This Privacy Policy explains how Yousef Abdullah (a sole trader trading as Attestly) (“Attestly”, “we”) collects, uses, and protects information when you use Attestly (the “Service”).
We use your information solely to provide and operate the Service: to authenticate you, to generate and store answers to your questionnaires, to enforce plan limits, and to process payments. We do not sell your data, and we do not use Your Content to train our own or any third party’s AI models.
To generate answers, Attestly sends the relevant questionnaire questions and excerpts of the documents and prior answers you provide to third-party AI providers via their APIs. These providers process the data to return a drafted answer or a semantic match and, under their API terms, do not use API inputs to train their models. We share the minimum necessary and only to deliver the Service to you.
| Subprocessor | Purpose | Data shared |
|---|---|---|
| Anthropic (Claude API) | Draft answers from your context | Question text + relevant document/answer excerpts |
| Voyage AI | Semantic matching (embeddings) | Question and answer/document text |
| Stripe | Payments & billing | Billing details (handled by Stripe) |
| Render | Application hosting | Service data in transit/at rest |
| Supabase | Database hosting | Account data, Your Content |
| Vercel | Frontend/app hosting | Static app assets; no document content |
Keep this table accurate to your live configuration. If you disable a provider (e.g., semantic search), remove it.
Application and database hosting. Your account data and the content you upload (questionnaires, policies, and answers) are stored in our primary hosting region, the United States (Render for the application, Supabase for the database). EU (Frankfurt) hosting is available for eligible plans and on request to support data-residency requirements, including for customers in the EU and the GCC.
AI processing. When an answer is drafted or semantically matched, the relevant question text and short document/answer excerpts are sent to our AI subprocessors (Anthropic and Voyage AI), which process this data in the United States under API terms that prohibit training on your inputs. We send the minimum necessary and never the whole document unless it is needed to answer a specific question.
UAE / GCC customers. We can execute a Data Processing Agreement reflecting the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), and, where applicable, DIFC and ADGM data-protection regulations. See our Data Processing Agreement.
We retain Your Content for as long as your account is active so the Service can reuse your approved answers. You can delete documents in the app at any time. On account closure, we delete or anonymize your data within a reasonable period, except where retention is required by law. To request deletion, contact us at hello@tryattestly.com.
Depending on your location (e.g., under GDPR or CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact hello@tryattestly.com. If we process personal data on your behalf as a processor, we will support your obligations to your own customers, including via a Data Processing Agreement on request.
The app stores an authentication token in your browser’s local storage to keep you signed in. We do not use third-party advertising or tracking cookies.
Your data may be processed in countries other than your own (including where our subprocessors operate — see §3a). Where required, we rely on appropriate safeguards such as Standard Contractual Clauses and equivalent mechanisms recognised under applicable law, including the GDPR and the UAE Personal Data Protection Law (PDPL).
The Service is not directed to individuals under 18, and we do not knowingly collect their data.
We may update this policy; material changes will be posted here with a new “Last updated” date.
Questions or requests: hello@tryattestly.com.