Privacy Policy

1. Who we are and what this Policy covers

QAAIFY [PLACEHOLDER: full legal name, jurisdiction of registration] ("we", "QAAIFY") provides a SaaS platform for evaluating and developing customer support teams. This Policy describes what data we process, for what purpose, and what rights users have.

Our role with respect to personal data depends on the context:

• When you visit our public website (landing page, registration page) or contact us before registering an account, we are the controller of your data: we independently determine the purpose and means of its processing.
• When an organization registers an account and uses the Service, the data of that organization's staff (team leads, agents) is processed by us as controller within the scope of account administration.
• Data of the client organization's end customers contained in support conversations (tickets, calls) — the client organization is the controller of this data, and QAAIFY acts as a processor on its behalf.

2. Definitions

• “Service” — the QAAIFY SaaS platform, including all its features.
• "Client" — a legal entity or sole proprietor that has registered an organization account in the Service.
• "User" — an individual to whom the Client has granted access to the Service (team lead, senior team lead, agent via the self-service portal).
• “Visitor” — an individual who browses our public website but does not have an account in the Service.
• "Client Content" — data that the Client or a connected helpdesk transmits to the Service: conversation content, call transcripts, user data, etc.
• “Our email” — the address for inquiries regarding this Policy, specified in Section 10 below.
• The terms “personal data,” “controller,” “processor,” “processing,” “data subject consent,” “data subject,” and “personal data breach” have the meanings defined by the GDPR (Regulation (EU) 2016/679).

3. Purposes of processing

We process personal data for the following purposes:

• registering and administering an account in the Service;
• providing the Service itself (AI evaluation, coaching, reports, etc.);
• communicating with you, including marketing messages about the product (which you can opt out of);
• compliance with legal requirements;
• ensuring and improving the security of the Service, investigating misuse;
• improving the Service as a product.

4. Processing principles

When processing personal data, we adhere to the following principles:

• Lawfulness, fairness, and transparency — processing based on consent or legitimate interest, carried out openly and clearly.
• Purpose limitation — data is used only for the purposes specified in Section 3.
• Data minimization — we collect only what is genuinely necessary for the stated purposes.
• Accuracy — you can keep your data up to date, and we update it upon your request.
• Storage limitation — we retain data only for as long as necessary (Section 8).
• Integrity and confidentiality — we apply technical and organizational security measures (Section 6).
• Accountability — we are responsible for complying with this Policy and GDPR requirements.

5. What data we process

• Support ticket content (ticket text, call transcripts) obtained from the connected helpdesk (Zendesk, Freshdesk, Intercom, Salesforce Service Cloud, HubSpot Service Hub) — for AI evaluation of service quality.
• Account data of the client organization's staff: name, email, role.
• Technical metadata: IP address, request time, User-Agent — for security and rate limiting.
• Payment data is processed by our payment partner (Merchant of Record) — card numbers are not passed to us or stored by us.

6. How we protect data

• API keys and access tokens to client systems are encrypted at rest (Fernet) with a separate key, distinct from the application's session key.
• Each organization's data is isolated at the application level (org_id on every request) — Row-Level Security at the database level is additionally being piloted for the most sensitive evaluations table.
• Automated heuristics detect prompt injection attempts in conversation content before it's sent to the AI provider.
• Backups: daily, with periodic automated recovery verification — enabled in the production environment.
• In the event of a personal data breach affecting you, we will notify you as soon as possible and provide the information necessary to fulfill your own notification obligations (if applicable) and those of regulators.

7. AI processing and third parties

For AI evaluation, ticket content is sent to one of the providers (OpenAI, Anthropic, Google Gemini) — the specific provider is chosen by the client organization in its settings, and the organization enters its own access key. We do not use client ticket content to train our own models.

Other services that may receive a limited set of data:

• Payment provider (subscription processing).
• Error monitoring service — deliberately does NOT receive client conversation content (send_default_pii disabled).
• S3-compatible storage for database backups.
• Optional, only if the Client has activated it: Slack/Microsoft Teams (notifications), Confluence/Notion (knowledge base sync).

The full list of technical providers is on a separate Subprocessor List. The rules for processing personal data that the Client submits to the Service as controller are described in more detail in a separate Data Processing Agreement (DPA). The rules for using AI features are set out in a separate AI Use Policy.

7a. Transfer of data outside Ukraine

We may transfer or provide access to data outside Ukraine where necessary for the operation of the Service — in particular through the use of international AI, cloud, helpdesk, email, and other technical providers listed in Section 7 above. We carry out any such transfer in accordance with applicable law and our contractual data-protection obligations.

8. How long we retain data

• Ticket text (conversation cache): if the client organization has enabled automatic purging in its settings — 365 days by default (the period is configurable by the organization). The AI evaluation itself (score, criteria, quality trends) is not deleted along with the text and remains for long-term analytics.
• The AI evaluation's compliance record (for the EU AI Act): at least 730 days — this minimum applies regardless of the text-purging settings above; the system does not allow a shorter period to be set.
• Database backups: 14 days (rotation).

9. Data subject rights

With respect to your personal data, you have the right:

• to information — receive clear information about what data we process, how and with whom we share it, and how long we retain it (this Policy and direct contact with us);
• to access — obtain a copy of your personal data;
• to rectification — correct inaccurate or incomplete data;
• to erasure (“right to be forgotten”) — delete your data when it is no longer necessary for the purposes of processing or you have withdrawn consent;
• to withdraw consent — at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• to restrict processing — under certain circumstances (for example, if you dispute the accuracy of the data);
• to data portability — receive your data in a structured, machine-readable format;
• to object — object to processing based on our legitimate interest, including for direct marketing purposes;
• to lodge a complaint — file a complaint with the relevant data protection authority if you believe your rights have been violated.

Requests regarding an organization's end-customer data should first be directed to that organization (the data controller). To exercise any of the rights above, write to support@qaaify.com.

10. Data protection contact

Questions about this Policy and requests regarding your personal data can be sent to: support@qaaify.com.

No separate formal Data Protection Officer and/or EU representative (GDPR Art. 27) has been appointed — given the current scale of processing EU clients' data, this is not necessary.

11. Changes to this Policy

We may update this Policy. Material changes will be communicated to client organizations in advance.