CustomAnswer LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA, explains here how it processes personal information. For account and website data, we generally act as controller. For contacts, conversations, and other data a customer submits to provide its support service, that customer is controller and CustomAnswer is its processor/service provider.
1. Scope and roles
This Policy covers our website, dashboard, mobile application, support, billing, integrations, and AI features. It does not govern third-party sites or a customer's own privacy practices. If an organization communicates with you using CustomAnswer, direct rights requests about that conversation to the organization; we assist it under our contract and applicable law. Business customers may request a data processing addendum.
2. Information we collect
| Category | Examples and sources |
|---|---|
| Account and profile | Name, email, password hash, language, organization, role, acceptance records; from you or supported social sign-in. |
| Customer Data | Contacts, channel identifiers, messages, attachments, media, knowledge-base material, prompts, instructions, AI inputs and output; from customers, their contacts, and enabled integrations. |
| Integration data | Meta/Facebook/Messenger/Instagram/WhatsApp and other account identifiers, page data, permissions, access tokens, webhook events, and configuration you authorize. |
| Billing | Coin purchases and usage, invoices, price, currency, tax/billing address, Stripe customer/payment identifiers, card brand and last four digits, payment status, refunds, disputes, and Auto-Reload consent. Stripe collects full payment credentials. |
| Device and activity | IP address, browser/device type, operating system, timestamps, routes, diagnostic, security, audit, and performance events. |
| Cookies and similar technologies | Session/security, language preference, analytics preference, Google Analytics identifiers, and Hotjar interaction data, heatmaps, and session recordings. |
| Support and communications | Emails, support requests, feedback, survey responses, and associated metadata. |
| Mobile permissions | Camera, photos/files, notifications, or other device access only when you use a feature and grant the permission. |
Account identifiers, authentication information, and necessary billing details are required to create an account or complete a purchase. Without them, we may be unable to provide the relevant service. Optional profile information, marketing choices, and device permissions are voluntary, although declining a permission may prevent the related feature from working. Do not send passwords, full payment-card details, or unnecessary sensitive information in support messages or AI prompts.
3. Why we process it and legal bases
We process information to create accounts; authenticate and secure the Service; deliver conversations and AI features; execute purchases and Auto-Reload; provide support; maintain, diagnose, and improve the Service; prevent fraud and abuse; comply with law; and communicate product or legal updates. Where GDPR-style law applies, bases include performing our contract, legitimate interests in security and service improvement balanced against your rights, consent for optional analytics or marketing, and legal obligations for tax, accounting, and lawful requests. You may withdraw consent prospectively.
Withdrawing consent does not affect processing lawfully carried out before withdrawal. Other processing may continue where a separate lawful basis applies, such as keeping required accounting records. You may object to processing based on legitimate interests and to direct marketing as provided by applicable law. Before using personal information for a new, incompatible purpose, we will provide the required notice and obtain consent or establish another lawful basis where required.
4. AI processing
Customer instructions, knowledge, conversation context, and attachments may be sent to configured Google Gemini/Vertex AI services to generate or evaluate responses. Output and related usage metadata may be stored with the conversation. Do not submit unnecessary sensitive data. AI output may be inaccurate and may be reviewed by authorized customer personnel. Our use of provider data is governed by our provider configuration and contract; this Policy does not promise that every provider offers identical retention or training terms.
5. When we disclose information
We disclose information only as needed to: the customer and its authorized users; Google Cloud/Gemini/Vertex AI for AI processing and infrastructure; Stripe for payments, invoicing, fraud prevention, and customer billing portals; Meta companies for integrations you enable; Cloudflare for anti-bot/security services; hosting, database, Redis/cache, S3-compatible storage, email, monitoring, and support vendors; Google Analytics and Hotjar for website analytics; professional advisers; authorities when legally required; and a buyer or successor in a corporate transaction. Providers process under contracts and may use data for their own independent purposes where their policies say so. We do not sell personal information for money. We do not use cross-context behavioral advertising, but optional analytics may constitute “sharing” under some US state laws; you may reject it in Cookie Settings.
6. International transfers
We and providers may process data in the United States and other countries. Where required, we rely on adequacy decisions, Standard Contractual Clauses, the EU-US Data Privacy Framework participation of an eligible provider, or another lawful mechanism, with supplementary safeguards where appropriate. Contact us for information about the applicable mechanism.
7. Retention
| Data | Typical retention |
|---|---|
| Account and Customer Data | While the account is active, then deletion or de-identification generally begins within 30 days after a valid deletion request. |
| Backups | Rotate out generally within 90 days; data is isolated from ordinary use meanwhile. |
| Payments, invoices, taxes, consent records | Up to 7 years or longer if required for tax, accounting, disputes, or fraud prevention. |
| Security/audit logs | Typically 12 months, longer for an investigation or legal need. |
| Support communications | Typically 3 years after closure. |
| Temporary uploads/export links | For the period displayed in the feature or until the link expires. |
Actual periods may be shorter or longer based on customer settings, legal holds, disputes, platform requirements, backups, and the need to establish or defend claims. We then delete, aggregate, or de-identify information.
Business closure does not remove our privacy obligations. If the Service closes, we will handle data export under the Terms of Service and delete or de-identify personal information when it is no longer needed, subject to lawful retention duties and claims. A merger, acquisition, or asset transfer does not authorize unrestricted reuse: any successor must process the transferred data consistently with applicable law and provide any required notice of changes. Closing the Service does not by itself authorize us to sell personal information or use it for unrelated marketing.
8. Your choices and rights
Depending on location, you may request access, correction, deletion, portability, restriction, objection, or withdrawal of consent; opt out of qualifying sale/sharing or targeted advertising; and appeal a denied request. You may also complain to a data protection authority. We do not discriminate for exercising rights. Authorized agents may submit requests where law permits. We verify requests proportionately, such as through account access or email confirmation. Use in-app Settings for export/deletion or see our Data Deletion page. For a customer's contact data, contact that customer first.
Send requests or appeals to [email protected] with the subject ?Privacy Request? or ?Privacy Appeal.? Explain the right you wish to exercise; do not send passwords or full card numbers. We respond within the period required by applicable law. Where the EU GDPR applies, this is normally within one month of receipt; if a permitted extension is needed, we will explain why within that month. Requests are generally free, subject only to exceptions allowed by law. If we cannot fulfill a request, we will explain the reason and available complaint or appeal options, unless legally prohibited.
Deleting your account does not necessarily delete information another organization independently controls. Where we act as a processor, we assist that organization with your request under its instructions and our legal obligations. Disconnecting an integration stops access as supported by that provider but does not itself erase previously imported records; deletion must be requested separately.
9. Cookies and analytics
Necessary storage supports authentication, security, language, and consent choices. On the public website, Google Analytics and Hotjar load automatically without a cookie popup unless you have saved a necessary-only preference or enabled Global Privacy Control. Rejecting optional analytics does not block core service access. Review or change choices in our Cookie Notice. Browser signals such as Global Privacy Control are honored for qualifying opt-outs where required.
10. Security
We use measures designed for the risk, including password hashing, transport encryption where configured, role/access controls, vendor controls, logging, and backups. No system is perfectly secure, and we cannot guarantee absolute security or “end-to-end encryption.” Keep credentials confidential and contact us about suspected compromise.
If we become aware of a personal data breach, we will notify affected customers, individuals, and competent authorities where required by applicable law and our data processing agreements, within the applicable deadlines. Notices will describe the relevant risks and available protective steps to the extent known. Contractual liability limitations do not remove mandatory notification duties or non-waivable privacy rights.
11. Children
The Service is for adults and organizations and is not directed to anyone under 18. We do not knowingly collect a child's information as account holder. If you believe a child provided information unlawfully, contact us. Customers must obtain required parental consent before submitting children's data.
12. Automated decisions
The Service generates suggested or automated communications, but CustomAnswer does not itself make decisions producing legal or similarly significant effects about customer contacts. Customers control how output is used and must provide human review where required. Contact the relevant customer about its decisions.
13. Changes
We may update this Policy and will post the new date. We will provide reasonable notice of material changes and obtain consent where law requires. Prior versions may be requested by email. The English version controls, subject to mandatory local law.
14. Contact
CustomAnswer LLC
30 N Gould St Ste R, Sheridan, WY 82801, USA
[email protected]
Write “Privacy Request” in the subject. If GDPR applies, you may contact your local supervisory authority; if a US state appeal is denied, you may contact your state attorney general.