Privacy Policy

Our Commitment to Your Privacy

At Answerplane ("we," "our," or "us"), privacy and data security are not just legal requirements. They are fundamental values that guide everything we do. We believe that your data belongs to you, and we are merely custodians helping you turn approved sources into governed, verifiable answers.

Our Core Privacy Principles:

• Your Data, Your Control: You own your data. We provide tools to access, export, modify, or delete your information at any time.
• Your Database Stays With You: We connect to your databases using read-only access by default. We do not ingest or replicate your source database contents wholesale.
• Encryption Everywhere: All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Database credentials are encrypted with additional layers of protection.
• Transparency First: We clearly communicate what data we collect, why we collect it, and how long we keep it. No hidden practices.
• Privacy by Design: Security and privacy are built into our platform from the ground up, not added as afterthoughts.
• Tenant Isolation: We use organization-scoped access controls, validation, and audit logs to keep customer environments separated.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our trusted data layer for source-connected AI answers (the "Service"). This policy complies with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws. By using our Service, you agree to the collection and use of information in accordance with this policy.

Data Controller

Answerplane is the data controller responsible for your personal data. For any privacy-related inquiries, you can contact our Data Protection Officer at:

Email: [email protected]
Address: Applifyer, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States

EU Representative (GDPR Article 27)

For data subjects in the European Economic Area (EEA), United Kingdom, or Switzerland:

Our primary infrastructure is located in the European Union (Azure Germany West Central region), and we maintain full compliance with EU data protection requirements. As a U.S.-based company with EU infrastructure, we process EU data locally within the EU whenever possible.

If we appoint a formal EU representative under GDPR Article 27 in the future, their contact information will be listed here.

You may contact us directly at [email protected] for all GDPR-related inquiries, including data subject rights requests, privacy questions, and compliance matters.

What We DO NOT Collect or Store

It's important to understand what we do not collect or store. Transparency means being clear about our limitations as well as our practices:

• Your Source Database Records: We do not ingest, replicate, or maintain a copy of your connected SQL or NoSQL database contents. We query your database only as needed to provide the Service.
• Customer-Directed Artifacts: Query results may be retained when you use product features that save them, including chat history, saved queries, dashboards, uploads, exports, or materialized result artifacts.
• Operational Records: We store the account, configuration, schema metadata, question text, generated SQL/NoSQL plans, audit logs, usage data, and support records needed to operate, secure, and improve the Service.
• AI Model Training: Your database data and query results are not used to train our AI models. Our AI providers process prompts under their applicable business API terms and settings, and Enterprise customers can request stricter provider routing or zero-retention options where available.

Bottom line: Your source database remains the system of record. We store the platform records and customer-directed artifacts needed to provide the features you choose to use.

Data Sovereignty and Ownership

You own your data. Period.

We recognize that your data is your most valuable business asset. Our role is to help you access and understand that data more easily. We are not claiming ownership or rights to your information.

• No Data Lock-In: You can disconnect your databases at any time. We revoke the connection path and delete associated credentials from primary systems within 30 days, or sooner where legally required.
• Export Capabilities: You can export available account, configuration, query history, and saved artifact records in machine-readable formats such as JSON or CSV.
• Data Portability: If you decide to leave our Service, we provide dashboard and support paths to export the platform records covered by this policy.
• Right to Deletion: Request deletion of eligible platform records at any time, and we will delete or anonymize them from primary systems within 30 days, or sooner where legally required.
• No Resale or Licensing: We will never sell, lease, or license your data to third parties for their commercial purposes.

Information We Collect

1. Personal Information

When you create an account or use our Service, we collect:

• Account Data: Name, email address, company name, job title, and password
• Billing Information: Payment card details, billing address, and tax identification (processed securely through our payment processor)
• PCI DSS Compliance: Payment card information is processed through Stripe, our PCI DSS Level 1 certified payment processor. We do not store credit card numbers, CVV codes, or full payment card details on our servers. Stripe handles sensitive payment data under its PCI DSS obligations.
• Profile Data: Profile picture, preferences, and organization settings
• Communication Data: Information from your communications with us, including support tickets and feedback

2. Database Connection Information

To provide our core services, we collect and securely store:

• Database Credentials: Connection strings, usernames, passwords, and API keys (encrypted using AES-256 encryption with unique encryption keys per organization)
• Database Metadata: Schema information, table/collection names, column/field names, data types, relationships, and indexing metadata used to understand your database structure.
• Query and Product Records: Approved-source questions you submit, generated SQL/NoSQL plans, execution times, success/error status, audit logs, chat history, saved queries, dashboards, uploads, exports, and materialized result artifacts when you use those features.

Critical Security Practices:

• Read-Only by Default: Database connections use read-only credentials. We cannot modify, delete, or corrupt your data.
• Encrypted at Rest: All credentials are encrypted using AES-256 with keys stored separately from the encrypted data.
• Encrypted in Transit: All database connections use TLS 1.3 or the highest encryption standard supported by your database.
• No Plain Text: Credentials are never stored in plain text, logs, or error messages.
• Credential Deletion: When you disconnect a database, we revoke the connection path and delete stored credentials from primary systems within 30 days, or sooner where legally required. Backup copies may persist only under the backup-retention timelines described below.

3. Automatically Collected Information

When you use our Service, we automatically collect:

• Usage Data: Features used, queries submitted, response times, error logs, and interaction patterns
• Device Information: IP address, browser type and version, device type, operating system, and unique device identifiers
• Cookies and Analytics: Session and preference cookies support account features. Our self-hosted Umami analytics is cookie-free, honors Do Not Track, excludes URL query strings and hashes, and records only anonymous page views, navigation, and Web Vitals.
• Log Data: Access times, pages viewed, time spent on pages, and navigation paths

4. Information from Third Parties

We may receive information about you from third parties, including:

• Authentication providers (if you sign in through single sign-on)
• Payment processors (for billing and transaction verification)
• Authentication and payment providers used for the services above

Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

• Contractual Necessity: Processing necessary to perform our contract with you (providing the Service)
• Legitimate Interests: Processing necessary for our legitimate interests (improving our Service, fraud prevention, security)
• Consent: Where you have given explicit consent (marketing communications, optional features)
• Legal Obligation: Processing necessary to comply with legal obligations (tax, accounting, regulatory requirements)

How We Use Your Information

We use your information for the following purposes:

Service Delivery

• Provide, operate, and maintain our trusted data layer for source-connected AI answers
• Plan approved-source answers and execute governed SQL/NoSQL plans against connected sources
• Authenticate users and maintain secure access to your organization's data
• Enable multi-tenant isolation and organization-specific features

Service Improvement

• Analyze query patterns and AI model performance (using anonymized, aggregated data)
• Develop new features, products, and services based on usage trends
• Conduct research and development on governed answer planning and source-scoped model behavior
• Optimize user experience and platform performance
• Important: Service improvements use operational metadata and anonymized usage statistics, not replicated source database contents

Communication

• Provide customer support and respond to your inquiries
• Send service-related notifications (security alerts, system updates, billing notices)
• Send marketing communications (with your consent, opt-out available)

Security and Compliance

• Detect, prevent, and address fraud, security breaches, and technical issues
• Monitor and analyze security threats and vulnerabilities
• Comply with legal obligations and regulatory requirements
• Enforce our Terms of Service and other policies

Data Sharing and Disclosure

We do not sell your personal data. We may share your information with:

Service Providers

We share data with trusted third-party service providers who assist us in:

• Cloud Infrastructure: Hosting and data storage services (your data is encrypted at rest)
• AI Model Providers: Answer planning and validation services. Critical: We send question text, schema metadata, and generated SQL/NoSQL plans needed for the request. We do not send full database dumps, and provider handling follows the applicable business API terms and settings.
• Payment Processing: Secure payment and billing services (payment information is tokenized and not stored by us)
• Analytics: Usage analytics and performance monitoring (only anonymized, aggregated data)
• Communication: Email delivery and customer support tools

All service providers are:

• Contractually obligated to protect your data and use it only for authorized purposes
• Required to comply with GDPR, CCPA, and other applicable data protection laws
• Prohibited from using your data for their own commercial purposes
• Subject to regular security audits and compliance reviews

Legal Requirements

We may disclose your information if required by law or in response to:

• Valid legal process (subpoenas, court orders, search warrants)
• Government or regulatory requests
• Investigations of potential violations of our Terms of Service
• Protection of our rights, property, or safety, or that of our users

Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred. We will notify you before your information is transferred and becomes subject to a different privacy policy.

Data Residency and International Data Transfers

Platform Infrastructure Location

Our primary infrastructure is hosted on Microsoft Azure in the Germany West Central region (Frankfurt, Germany). This means:

• EU Data Residency: Your account data, query metadata, settings, and configurations are stored in the European Union
• GDPR Compliance: Data stored in the EU benefits from strong data protection laws and remains subject to GDPR
• Low Latency for EU Users: European customers experience faster response times
• Encrypted Storage: All data at rest is encrypted using AES-256 encryption with Azure-managed keys

Your Database Location

Your actual business data remains in YOUR databases wherever you host them:

• We connect to your databases using read-only credentials
• Your database can be located anywhere in the world (on-premises, AWS, Azure, Google Cloud, etc.)
• We do not ingest or replicate your database records wholesale onto our servers
• Query results are processed to answer the request and may be retained only when a feature saves or materializes them, such as chat history, saved queries, dashboards, uploads, exports, or materialized result artifacts

AI Provider Data Processing

To plan approved-source answers, we use third-party AI/LLM providers:

• Providers: OpenAI (United States), Anthropic (United States), Google AI (United States), or OpenAI-compatible providers
• Data Sent to AI Providers: Your question text, database schema metadata (table/collection names, column/field names, data types), generated SQL/NoSQL plan text for validation
• Data NOT Sent to AI Providers: Full database dumps or broad replicated customer datasets
• Provider Retention Controls: AI providers process requests under their applicable business API terms and configured retention settings. Enterprise customers can request stricter provider routing or zero-retention options where available
• Data Protection: All transmissions to AI providers use TLS 1.3 encryption and are subject to Standard Contractual Clauses (SCCs)

International Data Transfers and Safeguards

When we transfer data from the European Economic Area (EEA) or United Kingdom to other countries (such as the United States for AI processing), we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): All third-party service providers (AI, payment, analytics) are bound by European Commission-approved SCCs
• Data Minimization: We only transfer the minimum data necessary for schema-grounded planning and answer validation
• Encryption in Transit: All international transfers use TLS 1.3 encryption
• Adequacy Decisions: We leverage European Commission adequacy decisions where available
• Supplementary Measures: We implement additional technical and organizational measures to protect transferred data

Multi-Tenant Security and X-Tenant-Id Filtering

For embedded widget deployments and multi-tenant database security:

• X-Tenant-Id Header: Widget requests can include an optional X-Tenant-Id header to scope queries to specific organizations/tenants within your database
• Database-Level Filtering: When configured, this header ensures queries only return data belonging to the specified tenant
• Security Validation: The tenant ID is validated before query execution to prevent unauthorized cross-tenant data access
• Use Case: Designed for multi-tenant applications where a single database stores data for multiple customers, each identified by a tenant ID
• Your Responsibility: You control the tenant ID logic and must ensure proper authorization before embedding widgets with tenant filtering

Summary: Your source database remains in your environment. Our platform processes schema metadata, question text, generated SQL/NoSQL plans, operational records, and customer-directed artifacts with contractual and technical safeguards in place.

Subprocessors and Third-Party Service Providers

Under GDPR Article 28, we disclose all third-party subprocessors who process personal data on our behalf. All subprocessors are contractually bound to protect your data and comply with GDPR, CCPA, and other applicable data protection laws.

Infrastructure and Hosting

• Microsoft Azure (Germany West Central, EU) - Cloud infrastructure, data storage, compute resources, database hosting
• Redis (Self-hosted on Azure Germany) - Session management, caching, and job queue
• RabbitMQ (Self-hosted on Azure Germany) - Message queue for background job processing
• PostgreSQL (Self-hosted on Azure Germany) - Platform database for account data and metadata

AI Planning and Validation

• OpenAI (United States) - AI model API for governed answer planning and validation (optional, based on your configuration)
• Anthropic (United States) - AI model API for governed answer planning and validation (optional, based on your configuration)
• Google AI (United States) - AI model API for governed answer planning and validation (optional, based on your configuration)
• Note: Only one AI provider is used per query based on your organization's configuration. Business API terms and organization settings control provider retention and model-training use; Enterprise customers can request stricter routing where available.

Payment Processing

• Stripe, Inc. (United States) - Payment processing, billing, subscription management, and PCI DSS compliance

Communication and Email Delivery

• Postmark (ActiveCampaign, LLC) (United States) - Transactional email delivery (account verification, password resets, billing notifications, security alerts)

Analytics and Monitoring

We operate Umami ourselves on private Azure infrastructure in Germany West Central. Analytics data is not sent to an external analytics provider. We do not use session replay, heatmaps, persistent identifiers, advertising profiles, account email addresses, typed content, questions, or customer data for website analytics.

Subprocessor Changes:

• We will notify you at least 30 days before adding new subprocessors or making material changes to existing ones
• You may object to new subprocessors within 10 days of notification by contacting [email protected]
• If we cannot accommodate your objection, you may terminate your subscription without penalty

Data Processing Agreements: All subprocessors that process personal data are bound by Standard Contractual Clauses (SCCs) or other GDPR-compliant data transfer mechanisms. Enterprise customers may review our Data Processing Agreement (DPA) at https://answerplane.com/legal/dpa or request a signed copy by contacting [email protected].

Data Security

Security is not just a feature. It is the foundation of our platform. We implement enterprise-grade security measures that protect your data at every layer:

Technical Safeguards

• Strong Encryption: AES-256 encryption for data at rest and TLS for data in transit
• Encrypted Credential Storage: Your database credentials are encrypted before storage
• Secure Key Management: Encryption keys are managed separately from encrypted credential data
• Access Controls: Role-based access control (RBAC) with principle of least privilege, multi-factor authentication (MFA) required for sensitive operations
• Network Security: Network controls, rate limits, monitoring, and secure connection handling
• Database Security: Read-only connections by default, encrypted credentials, secure connection pooling, automatic timeout for inactive connections
• Secrets Management: API keys, tokens, and credentials are stored using secure secret-handling practices

Organizational Safeguards

• Multi-Tenant Isolation: Organization-scoped access controls and tenant validation are applied throughout the platform.
• Automatic Organization Scoping: Queries and platform records are scoped to the authenticated organization.
• Security Reviews: We use vulnerability review, dependency checks, and targeted assessments to improve platform security.
• Employee Training: Team members with production access are expected to follow documented security and confidentiality practices.
• Access Monitoring: Comprehensive audit logs for all data access, administrative actions, and security events
• Incident Response: 24/7 security monitoring, documented incident response procedures, dedicated security team
• Compliance Roadmap: We are preparing controls and documentation for enterprise compliance reviews, including SOC 2 and ISO 27001 readiness.

Application Security

• Secure Development: Security built into every stage of our development lifecycle
• Input Validation: All user inputs are validated and sanitized to prevent injection attacks
• SQL Injection Protection: Parameterized queries only, with no string concatenation or dynamic SQL
• Rate Limiting: Automated rate limiting to prevent abuse and brute-force attacks
• Session Security: Secure session management with automatic timeout, secure cookies, and CSRF protection

Our Security Promise:

• We treat your data with the same level of security as we would want for our own business-critical data
• We continuously invest in security infrastructure and stay ahead of emerging threats
• We maintain transparency about our security practices and notify affected customers of security incidents as required by applicable law and our contractual commitments
• We design convenience features around least-privilege access, auditability, and source-owner controls

While we implement layered security controls, no system is 100% secure. We encourage you to use strong passwords, enable MFA, and follow security best practices. If you identify a security vulnerability, please report it to [email protected].

Your Control Over Your Data

We believe you should have clear, practical controls over your information. Here's how you can manage your data:

Self-Service Data Management

• Account Settings: Update your personal information, preferences, and organization details at any time
• Database Connections: Add, remove, or modify database connections from the dashboard. Disconnecting a database revokes the connection path and starts credential deletion under the retention timelines described in this policy.
• Query History: View, export, or delete your query history directly from your dashboard
• User Management: Add or remove team members, assign roles, and control access permissions
• Data Export: Export available account records, settings, query history, and configurations in JSON or CSV format
• Account Deletion: Start account deletion from the dashboard. Account closure includes a 30-day grace period, followed by deletion or anonymization under the retention and legal-obligation rules in this policy.

Granular Privacy Controls

• Communication Preferences: Control what emails you receive (product updates, security alerts, marketing)
• Analytics Opt-Out: Disable optional analytics while maintaining essential security logging
• Visibility Controls: Choose which database tables and columns are accessible to users

Transparent Data Access

• Audit Logs: View detailed logs of who accessed what data and when
• Plan Transparency: See the exact SQL/NoSQL plans generated from approved-source requests
• API Access: Programmatic access to available platform records through our API
• Real-Time Notifications: Get notified of important security events, data access, or configuration changes

Data Retention

We retain your data only as long as necessary for the purposes set out in this policy:

• Account Data: Retained while your account is active. After voluntary account closure, retained for 90 days to allow recovery. However, if you exercise your GDPR "Right to Erasure" or submit a deletion request, we will delete your data within 30 days (or sooner where legally required).
• Query History: Retained while your account is active and accessible through your dashboard.
• Database Credentials: Retained while the connection is active, then deleted from primary systems within 30 days after disconnection or sooner where legally required.
• Billing Records: Retained for 7 years to comply with tax and accounting requirements (cannot be deleted early due to legal obligations)
• Audit Logs: Retained for 2 years for security and compliance purposes. Security-related audit logs may be retained longer if necessary for ongoing investigations or legal obligations.

Deletion vs. Account Closure:

• Voluntary Account Closure: 90-day grace period to recover your account if you change your mind
• GDPR Deletion Request: Immediate deletion process begins, completed within 30 days (no recovery period)
• Backup Systems: Data in backup systems may persist for up to 90 additional days after primary deletion, after which it is permanently overwritten

After the retention period, we securely delete or anonymize your data using industry-standard data destruction methods.

Your Privacy Rights

Depending on your location, you have the following rights regarding your personal data:

GDPR Rights (EEA and UK)

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests or direct marketing
• Right to Withdraw Consent: Withdraw consent for processing at any time
• Right to Lodge a Complaint: File a complaint with your local data protection authority

CCPA Rights (California)

• Right to Know: Request disclosure of data collected about you
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt-out of the sale of personal information (we do not sell personal data)
• Right to Non-Discrimination: Equal service regardless of exercising your rights

How to Exercise Your Rights

To exercise any of these rights, contact us at:

• Email: [email protected]
• Account Settings: Many rights can be exercised directly through your account settings

We will respond to your request within 30 days (or as required by applicable law). We may require verification of your identity before processing your request.

Cookies and Tracking Technologies

We use essential and preference cookies for account features. Website analytics is cookie-free and does not identify individual visitors.

Types of Cookies We Use

• Essential Cookies: Required for authentication, security, and core functionality (cannot be disabled)
• Preference Cookies: Remember your settings and preferences (e.g., theme, language)
• Cookie-Free Analytics: Anonymous page views, navigation, and Web Vitals collected by our self-hosted Umami service. Do Not Track is honored; query strings, URL hashes, session replay, and heatmaps are disabled.

Managing Cookies

You can control cookies through:

• Your browser settings (most browsers allow you to refuse cookies)
• Do Not Track in your browser, which our analytics honors

Children's Privacy

Age Restrictions

Our Service is not intended for children under 16 years of age (or under 13 in the United States). We do not knowingly collect personal information from children under these age limits.

If you believe we have collected information from a child under the applicable age limit, please contact us at [email protected], and we will take appropriate deletion steps under applicable law.

Widget Embedding and Children

If you embed our widget on your website or application:

• Your Responsibility: You are responsible for ensuring compliance with children's privacy laws (COPPA, GDPR-K, etc.) on your website
• Age Verification: If your website is directed at children or has child users, you must implement age verification and parental consent mechanisms before allowing widget use
• Restricted Access: You should configure your website to prevent children from accessing the embedded widget
• Data Minimization: If children might use your website, ensure the widget does not collect or process personal information from children

We recommend disabling the widget or implementing age gates for any website sections accessible to children under 16.

Data Breach Notification

In the event of a data breach that affects your personal data, we will:

• Notify affected users within 72 hours of becoming aware of the breach (as required by GDPR)
• Notify relevant supervisory authorities as required by law
• Provide information about the nature of the breach, data affected, and steps taken
• Offer guidance on protective measures you can take

Third-Party Links and Services

Our Service may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third parties.

We are not responsible for the privacy practices of third parties. We encourage you to review their privacy policies before providing any information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify you via email or through a prominent notice in our Service
• For significant changes, request your explicit consent where required by law

Your continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to all requests within 30 days or as required by applicable law.

Supervisory Authority

If you are located in the EEA or UK and believe we have not addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.