Privacy Policy
Version 2.1. Effective 24 October 2026.
1. Who we are and scope
AnswerThis is an online research platform that you use in your web browser at answerthis.io and app.answerthis.io. It helps researchers search across more than 250 million papers, run systematic literature reviews, analyse documents, write with citations, and keep a personal library.
AnswerThis is operated by Deep Point Ventures Inc., a United States company. Our postal address is 1806 Summit Ave, Suite 300, Mailstop 242, Richmond, VA 23230, USA. You can reach us at support@answerthis.io or by phone at +1 804 234 3569. Our data protection contact is Ayush Garg, ayush@answerthis.io.
This Privacy Policy applies to answerthis.io, app.answerthis.io, and the related services we provide through them. It explains what we collect, how we use it, who we share it with, and your choices and rights. Your use of the platform is also governed by our Terms of Use at https://answerthis.io/terms.
2. Information we collect
We collect the following categories of information.
Account data
Your name, institutional email, affiliation or role, and the authentication identifiers used to sign you in.
Content you provide
Your search queries and prompts, your conversation history, your saved libraries and project details, the documents you upload (PDF and other files), the outputs and documents the platform generates, and the embeddings we derive from that text to power search.
Technical data
Your IP address and browser metadata recorded in our web-server logs, error diagnostics (each error event includes your user id and email), and timestamps.
Billing data
Only if you are an individual self-service subscriber. Your payment is handled by our payment processors. If an institution provides your access, we invoice the institution and do not process any card data.
Information from institutional single sign-on
When your institution provides single sign-on, your identity provider releases to us a persistent pseudonymous identifier and your affiliation. Your email address is optional, used only for notifications and support. We never receive your institutional password.
3. How we use information
We use your information to:
provide the platform: create and maintain your account, host and back up your content, and give you customer support;
keep the platform safe and reliable: detect and prevent security incidents, fraud, abuse and spam, and fix problems;
improve the platform: see which features are used so we can make them better;
communicate with you: send service messages about your account and, if you have opted in, occasional product updates. You can opt out of marketing at any time; we will still send essential service messages.
If you are in the European Economic Area or the United Kingdom, our legal bases under the GDPR are:
Performance of a contract, to provide the platform you have signed up for.
Our legitimate interests, to secure, maintain and improve the platform and to prevent abuse, balanced against your rights.
Your consent, for marketing emails, which you can withdraw at any time.
Compliance with a legal obligation, when the law requires us to act.
We do not train on your content. We do not use your content to train AnswerThis's models, and we do not allow it to be used to train any third party's models. The AI providers that process your content for us are bound by their terms not to train their models on it. We do not sell or rent your personal information.
4. AI processing and model providers
To answer your questions and produce documents, the platform sends parts of your content to specialist AI providers. This includes your query text, the passages we retrieve from papers, the text extracted from your uploads, and the recent conversation context. The providers use this to generate answers, to create the embeddings that power search, and to rank results. Your content is not used to train any of these providers' models.
Microsoft (Azure OpenAI, in Microsoft Foundry) runs the main language models that write your answers. Microsoft states that prompts and completions are not used to train its foundation models, that the models are stateless, and that content is not stored, except that content flagged by abuse monitoring may be sampled into a customer-segregated store for automated or human review. For institutional deployments we apply for modified abuse monitoring, which removes that sampling and review.
Amazon Web Services (Amazon Bedrock, running Anthropic Claude models) runs language models for search, screening, verification and structured extraction. AWS states that inputs and outputs are not shared with the model provider and are not used to improve the models. We do not enable Bedrock invocation logging.
Microsoft (Azure AI Document Intelligence) converts the PDFs and files you upload into text.
OpenAI creates the text embeddings used for search. OpenAI states that API data is not used to train its models. Abuse-monitoring logs are kept for up to 30 days by default. For institutional deployments we apply for Modified Abuse Monitoring or Zero Data Retention where we are eligible.
Anthropic (direct API) is a fallback language model used only if Bedrock is not available. Anthropic deletes API inputs and outputs within 30 days and does not train on customer content under its commercial terms.
E2B provides the isolated sandbox that runs an agent task. It receives the task context and any files you attach. The sandbox is destroyed after 15 minutes of inactivity or at the end of the session.
Some models are optional. OpenRouter (routing to Moonshot AI's "Kimi" and fallback models) and Google's Gemini API run only if you select them in the consumer product. For institutional deployments they are turned off, so institutional content is processed only by the core providers above.
5. Sharing and sub-processors
We share your information only as described here. We do not sell or rent your personal information.
Service providers (sub-processors)
We use the providers below to run the platform, and each receives only the data it needs. We keep this list current and give institutional customers advance notice of changes under their Data Processing Agreement, with a right to object.
Provider: Microsoft (Azure OpenAI, Microsoft Foundry) Role: Primary language models that generate answers Data received: Prompts: query text, retrieved paper passages, uploaded-document text, conversation context Location: United States (West US 3, Arizona)
Provider: Amazon Web Services (Amazon Bedrock, Anthropic Claude) Role: Language models for search, screening, verification and structured extraction Data received: Prompts and generated outputs Location: United States (us-east-1, Virginia). Cross-region inference may use other AWS commercial regions
Provider: Microsoft (Azure AI Document Intelligence) Role: Converts uploaded PDFs and files into text Data received: Uploaded document content Location: United States
Provider: OpenAI Role: Text embeddings for search Data received: Query text and document text chunks Location: United States
Provider: Anthropic (direct API) Role: Fallback language model if Bedrock is unavailable Data received: Prompts and generated outputs Location: United States
Provider: E2B Role: Isolated sandbox that runs an agent task; destroyed after 15 minutes idle or at session end Data received: Task context and files you attach for the task Location: United States
Provider: OpenRouter (Moonshot AI "Kimi" and fallbacks) and Google (Gemini API) Role: Optional, user-selectable models in the consumer product Data received: Prompts, only if you select these models Location: Turned off for institutional deployments
Provider: Exa Role: Retrieval of web page content for regulatory, HTA and trial-landscape searches Data received: Search terms Location: United States
Provider: Functional Software, Inc. (Sentry) Role: Error monitoring Data received: Error events, including user id and email Location: United States (US ingestion region)
Provider: Twilio (SendGrid) and Google Workspace (Gmail) Role: Transactional email Data received: Name and email address Location: United States
Provider: Cloudflare Role: Content delivery and proxy for the web front end Data received: HTTP request metadata Location: Global network (United States company)
Provider: DigitalOcean Role: Application hosting, database and object storage Data received: Account data, content, uploaded files and embeddings Location: United States (New York)
Provider: Redis Ltd (Redis Cloud) Role: Job queue and short-lived cache Data received: Job payloads and cached embedding vectors (2-hour lifetime) Location: United States (Google Cloud us-central1)
Provider: Third Iron (LibKey/BrowZine) Role: Institutional full-text link resolution, only if the institution connects its LibKey subscription Data received: Article identifiers and institution id (no personal data) Location: Used only with the institution's subscription; no personal data
Payment processors
If you are an individual subscriber, your payment is handled by Stripe, PayPal or ChargeBee. We do not process card data for institutional accounts, which are invoiced.
Public research data sources
When you search, we send your search terms, not your personal information, to public research databases. OpenAlex, Semantic Scholar, Crossref, PubMed/NCBI, arXiv, ClinicalTrials.gov, openFDA, EMA, CTIS, ISRCTN and CMS.
Business transfers
If AnswerThis is acquired, sells assets, or goes through another change of control, personal information may be one of the assets transferred.
Legally required disclosures
We may access, preserve and disclose information when we believe it is needed to comply with the law or a court order, to enforce our Terms of Use, or to protect the rights, property or safety of AnswerThis, our users or others.
6. Where data is stored and international transfers
We host the platform in the United States. Our application runs on DigitalOcean (Kubernetes) in New York, and the web front end is delivered through Cloudflare. Your account data and content, including the vector embeddings, are stored in DigitalOcean Managed PostgreSQL in New York. Uploaded files are stored in DigitalOcean Spaces in the NYC3 region. Our job queue and short-lived cache run on Redis Cloud in Google Cloud's us-central1 region in the United States.
If you use the platform from the European Economic Area, the United Kingdom or Switzerland, your personal data is transferred to the United States. Some of our sub-processors, including Amazon Web Services and DigitalOcean, are certified under the EU-US Data Privacy Framework. AnswerThis itself is not certified under the EU-US Data Privacy Framework. For these transfers we rely on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two, for controller-to-processor transfers, together with the supplementary technical measures described in section 7. Institutional customers can sign a Data Processing Agreement with us that includes these clauses.
We do not offer EU data residency today. An EU-hosted deployment can be arranged for a campus-wide licence under a separate order.
7. Security
We protect your information with the following measures.
Encryption in transit. All traffic uses HTTPS with TLS 1.2 and 1.3 (older versions are refused), with certificates from Let's Encrypt for the API and website and a Cloudflare-managed certificate for the web application. Database connections also use TLS.
Encryption at rest. Our managed database is encrypted at rest by DigitalOcean using LUKS and AES-256. The Redis cache is encrypted at rest, and our AI providers encrypt content at rest. Uploaded files in DigitalOcean Spaces are encrypted at rest by DigitalOcean, stored in a private bucket, and held under DigitalOcean's SOC 2 Type II controls.
Passwords. Local passwords are stored only as bcrypt hashes. Single sign-on users have no local password, and we never receive your institutional credentials.
Sessions. You stay signed in with a signed token held in an HttpOnly, Secure cookie. Consumer sessions last 30 days. Institutional deployments can use shorter sessions with re-authentication through the institution's identity provider.
Tenant isolation. The platform is multi-tenant with logical isolation. Every request is scoped to the signed-in user or team, and no internal tool displays your content.
Restricted internal access. Production access is limited to named AnswerThis engineers, each with their own credentials.
Backups. The database is backed up daily, with point-in-time recovery for the previous 7 days.
Monitoring. We keep web-server access logs and use error monitoring and infrastructure alerts.
No online service can be guaranteed completely secure, so please protect your password and sign out on shared devices.
8. Retention and deletion
We keep your account data and content for as long as your account is active. When you close your account or send us a verified deletion request, we delete your personal data within 30 days. This covers your account, your libraries, the files you uploaded, the documents the platform generated, and the embeddings derived from your content. Copies in our encrypted backups age out within 7 days after that. Short-lived caches of embedding vectors are cleared within 2 hours.
Our AI providers keep content only as described in section 4: Azure OpenAI and Amazon Bedrock do not retain your prompts beyond processing them (Azure's abuse-monitoring exception is described in section 4), OpenAI keeps abuse-monitoring logs for up to 30 days, and Anthropic deletes inputs and outputs within 30 days.
We keep web-server logs and error diagnostics for a limited period, up to 90 days, so we can investigate security and reliability issues.
9. Your rights
You have rights over your personal data. If you are in the European Economic Area or the United Kingdom, you have the right under the GDPR to:
access the personal data we hold about you;
ask us to correct it (rectification);
ask us to delete it (erasure);
ask us to restrict how we use it;
receive a copy in a portable format (portability);
object to processing based on our legitimate interests;
withdraw consent you have given, at any time;
complain to a data protection supervisory authority. If you are in Spain, that authority is the Agencia Española de Protección de Datos (AEPD).
To exercise any of these rights, email support@answerthis.io. We respond within 30 days and verify your identity first.
California residents
Under the California Consumer Privacy Act you can ask us to disclose the categories and specific pieces of personal information we have collected about you, to provide a portable copy, and to delete it, subject to legal exceptions. We do not sell your personal information and will not discriminate against you for exercising your rights. You may use an authorised agent, and we will verify your identity first. Use the contacts in section 11.
10. Institutional accounts and single sign-on
If your access is provided by a university or employer, that institution is the data controller and AnswerThis acts as its processor under a Data Processing Agreement. We process content only to provide the service to the institution's users. The institution can see usage reports at an aggregate level, and cannot see the content of your work through any administrative tool.
Single sign-on uses SAML 2.0. We ask your identity provider for a persistent pseudonymous identifier, a SAML pairwise identifier or eduPersonTargetedID, and your scoped affiliation (eduPersonScopedAffiliation). Your email address is optional and is used only for notifications and support. We never receive your institutional password.
When your institution stops asserting your identity, you lose access at once. On the institution's instruction we disable or delete accounts within 5 business days.
11. Children, cookies, changes and contact
Children
The platform is for researchers and is not directed to children. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has given us personal information, contact us at support@answerthis.io and we will delete it.
Cookies
On app.answerthis.io we use only essential cookies, to keep you signed in and to keep your session secure. On our marketing site, answerthis.io, we may use analytics and advertising cookies, and where the law requires it we ask for your consent first. You can control cookies in your browser.
Changes to this policy
We may update this policy from time to time. When we make a material change, we will post a notice on the platform and, if you have given us your email address, we will email you. The effective date at the top shows when the current version took effect.
How to contact us
For any privacy question, email support@answerthis.io. You can also write to us at 1806 Summit Ave, Suite 300, Mailstop 242, Richmond, VA 23230, USA, or call +1 804 234 3569. Our data protection contact is Ayush Garg, ayush@answerthis.io.
Deep Point Ventures Inc., trading as AnswerThis. 1806 Summit Ave, Suite 300, Mailstop 242, Richmond, VA 23230, USA. support@answerthis.io. Privacy Policy version 2.1, effective 24 October 2026.
