Clear handling for the information behind the work.

We handle information that is needed to respond to an inquiry, operate an AnswerLift workspace, or complete a purchase.

• Snapshot and sales inquiries. Name, work email, agency or company, agency website, optional client URL, and the freeform visibility concern you submit.
• Support requests. Name, email, optional order reference, the topic and the message you send through the support form, plus a one-way hash of your network address kept briefly to limit abuse of the form.
• Account and workspace information. Information associated with authenticated users, workspaces, membership, and team invitations, including the version of our terms you accepted and when, and the name or email recorded against the evidence records you sign off as a reviewer.
• Work product entered in the service. Audit details, evidence observations, sources and URLs, remediation tasks, notes, and related review information entered by authenticated users.
• Usage and attribution information. Basic, aggregated site-use and attribution dimensions described below.
• Transaction information. The order Stripe reports back when you buy a Sprint: buyer email, Stripe customer and payment references, amount and currency, and your confirmation that you are buying for a business together with the version of the terms you accepted. Card details are entered on Stripe’s own page and never reach AnswerLift.

Account and workspace information is kept for as long as your account is open, and is deleted when you delete your account (see the account deletion page below). Billing and payment records are retained for six years from the end of the accounting period the record falls in, which is the retention HMRC requires of a UK limited company. Snapshot and sales-inquiry information is kept only as long as needed to respond to the inquiry it relates to, and in any case no longer than 24 months. Support requests are kept for 24 months after they are closed, so that a later question about the same order can be answered; the network-address hash used to rate-limit the form is not linked to your account and is only compared against requests made in the previous hour. Evidence records collected during a Sprint belong to the workspace and are kept until the workspace owner deletes them or the account.

AnswerLift runs on the publisher’s own virtual private server, hosted by OVH Limited in London, United Kingdom, and the application database, backend functions and outbound mail server run on that same server. Hosting therefore involves no international transfer. Some service providers process information outside the UK, mainly in the United States. The five comparison models (DeepSeek, Qwen, Kimi, GLM and MiniMax) are developed by companies based in China; we reach them only through OpenRouter and exclude China-hosted endpoints, so they are served from outside China. Every provider is listed in the next section with what it receives, where, when, and the safeguard relied on. For the providers that receive personal data about you — Stripe and Cloudflare in the United States — we rely on the UK Extension to the EU-US Data Privacy Framework, with the UK International Data Transfer Addendum to the EU Standard Contractual Clauses in their data processing terms as a fallback. PostHog receives data only if analytics is switched on and you accept it; its location and safeguard are in the table below. AI models are reached only through OpenRouter, under the UK Addendum in its data processing agreement (OpenRouter is not certified under the UK-US data bridge), and every request allows only providers that do not collect or train on inputs, only zero-data-retention endpoints and never a China-hosted endpoint. Nothing about you is sent to any AI model: the questions are generic buyer questions that never contain your name, your email or your client’s contact details, the client brand is left out of them, and email addresses, phone numbers and UK postcodes are removed automatically from every request before it is sent.

AnswerLift is hosted on the publisher’s own virtual private server at OVH Limited in London, United Kingdom. The application database, the backend functions and the sign-in service for workspace accounts all run on that server as a self-hosted Convex instance, so there is no third-party backend platform holding this data. Payments for the Visibility Sprint are taken by Stripe on their own hosted checkout page; the application records the resulting order but never receives or stores card details. Snapshot and sales inquiries are stored in that same self-hosted database and are not passed to any marketing or advertising service.

When a Sprint or scheduled collection runs, the agreed buyer questions are sent to the answer engines described on the methodology page and their answers are stored as evidence. With no gateway key configured, no request is made at all. The full list of providers:

When browser analytics is configured, the application uses PostHog for site analytics and event capture. The specific browser-storage and attribution behavior is described in the next section.

Sign-in, confirmation and password-reset codes are sent by our own mail server, on the same OVH server in London; no third-party email service handles them. Support requests sent through the support form are stored in our own database and are not passed to a ticketing or marketing service. We may disclose information when needed to operate these services, complete a purchase, respond to a request, protect the service, or meet legal obligations. A provider is added to this list before any data is sent to it.

The public site records aggregate daily attribution counts for landing pages and high-level source classifications, such as direct, search, social, referral, or AI answer engine. The application classifies a browser referrer on the device and sends the classification rather than a raw referrer URL. Its aggregate attribution reporting does not send IP addresses or persistent visitor IDs to the AnswerLift attribution table.

Attribution and analytics storage are switched off by default and run only if you accept them on the banner. If you accept, the site keeps first-touch and current-session attribution information in browser local storage and session storage (answerlift_first_touch_v1, answerlift_session_attribution_v1, answerlift_last_attribution_page_v1 and, for campaign tags, items beginning mt_utm_), including UTM values when present, and PostHog is initialized for page views, event capture and checkout attribution, using local storage and a first-party cookie for its persistence. Checkout links carry no identifiers: the Stripe Checkout Session is created by our own server, and the link we hand your browser is the one Stripe returned, unmodified.

If you reject, or have not answered, none of that runs: no PostHog request is made, no attribution entry is written or read, and nothing is stored on your device except the record of your own choice (answerlift.analytics-consent, in local storage), which is strictly necessary. The session cookie used to keep you signed in is also strictly necessary and is not covered by the banner. You can change your choice at any time:

We may send a short introductory email about AnswerLift to agencies and other businesses, at an address the business publishes for business enquiries (for example on its website or in a business directory). We collect only: the business name, its website, the published contact address, its Companies House details, and our own notes of what we sent and any reply. We do not guess or buy personal email addresses.

Our lawful basis is legitimate interests (Art. 6(1)(f)): telling relevant businesses about a business service. Under the Privacy and Electronic Communications Regulations we send these emails only to companies, limited liability partnerships and other corporate bodies, not to sole traders or partnerships unless they have agreed. Every email says who we are and how to opt out.

You can object at any time, and we will stop. Reply to the email or use the contact route below. We then add the address and domain to a suppression list, which we keep for as long as we do any outreach, so that we never contact you again; it holds only the address, the domain and the date. Other prospect records are deleted 12 months after our last contact. You also have the rights listed under “Ask about your information” below.

If you ask us for a free Snapshot, the brand, market and questions you send are put to the answer engines through OpenRouter, as described above; email addresses, phone numbers and UK postcodes are removed before they are sent.

Traffic to the site is encrypted in transit (HTTPS). Workspace data is only returned to signed-in members of that workspace, a check made in the backend on every request rather than in the page. The operator console needs both a signed admin token and an allowlisted account, and operator actions on customer workspaces are written to an audit log. Passwords are stored only as salted hashes by the sign-in library. Card details never reach our systems.

No system or transmission can be guaranteed absolutely secure. The security measures we commit to for customers’ client data are listed in Annex 2 of the Data Processing Agreement.

To ask about access, correction, deletion, or another privacy matter, email support@answer-lift.com. We may need to verify your identity before acting on a request.

You can delete your account and its data yourself from inside the app, without contacting us. The public account deletion page sets out exactly what is deleted, what is kept and why. If you are in the UK or the EEA you also have rights of access, correction, restriction, objection and portability, and the right to withdraw analytics consent at any time; we answer data-rights requests within one month. If you are unhappy with how we have handled your data you can complain to us through the same route, and we will acknowledge your complaint within 30 days; you can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113) at any time, without coming to us first.

California residents may use the same contact path to submit a privacy-related request. The availability and scope of any request depend on the information involved and applicable law.

We may update this notice as the service or its operational practices change. When we do, we will post the updated version here and revise the effective date.

For questions about this notice, email support@answer-lift.com.

Looking for a Snapshot? Request one here.