AnswerPool — Privacy Policy
AnswerPool is an API for software. There are no user accounts, no cookies and no tracking. This policy explains exactly what we store, why, and for how long. The operator is AutoCortex LLC, a Texas limited liability company, contactable at support@answerpool.io, and is the controller of the data described here.
1. What we collect
Request records. For every HTTP or MCP request: timestamp, method, path, the query string (up to 512 characters — this includes the parameters you send, such as a ticker or a search term), response status, latency, the Host and User-Agent headers, the Referer header if your client sends one, which payment rail was used, and a salted SHA-256 hash of your network address. We do not store your IP address itself. For MCP calls we additionally store the tool name and up to 120 characters of the arguments (the product id and catalog search text).
Payment records. For card purchases: the Stripe checkout session id, the amount, and the resulting credit balance and spend events. We never see or store card numbers. API keys are stored only as a SHA-256 hash of a random secret. For x402 payments: the paying wallet address and the settlement record. Checkout session ids are redacted from our request log.
Answers. The response body we computed and sent you, its hash, its size, a structural summary of it (how many items each section contained), and the normalized parameters it was computed from.
Email. If you write to support@answerpool.io, we keep your message and address to answer it.
We collect nothing else. No names, no accounts, no profiles, no advertising identifiers.
2. Why we collect it, and our legal bases
To deliver and meter the Service and to refund failed calls (performance of our contract with you); to keep financial and tax records (legal obligation); to detect and prevent abuse, fraud and circumvention, to debug, and to understand demand for our products (our legitimate interests); and to keep a permanent, verifiable record of what we computed and served, which is the substance of the Service (legitimate interests, and performance where a dispute arises about what you received). We do not use your data for advertising, we do not sell or share it, and we do not use your request content to train models.
3. How long we keep it
| Data | Retained |
|---|---|
| Raw request records (query strings, User-Agent, Referer, hashed client) | 30 days, then permanently deleted |
| Daily traffic totals (day, method, path, status → counts) | Indefinitely. These contain no query strings, no user agents and no client identifiers |
| MCP tool arguments (up to 120 characters) | 30 days, with the raw request record. The permanent totals keep the tool name only |
| First-contact record: one row per client hash with the first path, query string, user agent and referer we ever saw from it | Indefinitely. Written once per client and never updated; it is how we know how a customer found us |
| Answers we computed and served, and their normalized inputs | Indefinitely. This is the core record of the Service |
| Payment and credit records (purchases, spends, refunds, hashed keys, wallet addresses) | Indefinitely, as financial records |
| Support email | Until it is no longer needed to answer you, then deleted on request |
4. Query content and answers
The parameters you send and the answers we return are stored as described above. They are never sold, shared or used for advertising. Do not put personal or confidential information into a query: our endpoints take identifiers and keywords about public records, and anything you send is stored for the periods in section 3.
5. Who processes data for us
Stripe (card payments and checkout — Stripe is the controller of your payment details under its own policy); Coinbase (its x402 facilitator verifies and submits USDC settlement on the Base network for x402 payments); Railway (application hosting and database); Cloudflare (CDN, TLS and network protection — it processes connection metadata under its own policy); OpenAI (only for the one LLM-scored product, under API terms that exclude training on API data). We also send queries to the public data sources we compute from (including the SEC, Federal Register, USAspending, NIH, openFDA, CISA, NIST, NWS, ClinicalTrials.gov and OpenAlex); those queries are about public records and do not include anything identifying you.
6. Blockchain payments are public
x402 payments settle on Base, a public blockchain. The paying wallet address, the amount and the transaction are public, permanent and outside our control. If you pay with a wallet that can be linked to you, that link is public.
7. Where we operate, and international transfers
The Service is operated from the United States, and all data described here is stored and processed in the United States. If you use the Service from outside the U.S., you are sending data to the U.S., which may have different data-protection rules than your country. Where transfers of personal data from the EEA or the UK require a transfer mechanism, we rely on the European Commission's standard contractual clauses, as do our processors.
8. Cookies and tracking
We set no cookies. Our pages load no analytics scripts, no tracking pixels, no third-party fonts and no third-party code of any kind. Stripe's checkout page is Stripe's own and uses Stripe's cookies under Stripe's policy.
9. Your rights
Depending on where you live, you may have the right to know what we hold about you, to get a copy, to correct or delete it, to object to or restrict processing, and to not be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act, and we have not done so in the preceding twelve months. We do not use personal information for targeted advertising and we do not profile people.
To exercise a right, email support@answerpool.io and tell us your credit key id (not the key itself) or your wallet address. We will tell you what we hold and delete what we can. Two limits, stated honestly: (a) records we must keep as financial records, and (b) the computed answers and their provenance, which are the substance of the Service and are pseudonymous — they are keyed to a hashed client or a wallet address, not to a name. We do not hold enough information to identify you unless you tell us who you are. If you are in the EEA or UK you may also complain to your supervisory authority.
10. Children
The Service is not directed to children, is not offered to anyone under 18, and we do not knowingly collect information from children. If you believe a child has provided information, email support@answerpool.io and we will delete it.
11. Security
Traffic is served over TLS with HSTS. API keys are stored only as SHA-256 hashes; a key is shown once at claim time and cannot be recovered. Client network addresses are stored only as salted hashes. Operator endpoints are token-gated and excluded from public documentation. We never store card data. No system is perfectly secure, and we cannot guarantee absolute security.
12. Breach notification
If we become aware of a breach affecting data described here, we will investigate, take corrective action, and notify affected users and regulators where the law requires it, without undue delay.
13. Public pages contain no personal data
Our public forecast ledger (/v1/evals), sample responses (/v1/samples) and product pages publish method-level tallies, scores and computed answers about public records. They contain no customer data. Operational telemetry is never published, sold or shared.
14. Changes
We may update this policy; the current version and its effective date are always at this URL. Material changes take effect 14 days after posting.