can ask us to do.
Version 1.0 · Last updated 7 October 2026
This document is not yet in effect. It takes effect once the company that operates Web Answerly is registered in Australia and its name, ABN and ACN appear below. Until then it describes how Web Answerly works and what we intend to commit to. Questions: legal@webanswerly.com.
1. Who we are
Web Answerly is operated from Victoria, Australia. The operating company is being registered. Its legal name, ABN and ACN will appear here, and it will be the party to this document, before the document takes effect. In this document "Web Answerly", "we", "us" and "our" mean that company.
We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). Where the EU or UK General Data Protection Regulation applies, we also meet its requirements. Contact our privacy team at privacy@webanswerly.com.
2. Two roles: our information and our customers' information
Web Answerly handles personal information in two different capacities.
- As the business responsible (controller). We decide how to handle information about our own customers and their teams: accounts, workspaces, billing, support, demo requests, and the security and operation of the Service. This policy is our notice for that information.
- On behalf of our customers (processor). When a business uses Web Answerly, its content and the conversations its visitors and customers have with its agents (End User Data) belong to that business. It decides what is collected and why; we process it on its instructions, under our Data Processing Addendum. If you chatted with an agent on someone else's website, emailed it, or booked through it, that business's privacy notice applies, and requests about your information should go to it first. If you contact us instead, we will pass your request on and help it respond.
3. Information we handle for our own purposes
| Information | Where it comes from | Examples |
|---|---|---|
| Account | You, or Google if you sign in with Google | Name, email address, password (stored only as a one-way hash by our authentication provider, so we never see it), profile picture, sign-in method, and multi-factor settings if you enable them. |
| Profile you choose to add | You | Job title, phone number, time zone and language preference. |
| Workspace and business | You and your team | Workspace and company name, website, industry, company size, logo, address, billing and technical contact emails, tax ID, purchase-order reference, team members, invitations and roles. |
| Billing | You, and Stripe | Plan, subscription status and period, Stripe customer and subscription identifiers, invoices and payment status. Stripe collects your card details directly; we never receive your full card number. |
| Usage and service records | Your use of the Service | Answers, actions and voice minutes used; model, token, latency and cost records per answer; when you were last active in the dashboard and on which days; and audit records of administrative changes. |
| Connected-service details | You, and the service you connect | For integrations you connect: the account name or email, granted permissions, and access tokens (stored encrypted). |
| Support and correspondence | You | Emails you send to our support, privacy or legal addresses, and our replies. |
| Demo requests | You, on our website | Name, email, website and message. These are sent to our team and to you by email; they are not stored in our application database. |
| Security and technical data | Your device and our providers | IP address, used for rate limiting and abuse protection (held only for the limit window, usually minutes, or as a one-way hashed network prefix); sign-in records including IP address and browser kept by our authentication provider; and request logs kept briefly by our hosting provider. |
| Legal acceptance records | You, at sign-up | Which versions of our Terms and policies you accepted or acknowledged, when, and the IP address and browser used. |
4. Information we process for our customers
On a customer's instructions, the Service may process the following. Which items apply depends on the features that customer turns on.
- Knowledge content: pages crawled from the customer's website, documents it uploads or links, text and Q&A it writes, and documents synced from services it connects (Notion, Google Drive, GitHub, Confluence, Microsoft 365), stored with searchable passages and embeddings. This content may contain personal information, such as staff names on a team page.
- Conversations: messages and AI replies, the page address and referrer where the chat started, a random visitor identifier, the channel used, feedback ratings, the sources cited, and replies and internal notes from the customer's team.
- Details visitors choose to give: lead and handoff forms (name, email, company, message and a copy of the conversation), guided intake answers and contact details, and meeting bookings (name, email, time, time zone and notes; the event is created in the customer's connected calendar).
- Verified customer identity: if the customer signs its own users in and passes us a signed token, the customer's identifier for that user and any name, email or attributes it chooses to include.
- Email and Slack: for an email agent, the sender's address, subject, message text, threading headers, email authentication results, and attachment names and types (attachments are not read). For Slack, the workspace, channel and user identifiers and the message text.
- Voice: if a customer turns voice on, only the transcript of what the visitor says is sent to us, and it is kept as ordinary conversation messages. Audio is never sent to or stored by Web Answerly. Speech is turned into text either by the visitor's own browser, whose maker may process the audio under its own terms, or, if the customer enables it, by our model provider directly from the browser.
- Actions: what an action was asked to do, whether the visitor confirmed it, a summary of the result, and its status. The full response from the customer's system is shown to the visitor who asked; we store only a summary.
- Quality and outcome records: grades and summaries of conversations that the customer asks us to review, topics its agent could not answer, and cookie-free daily view counts for websites built with Web Answerly.
5. How we use information, and our legal bases
The EU and UK GDPR require us to state a legal basis for each use. Australian law asks us to say why we collect information; the purposes below serve both.
| Purpose | Information | Legal basis (EU/UK GDPR) |
|---|---|---|
| Create and run your account and workspace, and provide the features you use | Account, profile, workspace, connected-service details | Performing our contract with you |
| Bill you, handle failed payments and keep financial records | Billing, workspace | Performing our contract; complying with tax and accounting law |
| Answer support requests and send service messages (confirmations, security alerts, billing and policy notices) | Account, correspondence | Performing our contract; our legitimate interest in supporting customers |
| Respond to demo requests | Demo requests | Steps you ask us to take before a contract; our legitimate interest in replying |
| Keep the Service secure, prevent abuse and fraud, enforce our Terms and limits | Security and technical data, usage records | Our legitimate interest in protecting our customers, their visitors and the Service |
| Understand and improve how the Service is used, using usage counts and service records, not the content of your knowledge or conversations | Usage and service records | Our legitimate interest in improving the Service |
| Evidence what you agreed to | Legal acceptance records | Our legitimate interest in being able to establish and defend legal claims |
| Comply with the law and respond to lawful requests | Any, as needed | Complying with a legal obligation |
| Process End User Data and knowledge content for our customers | Section 4 information | Our customer is the controller and decides the basis; we act on its instructions |
We do not rely on consent for any of the uses above. If we ever ask for your consent for something specific, you can withdraw it at any time. We do not currently send marketing email; if we start, we will follow the law on consent and unsubscribing.
6. AI processing and training
- We do not use customer content, conversations or End User Data to train AI models, ours or anyone else's.
- To generate an answer, the relevant passages, the conversation and the agent's instructions are sent to our AI model provider. To make content searchable, passages are sent to it to create embeddings. Our current model provider, OpenAI, states that data sent through its API is not used to train its models unless the customer opts in. We have not opted in. OpenAI may keep API data for up to 30 days to detect abuse, unless the law requires longer.
- We use only model providers whose terms for the API service we use do not permit them to train on the data we send. A new provider is added only through the notice process on our Subprocessors page.
- We do not use AI to make decisions about you that have legal or similarly significant effects. Our customers decide how their own agents are used, and our Acceptable Use Policy prohibits using them to make such decisions without human review.
7. Google user data
Web Answerly uses Google services in three ways. Each asks only for the access described here.
- Sign in with Google: your name, email address and profile picture, to create and identify your account.
- Google Drive (if a customer connects it): read-only access, so that the files and folders the customer selects can be indexed as knowledge for its agents, plus the account's email, to show which account is connected. We read only the selected items. Their text is stored as searchable passages and embeddings, sent to our AI model provider to answer questions, and shown as citations.
- Google Calendar (if a customer connects it for booking): permission to read free/busy times and to create, move and delete events, plus the account's email. We use it only to show available times and to create, reschedule and cancel the meetings visitors book through Web Answerly. Free/busy returns only busy periods, not event details.
Access tokens are stored encrypted. Data from Google is shared only with the subprocessors needed to provide these features, never sold, and never used for advertising. Disconnecting in the dashboard deletes the stored tokens and asks Google to revoke them; you can also remove access in your Google Account settings. Indexed Drive content stays until the customer deletes the source, so an agent keeps working after a re-authorisation. To have it deleted, delete the source or contact us.
Web Answerly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use data obtained through Google Workspace APIs to develop, improve or train generalised or non-personalised AI or machine-learning models.
8. Who we share information with
- Our service providers and subprocessors, who host, store, process, email and bill for us, under contracts that limit what they may do. They are listed, with what they do and where, on our Subprocessors page.
- Services our customers connect. When a customer connects Slack, a calendar, a webhook, its own API or an MCP server, information flows to that service at the customer's direction, under that service's terms.
- The business you dealt with. End User Data is available to the customer whose agent you used, and to the members of its team it chooses.
- Our staff, only those who need access to support you, keep the Service running or investigate a security issue. Their access is logged.
- Professional advisers, and authorities, where the law requires or permits it, or where we need to establish, exercise or defend legal claims.
- A buyer or successor, if all or part of our business is sold or restructured, under confidentiality and with this policy continuing to apply.
We do not sell personal information, and we do not use it for advertising.
9. Where information is processed
Our database, application servers and indexing worker run in Sydney, Australia. Some of our providers process information outside Australia:
- the United States: our AI model provider (OpenAI), our email providers (Resend for sending; Mailgun for receiving mail to our own addresses), and Stripe for payments;
- our hosting provider's global content-delivery network, which serves pages and the widget from locations near the person viewing them;
- wherever the providers of services our customers connect are located (for example Google, Microsoft, Slack or Notion).
We take reasonable steps, including contractual terms, to make sure overseas recipients handle personal information consistently with the Australian Privacy Principles. Australia does not have an EU or UK adequacy decision. For personal information we process for EU or UK customers, our DPA incorporates the EU Standard Contractual Clauses and the UK Addendum, and we rely on our providers' transfer mechanisms for onward transfers.
10. How long we keep information
| Information | How long |
|---|---|
| Account, profile and workspace | While the account or workspace exists. After you ask us to close it, we delete it within 30 days. |
| Customer knowledge content and End User Data | Until the customer deletes it (deleting an agent deletes its conversations), or until 30 days after the workspace is closed. |
| Billing and tax records | As long as tax and corporate law require, generally five to seven years. |
| IP addresses used for rate limiting | For the length of the limit window, usually minutes. |
| Dashboard activity records | Up to 13 months. |
| Slack and email event records used to prevent duplicates | 7 days. |
| Legal acceptance records | While the account exists and for 7 years after it closes, so we can evidence what was agreed. |
| Support correspondence and audit records | As long as needed to handle the matter, protect the Service and meet legal obligations. |
| Backups | Overwritten on our database provider's backup cycle. |
11. Security
We protect personal information with technical and organisational measures that include workspace isolation enforced in the database, encryption of stored credentials, hashed keys, access controls and rate limits. Our Security page describes them. No system is completely secure. If a data breach is likely to cause serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in the way the Notifiable Data Breaches scheme sets out, and notify affected customers under our DPA.
12. Your rights
Everyone
- You can ask for access to the personal information we hold about you, and ask us to correct it. You can update most account and profile details yourself in the dashboard.
- We will respond within 30 days. We do not charge for a request. We may need to confirm your identity first. If we refuse, we will explain why and how to complain.
In the EU and UK
You also have the right to erasure, to restrict or object to our processing (including processing based on our legitimate interests), and to data portability. You may complain to your local data protection authority, or in the UK to the Information Commissioner's Office. We would appreciate the chance to resolve your concern first.
Complaints in Australia
Send privacy complaints to privacy@webanswerly.com. We will acknowledge your complaint, investigate it, and reply in writing within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
If your request is about a business's agent, contact that business; as its processor, we will help it respond.
13. Children
Web Answerly is for people aged 18 and over, and customers may not deploy agents directed at children. We do not knowingly collect information from children for our own purposes. If you believe a child has given us information, contact us and we will delete it.
14. Cookies and browser storage
Our website uses only the cookies and browser storage needed to sign you in and remember your display preference. It has no advertising or third-party analytics trackers. The chat widget stores nothing optional until the host website signals consent. Details are in Cookies and Browser Storage.
15. Changes to this policy
We will update this policy when how we handle personal information changes. For a significant change, we will notify customers by email and in the dashboard at least 30 days before it takes effect. The version and date at the top of this page show which version applies.
16. Contact
Privacy questions, requests and complaints: privacy@webanswerly.com.