Privacy Policy

1. Who we are and what this Policy covers

QAAIFY [PLACEHOLDER: full legal name, jurisdiction of registration] ("we", "QAAIFY") provides a SaaS platform for evaluating and developing customer support teams. This Policy describes what data we process, for what purpose, and what rights users have.

Our role with respect to personal data depends on the context:

• When you visit our public website (landing page, registration page) or contact us before registering an account, we are the controller of your data: we independently determine the purpose and means of its processing.
• When an organization registers an account and uses the Service, the data of that organization's staff (team leads, agents) is processed by us as controller within the scope of account administration.
• Data of the client organization's end customers contained in support conversations (tickets, calls) — the client organization is the controller of this data, and QAAIFY acts as a processor on its behalf.

2. Definitions

• “Service” — the QAAIFY SaaS platform, including all its features.
• "Client" — a legal entity or sole proprietor that has registered an organization account in the Service.
• "User" — an individual to whom the Client has granted access to the Service (team lead, senior team lead, agent via the self-service portal).
• “Visitor” — an individual who browses our public website but does not have an account in the Service.
• "Client Content" — data that the Client or a connected helpdesk transmits to the Service: conversation content, call transcripts, user data, etc.
• “Our email” — the address for inquiries regarding this Policy, specified in Section 10 below.
• The terms “personal data,” “controller,” “processor,” “processing,” “data subject consent,” “data subject,” and “personal data breach” have the meanings defined by the GDPR (Regulation (EU) 2016/679).

3. Purposes of processing

We process personal data for the following purposes:

• registering and administering an account in the Service;
• providing the Service itself (AI evaluation, coaching, reports, etc.);
• communicating with you, including marketing messages about the product (which you can opt out of);
• compliance with legal requirements;
• ensuring and improving the security of the Service, investigating misuse;
• improving the Service as a product.

4. Processing principles

When processing personal data, we adhere to the following principles:

• Lawfulness, fairness, and transparency — processing based on consent or legitimate interest, carried out openly and clearly.
• Purpose limitation — data is used only for the purposes specified in Section 3.
• Data minimization — we collect only what is genuinely necessary for the stated purposes.
• Accuracy — you can keep your data up to date, and we update it upon your request.
• Storage limitation — we retain data only for as long as necessary (Section 8).
• Integrity and confidentiality — we apply technical and organizational security measures (Section 6).
• Accountability — we are responsible for complying with this Policy and GDPR requirements.

5. What data we process

• The content of support conversations (ticket text, call transcripts) received from a connected helpdesk (Zendesk, Freshdesk, Intercom, Salesforce Service Cloud) — for AI evaluation of service quality.
• Account data of the client organization's staff: name, email, role.
• Technical metadata: IP address, request time, User-Agent — for security and rate limiting.
• Payment data is processed by our payment partner (Merchant of Record) — card numbers are not passed to us or stored by us.

6. How we protect data

• API keys and access tokens to client systems are encrypted at rest (Fernet) with a separate key, distinct from the application's session key.
• Each organization's data is isolated at the application level (org_id on every request) — Row-Level Security at the database level is additionally being piloted for the most sensitive evaluations table.
• Automated heuristics detect prompt injection attempts in conversation content before it's sent to the AI provider.
• Backups: daily, with periodic automated recoverability checks [PLACEHOLDER: confirm whether this is enabled in the production environment].
• In the event of a personal data breach affecting you, we will notify you as soon as possible and provide the information necessary to fulfill your own notification obligations (if applicable) and those of regulators.

7. AI processing and third parties

For AI evaluation, conversation content is sent to one of the providers (OpenAI, Anthropic, Google Gemini) — the specific provider is chosen by the client organization in settings. We do not use client conversation content to train our own models.

Other services that may receive a limited set of data:

• Payment provider (subscription processing).
• Error monitoring service — deliberately does NOT receive client conversation content (send_default_pii disabled).
• S3-compatible storage for database backups.

[PLACEHOLDER: full list of sub-processors and links to their own privacy policies — to be confirmed with legal.]

8. How long we retain data

The application has an automated mechanism for deleting stale data (conversation cache and similar) on a schedule. Exact retention periods for each data category: [PLACEHOLDER — to be confirmed with the business, with specific values to be filled in].

9. Data subject rights

With respect to your personal data, you have the right:

• to information — receive clear information about what data we process, how and with whom we share it, and how long we retain it (this Policy and direct contact with us);
• to access — obtain a copy of your personal data;
• to rectification — correct inaccurate or incomplete data;
• to erasure (“right to be forgotten”) — delete your data when it is no longer necessary for the purposes of processing or you have withdrawn consent;
• to withdraw consent — at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• to restrict processing — under certain circumstances (for example, if you dispute the accuracy of the data);
• to data portability — receive your data in a structured, machine-readable format;
• to object — object to processing based on our legitimate interest, including for direct marketing purposes;
• to lodge a complaint — file a complaint with the relevant data protection authority if you believe your rights have been violated.

Requests regarding an organization's end-customer data should first be directed to that organization (the data controller). To exercise any of the rights above, write to support@qaaify.com.

10. Data protection contact

Questions about this Policy and requests regarding your personal data can be sent to: support@qaaify.com.

[PLACEHOLDER: whether a separate formal Data Protection Officer and/or EU representative is required (GDPR Art. 27) — depends on the scale of processing EU clients' data, to be confirmed with a lawyer.]

11. Changes to this Policy

We may update this Policy. Material changes will be communicated to client organizations in advance.