Privacy policy

Last updated: 17 October 2026

1. Who we are and our role

AnswerLine (answerline.dev) is operated by Quantive Betéti Társaság (Quantive Bt.), Erzsébet körút 55., 1171 Budapest, Hungary, company registration number 01-06-798410 ("we", "us"). Contact: support@answerline.dev.

Under the EU General Data Protection Regulation (GDPR) our role depends on the data:

• Controller for the data we collect to run your account and our business: account, billing, usage metadata, security and audit records, cookies, and support correspondence.
• Processor for personal data that you, our customer, put into requests, for example a person's name in a prompt, and for the results we return for those requests. We process that data only to carry out your requests, on your instructions; you are the controller of it and decide whether you have a lawful basis to submit it.

2. What we collect

• Account data: email address, sign-in method (email link or Google), team and account membership, roles, and the names you give API keys.
• Billing data: USD balance, top-ups and auto top-up settings, balance ledger, tier, invoices and payment history. Card details are collected and held by our payment processor, Stripe; we never see or store full card numbers.
• API usage metadata: timestamps, engine, country/geo parameter, request status, amounts reserved and charged, request ids, and per-day usage rollups.
• Request payloads and results: the prompts and parameters you submit and the structured results we return, including raw responses and, when you request them with include.html, HTML snapshots of the result pages.
• Affiliate data: the payout email and payee details (name, residence country, whether the payee is an individual or a business, and its tax/VAT id where it has one) an account owner sets on the Referrals page, which accounts signed up through a referral link, and the commissions they earn.
• Webhook configuration: the endpoints you register, the delivery log, and your account's webhook signing secrets. Signing secrets are stored in plaintext, because signing each delivery with HMAC requires the secret itself; they are shown only to account owners.
• Security and audit records: sign-in events with client IP, key creation and revocation, membership changes and other account actions, kept in an audit log; and a random device identifier stored in a cookie, used to limit sign-ups per device (see the cookie policy).
• Support correspondence: emails and messages you send us.

We do not run advertising or third-party analytics trackers, and the website serves its own fonts.

3. Why we process it (legal bases)

For the data we control:

• To provide the service, running your requests, storing results for retrieval, delivering webhooks, managing your account and keys (performance of a contract, GDPR Art. 6(1)(b)).
• To bill you, metering usage, charging your balance, invoicing, and meeting tax and accounting obligations (contract and legal obligation, Art. 6(1)(b), (c)).
• To run the affiliate program, attributing sign-ups to referral links, recording commissions and paying them to your payout email (performance of a contract, Art. 6(1)(b)).
• To keep the service secure, abuse prevention, rate limiting, limiting free sign-ups per device, audit logging, detecting compromised keys (legitimate interest, Art. 6(1)(f)).
• To support you and improve reliability, answering requests, diagnosing failures, monitoring capacity (legitimate interest, Art. 6(1)(f)).

Personal data inside request payloads and results is processed on your behalf, as described in section 1.

4. How long we keep it

• Request payloads and results (task records, result files, raw responses and HTML snapshots) are kept for 4 days after the request and deleted within 6 days of it: records go when their whole day is past the 4 days, files when the daily cleanup that follows runs.
• Database backups contain request payloads and the other database records in this list. Backups are kept for 7 days on our server and for 30 days in offsite storage, then deleted. Data deleted from the live database can therefore remain in a backup for up to 30 days after its deletion.
• Sessions expire 30 days (720 hours) after sign-in, or earlier when you sign out; sign-in links expire after 15 minutes and team invites after 7 days. Expired rows are deleted within about an hour.
• Audit log events are deleted 400 days after they happened.
• Daily usage rollups are deleted 400 days after the day they record.
• Notification records (which account emails were sent, for which top-up, balance alert or invoice) are deleted 400 days after sending.
• Webhook deliveries are deleted 7 days after they were delivered or, for deliveries that failed for good, after their last attempt.
• Stripe event ids we have processed are deleted 30 days after processing.
• Account data is kept while your account exists. When you delete your user, see "Delete your account" below.
• The hash of a deleted user's mailbox is deleted 400 days after the deletion.
• Billing and accounting records (balance ledger, referral commissions, invoices and payment records) are kept for the period required by Hungarian and EU accounting and tax law.

5. Who receives it

We do not sell personal data. The following receive personal data in the course of providing the service.

The engines your requests target

Running a request means sending its prompt or query, with its location parameters, to the service it targets, and those services receive and process it under their own terms and privacy policies. The operators are: OpenAI (ChatGPT), Perplexity AI (Perplexity), Google (Gemini, Google Search, Google News, AI Overview and AI Mode), Microsoft (Copilot) and xAI (Grok). Requests are sent through our proxy network and data-collection providers, not from your account with those services, and do not include your account details.

Subprocessors and service providers

• Data collection providers, which run requests against the engines on our behalf and return the answers, so they process the prompts, their location parameters and the engines' answers.
• A proxy network, which our requests to the engines are sent through.
• Stripe, payment processing and invoicing.
• Cloudflare, network delivery, DDoS protection and edge security for the website, dashboard and API; hosting of the website; object storage; and, where we send email through it, transactional email through Cloudflare Email Service (sign-in links, invites, notifications).
• Resend, transactional email (sign-in links, invites, notifications), where we send email through it instead of Cloudflare Email Service.
• Hetzner, server hosting in the EU.
• Google, if you sign in with Google, Google authenticates you and shares your email address with us.

Where a recipient is outside the EU/EEA, transfers are covered by adequacy decisions or standard contractual clauses.

We also disclose data where the law requires it, and to a successor if the business is sold or merged, subject to this policy.

HTML snapshot links

When a request asks for include.html, the result contains links to HTML snapshots of the result pages. These are unguessable links: anyone who holds a link can open the snapshot without an API key until it is deleted with the request's results. Treat the links like the results themselves and share them only with people who may see those results.

6. Your rights

Under the GDPR you can request access, rectification, erasure, restriction, portability and object to processing based on legitimate interest. You can withdraw consent where processing relies on it. Many of these are self-service under Settings in the dashboard; for anything else contact support@answerline.dev. If your personal data is inside a request one of our customers submitted, contact that customer, who controls it; we will assist them.

You also have the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or your local supervisory authority.

Download your data

Download my data saves a JSON file with your user (email address, sign-up time), your team memberships, your sessions (when each started and expires) and the notification emails we sent you, and for each account you own: its balance, tier, referral code and payout email, API keys (names, prefixes and use times), members, invites, bonus claims, referral commissions and daily usage. It never contains API keys, sign-in links, session tokens, webhook secrets or their hashes. A few downloads per hour are allowed.

The download does not include the audit log, request payloads and results, the webhook delivery log, the balance ledger, or invoices and payments held by Stripe. You can request a copy of any of these from support@answerline.dev.

Sign out everywhere

Sign out everywhere ends every session of your user at once, on every device, including the one you use.

Delete your account

To delete your user, type your email address exactly under Delete account. Then:

• If you are the only owner of an account that has other members, deletion is refused until you make one of them an owner or remove them.
• You leave every account that has another owner; the account and its data stay with its team, and your email address is removed from its notifications and audit log.
• An account you are the only member of is deleted with you: its auto top-up is cancelled at once and its remaining balance is forfeited, without a refund; its queued tasks are dropped and its API keys stop working (within about 30 seconds). Referral commission it earned and was not yet paid is forfeited.
• Your sessions and sign-in links end, and your email address is replaced in our records at once.
• After a grace window of 30 days, a deleted account's remaining personal details are erased: its name, invite addresses and bonus claim links are overwritten, and its API keys, audit log, daily usage and balance are deleted. Until then, support can help if you deleted by mistake.
• We keep what accounting and the law require: the balance ledger and referral commission amounts, and the invoices and payments our payment processor holds.
• We keep a SHA-256 hash of your mailbox (your address as your email provider delivers it, for example without the +tag) for 400 days, used only so that signing up again with it does not grant the free requests a second time.
• The prompts and results of your requests are deleted on the schedule in section 4, including the backup period.

7. Changes and contact

We may update this policy and will post the new version here with a new "last updated" date; for material changes we will give notice by email or in the dashboard. Questions and requests: support@answerline.dev.