AnswerUp Developer Portal Privacy Policy
Controller/operator: AnswerUp LLC, a South Carolina limited liability company, USA
Privacy requests: support@answerup.ai
General/legal contact: info@answerup.ai
Portal: https://build.answerup.ai
Effective date: 2026-10-25 (UTC)
1. Scope
This Policy explains how AnswerUp LLC processes information through the AnswerUp Core Developer Portal, its account and private-preview features, and Guide. AnswerUp Front Desk is a separate product with no shared Core Portal identity, account or operational data boundary; this Policy does not govern Front Desk or developers' own applications.
2. Information and purposes
Account and security: We process email addresses, authentication method and provider identifiers, account/session information and security events to establish identity, protect access and operate accounts. Google, GitHub, Microsoft or email authentication may be offered; the identity provider separately processes sign-in data under its own terms.
Private preview: We process preview requests, invitations and redemption, agreement acceptance and exact document version, owner approval, entitlements, expiry/revocation and relevant audit records to manage authorized participation. Registration alone does not grant access.
Public visitor Guide: Questions and selected public source excerpts are sent to OpenAI to generate an answer, followed by a separate checking request. The Portal does not save visitor questions and answers as database conversations. An essential signed cookie and pseudonymous usage and network controls help manage service limits; hosting and security logs may separately record network information.
Authenticated Guide: We process questions, bounded recent conversation context and selected source excerpts through OpenAI. We store account-bound Guide conversations, feedback and usage records in the dedicated Core Portal. Separate Guide conversations do not automatically share memory.
Integrate Core with My App (authenticated Guide): When this feature is enabled for an eligible private-preview participant, you may paste a small JavaScript or TypeScript application-code snippet, or describe a new application or business operation. We send your submitted code, descriptions, programming language, verification description, optional logging/Trace preference and follow-up questions, together with selected AnswerUp documentation and reference context, to the configured AI provider (currently OpenAI) for a single generation pass that selects a source-backed integration example and suggests host wiring. The Guide application then applies local deterministic checks for admitted API use, citations, response format and selected security-sensitive patterns; authenticated Guide does not send the complete proposal for a separate AI whole-answer check. Generated code is developer-reviewed guidance, not executed by Guide or independently proven correct. Follow-up questions resend the code and descriptions still open in this view. Incomplete examples, including requests without an identified authoritative verifier, may also be processed by the provider.
We treat these submissions as confidential developer input. We do not add them or the proposals to Guest Guide retrieval, shared/public documentation or other participants’ conversations. We do not save submitted code, application descriptions, follow-up questions, generated proposals or model prompts in Guide conversation history. The Guide application does not intentionally write that content to application-generated logs. Infrastructure, observability and provider systems may separately retain content or operational and security records under their applicable settings and terms. We record fixed history markers, a request digest, account/request and release identifiers, bounded usage/cost counters, model/configuration observations and content-free validation/security status. Code and proposals remain temporarily in the open Guide view and in request processing; closing or leaving that view, or changing accounts or conversations, clears the view. This does not delete records retained separately by the AI or infrastructure provider.
Remove credentials, secrets and sensitive personal data before submission. Automated checks detect some obvious credentials but cannot detect every secret. Guide does not execute code, access repositories or change your files. Optional logging/Trace guidance concerns your application and does not itself upload your application evidence. We request AI response storage disabled (currently OpenAI store:false); this does not guarantee zero provider retention. Provider security/abuse-monitoring records and other operational retention may still apply under the applicable provider configuration and terms described in section 4.
Support: If you contact us, we process your contact details and the information you provide to answer requests and investigate problems. Please do not submit credentials, sensitive personal data or unredacted customer/provider evidence.
Trace Local: The selected local viewer runs on your device. Installing or using it does not automatically upload evidence to AnswerUp. If you choose to share captures with support or Guide, that submission is handled under the applicable channel and should be redacted first.
3. Legal bases
Where the GDPR or UK GDPR applies, we process account and preview-administration information as needed to provide requested account and preview services; security and abuse-prevention information for our legitimate interests in protecting the Portal and its users; records when required by law; and optional information on the basis of consent when applicable law requires it. We assess these bases against the particular processing and applicable law. Contact us to ask about the basis for a particular use or to exercise an applicable right.
4. Providers and international transfers
The Core Portal uses a dedicated Supabase project for identity, records and private storage; Vercel for hosting; Resend for authentication/invitation email; selected identity providers for sign-in; and OpenAI for Guide processing and checking. OpenAI Responses calls use response storage disabled (store:false), which does not guarantee zero provider retention. These providers may use their own subprocessors and retain operational or security information under their applicable terms. Contact us for information about the providers and arrangements applicable to your use.
Processing may occur outside your country, including in the United States. Where transfer rules apply, we will use a mechanism required by applicable law and provide information about applicable safeguards on request. We do not promise EU-only processing or zero provider retention. If a representative is required under applicable EU or UK law, we will provide the representative's contact details before processing that requires the appointment.
5. Cookies and security
We use first-party session, sign-in, invitation and signed visitor-Guide cookies or browser state for authentication, security, preferences and allowance controls. The Portal also stores a display preference in browser local storage and short-lived sign-in state in session storage. We have not identified a third-party analytics tag in the Portal application source; infrastructure providers may process request and security logs. If we add nonessential analytics or tracking, we will update this Policy and provide any notice or choice required by law. We use encrypted transport, private storage and server-side authorization checks. No online service can guarantee absolute security.
6. Retention
Authenticated Guide conversations and feedback are subject to maintenance and deletion controls; the configured periods and actual maintenance runs may vary. Visitor Guide questions and answers are not saved as Portal conversations. Pseudonymous allowance records and content-free diagnostics support current and previous UTC month accounting and unresolved request reconciliation; some completed records and older counters are removed on a later eligible visitor request.
We target approximately 60 days for ordinary AnswerUp-controlled Guest usage records, operational logs and closed support correspondence, subject to security, dispute and legal holds. Regular cleanup is being established; this target is not a guaranteed automatic deletion deadline. We review accounts after entitlement expiry or revocation rather than automatically deleting inactive accounts. We retain invitation, agreement, entitlement and security evidence for as long as reasonably needed to administer rights, address claims and meet legal obligations, with periodic review. We consider deletion requests against those needs and applicable law. Deleted live records may remain in backups until the provider's lifecycle ends; provider-managed records follow their own retention and deletion rules.
7. Your rights
Depending on where you live and applicable law, you may have rights to access, correct, delete, restrict or object to processing, receive portable data, withdraw consent where used, or complain to a supervisory authority. Contact support@answerup.ai. We may need to verify your identity and may retain information where legally required. You can delete individual saved Guide conversations or your live Guide history through supported account controls; this does not necessarily erase backups or vendor records.
If an applicable law gives you additional complaint, appeal or supervisory-authority rights, those rights remain available. Contact us for the relevant procedure and, where applicable, representative details. We respond to verified requests within the periods required by applicable law.
8. Changes and contact
We will publish an effective date and update this Policy when practices materially change, with appropriate notice to affected users. Contact support@answerup.ai for privacy requests or info@answerup.ai for general/legal matters.