---
title: "AnswerRail Privacy Policy & Edge Verification Architecture (v1.1.0-parity-v20)"
canonical: "https://answerrail.com/privacy"
effective_date: "2026-10-03"
release_version: "v1.1.0-parity-v20"
data_controller: "Tarquin Barnsby (trading as AnswerRail / The Quite Good Project)"
ico_registration: "ZC136598"
signing_kid: "ar_ed25519_2026_k1"
public_key_x: "W3Ce5nykyharINhDTj_EL5JtdEkz0_bcXrDsDN-vy3Y"
jwks_uri: "https://answerrail.com/.well-known/http-message-signatures-directory"
release_manifest_url: "https://answerrail.com/releases/v1.1.0-parity-v20/manifest.json"
---

# AnswerRail Privacy Policy & Edge Verification Architecture (v1.1.0-parity-v20)

## 1. Data Controller Identity & Ephemeral Edge Processing
- **Data Controller**: Tarquin Barnsby (trading as AnswerRail / The Quite Good Project), registered in the United Kingdom with the Information Commissioner's Office (ICO Registration Number: `ZC136598`). Contact: `privacy@answerrail.com` / `ops@answerrail.com`.
- **Edge Proxy Header Hygiene (`fetchOrigin` in `src/core/fetcher.ts`)**: AnswerRail compiles origin HTML into Markdown in-memory within Cloudflare V8 isolates. Outbound origin subrequests intentionally omit caller `Cookie`, `Authorization`, and `Accept-Language` headers so caller-specific credentials or locale preferences are never forwarded or cached, and `Set-Cookie` headers are stripped on cacheable edge responses.

## 2. Categories of Data Processed & Lawful Basis (UK GDPR / EU GDPR Art. 6)
- **A. Customer Account & Billing Data (Art. 6(1)(b) — Performance of a Contract)**: Administrative email address, generated license keys, configured domain hostnames, and Stripe Customer/Subscription IDs (payment card numbers are processed directly by Stripe, Inc.).
- **B. Edge Security & Abuse Rate-Limiting (Art. 6(1)(f) — Legitimate Interests)**: To protect the public `/proxy` endpoint against SSRF and denial-of-service abuse, `src/routes/live-proxy.ts` maintains an ephemeral in-memory rate-limit map (`LIVE_PROXY_RATE_MAP`) keyed by client IP (`CF-Connecting-IP`) enforcing a maximum of 30 requests per rolling 10-minute window, evicted automatically upon window expiry.
- **C. Aggregated Bot Telemetry & First-Party AI Referral Attribution (Art. 6(1)(f) — Legitimate Interests)**:
  - **Bot Crawl Telemetry**: Request timestamp, HTTP status code, AI crawler User-Agent token (`PerplexityBot`, `OAI-SearchBot`, `ClaudeBot`), requested URL path, and HTML-to-Markdown byte metrics.
  - **First-Party Referral Cookie (`__ar_ai_ref`)**: When a human browser visits an AnswerRail route with an HTTP `Referer` header matching an AI answer engine (`perplexity.ai`, `chatgpt.com`, `claude.ai`, `copilot.microsoft.com`, or `gemini.google.com`), `src/index.ts` increments an aggregate per-hostname referral counter in KV and sets a first-party attribution cookie (`__ar_ai_ref=<source>; Path=/; Max-Age=2592000; SameSite=Lax`, 30-day expiry). No third-party advertising or cross-site tracking cookies are used.

## 3. Infrastructure Subprocessors, Retention & Data Subject Rights
- **Subprocessors**: **Cloudflare, Inc.** (Anycast V8 isolate execution, Cache API, Workers KV) and **Stripe, Inc.** (PCI-DSS Level 1 payment processing and invoicing), governed by the UK International Data Transfer Addendum and EU Standard Contractual Clauses.
- **Retention Schedule**: Ephemeral IP rate-limit entries expire within 10 minutes; edge Markdown cache entries expire per `Cache-Control` TTL (up to 3,600s default or immediately via `POST /api/purge`); `__ar_ai_ref` attribution cookies expire after 30 days; customer account configurations are retained while the subscription is active and erased within 30 days of account deletion request (statutory billing/tax records retained by Stripe for 7 years).
- **Statutory Data Subject Rights**: Under UK GDPR and EU GDPR (Articles 15–21), individuals have the right to request access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests by emailing `privacy@answerrail.com`. You also have the right to lodge a complaint with the UK Information Commissioner's Office ([https://ico.org.uk](https://ico.org.uk), registration `ZC136598`) or your local EU/EEA supervisory authority.

## 4. Fail-Closed Representation Parity Gates vs. Fail-Open Service Pass-Through (`v1.1.0-parity-v20`)
AnswerRail enforces a strict architectural separation between **Representation Selection (Fail-Closed)** and **Service Availability (Fail-Open)**:
- **Fail-Closed Representation Gate (`extractIndependentStaticReference` in `src/core/transformer.ts`)**: Before serving any compiled Markdown, an independent regex/scanner verification pass inspects the raw origin HTML (independently of Linkedom and Turndown) to extract all visible currency/price tokens (`$`, `£`, `€`, `¥`), collapsed FAQ/accordion answers (`data-state="closed"`, `hidden`, `<details>`, `<dd>`), and main-content anchor links. If `currencyRecallRatio < 1.0`, `faqAnswerRecallRatio < 1.0`, `linkRecallRatio < 1.0`, or raw HTML exceeds `2,097,152` bytes (`2 MiB`, `truncated: true`), the proxy **fails closed on the Markdown representation**—refusing to emit or cache incomplete Markdown. Outbound origin fetches enforce a `10,000ms` timeout in `src/core/fetcher.ts`, and `@answerrail/next` middleware enforces a configurable `timeoutMs` (default `3,500ms`).
- **Unified Fallback Diagnostics Header Contract (`src/routes/live-proxy.ts`)**: When a parity gate or `2 MiB` truncation check blocks a Markdown transform, the proxy **fails open to unmodified raw origin HTML** with the exact canonical 5-header set:
  - `Cache-Control: no-store, no-cache, must-revalidate`
  - `X-AnswerRail-Cache: BYPASS`
  - `X-AnswerRail-Failsafe: FAIL_CLOSED_ORIGIN_HTML`
  - `X-AnswerRail-Fallback: origin-html`
  - `X-AnswerRail-Routing: fail-closed-origin-truncated | fail-closed-currency-shortfall | fail-closed-faq-recall-shortfall | fail-closed-link-recall-shortfall`

## 5. RFC 9110 Canonical Cache Key, 5-Tier `Cache-Control` Policy & Pre-Cache `robots.txt` Enforcement
- **Canonical Cache Key (`createMarkdownCacheKey` in `src/services/cache.ts`)**: While responses include `Vary: User-Agent, Accept` for RFC 9110 § 12.5.5 compliance, Cloudflare edge cache storage keys are normalized to the exact runtime URL format:
  `https://cache.answerrail.internal/__ar_markdown_v1?target=<canonicalTarget>&lod=<compact|standard|deep>&mode=<twin|ast>[&schema=1]`
  where `&schema=1` is appended when `schema=true` or `lod=deep`. URL fragments (`#section`) are stripped, and all eligible AI retrieval crawlers share a single canonical Markdown cache entry per `(target, lod, mode, schema)`, preventing `User-Agent` cache fragmentation while guaranteeing `Googlebot` and human browsers never hit the Markdown cache.
- **5-Tier `Cache-Control` Contract**:
  1. **Documentation & Specification Routes (`/vs/*`, `/security`, `/privacy`, `/research`, `/pricing`, `/llms.txt`)**: Emit `Cache-Control: public, max-age=60, must-revalidate` (60-second freshness window with mandatory revalidation on expiry, paired with `POST /api/purge` edge cache invalidation).
  2. **Compiled `/proxy` Markdown Responses (`computeDownstreamCacheControl` in `src/services/cache.ts`)**: Honor restrictive origin `Cache-Control` directives (`no-store`, `private`, `no-cache`) by returning `Cache-Control: no-store, no-cache, must-revalidate` (or `Cache-Control: public, max-age=0, must-revalidate` when origin `max-age=0`/`s-maxage=0`) and bypassing edge cache storage (`X-AnswerRail-Cache: BYPASS`); otherwise emit `Cache-Control: public, max-age=<min(14400, originTtl)>[, must-revalidate]` (defaulting to `Cache-Control: public, max-age=3600, must-revalidate` when origin specifies no TTL).
  3. **Fail-Closed Parity Fallback Responses (`src/routes/live-proxy.ts`)**: Emit `Cache-Control: no-store, no-cache, must-revalidate` and `X-AnswerRail-Cache: BYPASS`.
  4. **Next.js Middleware (`@answerrail/next` in `src/middleware.ts`)**: Strips upstream cache headers and emits `Cache-Control: private, no-cache, no-store, max-age=0, s-maxage=0, must-revalidate` and `CDN-Cache-Control: no-store`.
  5. **Disallowed `robots.txt` Responses (`403 Forbidden` in `src/routes/live-proxy.ts`)**: Emit `Cache-Control: private, no-store` and `X-AnswerRail-Cache: BYPASS`.
- **Pre-Cache RFC 9309 `robots.txt` Gate (`checkOriginRobotsTxt` in `src/core/fetcher.ts`)**: Origin `/robots.txt` rules are evaluated per bot product token *before* any edge cache lookup, using manual redirect following (max 5 hops) with `verifyResolvedHostSafety` SSRF protection on every hop. Disallowed crawlers receive `403 Forbidden by robots.txt` with `Cache-Control: private, no-store` and `X-AnswerRail-Cache: BYPASS`.

## 6. Asymmetric Ed25519 RFC 9421 Cryptographic Provenance (`kid="ar_ed25519_2026_k1"`)
AnswerRail implements two distinct asymmetric Ed25519 signing operations in `src/services/provenance.ts` per IETF RFC 9421 & RFC 9530, attesting AnswerRail edge compilation provenance:
- **Public Key Discovery Directory**: `https://answerrail.com/.well-known/http-message-signatures-directory` and `https://answerrail.com/.well-known/answerrail-proxy.json`
- **Public Key JWK**:
```json
{
  "kty": "OKP",
  "crv": "Ed25519",
  "kid": "ar_ed25519_2026_k1",
  "use": "sig",
  "alg": "EdDSA",
  "key_ops": ["verify"],
  "ext": true,
  "x": "W3Ce5nykyharINhDTj_EL5JtdEkz0_bcXrDsDN-vy3Y"
}
```
- **Operation A — Outbound Origin Subrequest Signing (`signOutboundOriginRequest`, `tag="web-bot-auth"`)**:
  `Signature-Input: sig1=("@method" "@authority" "@target-uri" "signature-agent" "x-answerrail-timestamp");created=<unix_s>;expires=<created+300>;nonce="<16B_base64url>";keyid="ar_ed25519_2026_k1";alg="ed25519";tag="web-bot-auth"`
- **Operation B — Compiled Markdown Response Signing (`generateProvenanceHeaders`, `tag="answerrail-response-provenance"`)**:
  `Signature-Input: sig1=("content-digest" "@target-uri";req);created=<unix_s>;expires=<created+300>;nonce="<16B_base64url>";keyid="ar_ed25519_2026_k1";alg="ed25519";tag="answerrail-response-provenance"`
  where `content-digest` is the RFC 9530 SHA-256 digest (`sha-256=:<base64>:`) of the compiled Markdown body and `"@target-uri";req` is the RFC 9421 § 2.4 request-derived target URI. Both operations enforce bounded stateful single-use nonce replay tracking (`checkAndRecordReplayNonce`). On edge cache `HIT`, stale `Signature*` headers are stripped before invoking `reSignFn`; if `reSignFn` fails or is unconfigured, stale signatures remain removed and `Content-Digest` / `X-AnswerRail-Content-SHA256` are recomputed directly.

## 7. Contact & Data Protection Officer
Email: `privacy@answerrail.com` · `ops@answerrail.com`

---
*AnswerRail Technical Documentation · Release v1.1.0-parity-v20 · Canonical Spec: https://answerrail.com/privacy*