AnswerEngine · Legal
Privacy Policy
Effective date: 2026-05-20
1. What we collect
- Account data: email, organization name, role, login timestamps.
- Site data: the domain you authorize us to crawl, plus everything publicly accessible on that site (page HTML, titles, structured data, internal link graph).
- Configuration: keywords you want to track, competitors you list, brand profile, CMS credentials (encrypted), webhook URLs and secrets.
- Generated data: AI citation results (which engines cited you for which queries), scan results (geoScore per page), drafted content, drafted Reddit answers.
- Billing data: handled by Stripe — we receive customer ID and subscription status, not card details.
2. What we don't collect
- We don't place tracking pixels on your customers' sites.
- We don't ingest PII from your CRM or end-user database unless you explicitly send it via the API.
- We don't train AI models on your data. LLM API calls are pass-through to providers under their data-use policies (see provider links below).
3. How we use it
- To deliver the AnswerEngine service (scanning, citation tracking, content generation, integrations).
- To detect platform abuse (rate limits, anomalous LLM spend).
- To improve the product (aggregate, anonymized usage metrics — never individually identifiable).
- To bill you for usage within your plan.
4. Third-party processors
AnswerEngine relies on the following sub-processors. Each has its own privacy and data-use policies which you can review:
- Vercel — hosting
- Stripe — billing
- Resend — transactional email
- Anthropic Claude — premium LLM content generation
- DeepSeek — bulk LLM content generation
- OpenAI — ChatGPT citation tracking
- Perplexity — Perplexity citation tracking
5. Data location + retention
Data is stored in the United States (Vercel Postgres / Neon). Account and configuration data is retained for the life of your subscription plus 30 days after cancellation. Scan, citation, and generated content data follows the same retention. You may request deletion at any time at privacy@bacwaterdepot.com.
6. GDPR + CCPA
EU and California residents have the right to: access their data, request correction or deletion, request a portable export, and object to processing. Email privacy@bacwaterdepot.com with your account email and we'll respond within 30 days.
7. Security
- All data in transit is TLS-encrypted.
- Sessions use signed JWT cookies with HS256 + httpOnly + Secure + SameSite=Strict.
- API keys are SHA-256 hashed at rest — plaintext is never recoverable.
- Webhook payloads are HMAC-SHA256 signed; subscribers verify authenticity.
- CMS credentials are stored encrypted at rest with a key managed by Vercel Environment Variables.
8. Cookies
We use one cookie: platform_session (signed JWT, httpOnly, 7-day expiry). No analytics or advertising cookies on /platform/* routes.
9. Changes
Material privacy changes will be emailed to account owners at least 30 days before they take effect.
