Privacy Policy

QuantCX is provided by [Legal entity name], [Registered address] ("QuantCX", "we", "us"). This policy explains how we handle personal data when you visit our website, create an account or use the Service described in our Terms of Service.

Two roles. For account, billing and website data we decide how the data is used, so we are the controller. For the conversations, tickets, contacts and knowledge that our customers put into the Service about their own end users, the customer is the controller and we act as their processor, following their instructions. If you are an end user of one of our customers, please contact that business about your data first.

• Account data: name, email address, password (stored hashed), workspace name, role and preferences.
• Billing data: plan, invoices and billing contact. Card details are handled by our payment provider; we do not store full card numbers.
• Customer content: knowledge sources, instructions, conversations, tickets, notes, contacts and files that you or your end users provide through the Service.
• Usage and device data: log data, IP address, browser and device type, pages viewed, feature usage and error reports.
• Communications: messages you send to our support team and your email preferences.

• to provide, operate and secure the Service, including generating AI answers from your knowledge;
• to process payments and manage your subscription;
• to provide support and send service messages such as security alerts and billing notices;
• to understand usage and improve the product, using aggregated or de-identified data where possible;
• to send product news and marketing, only where permitted and with an easy way to opt out;
• to comply with legal obligations and enforce our Terms.

To answer questions, the Service sends relevant parts of your instructions, knowledge sources and the current conversation to AI model providers that process them on our behalf. We do not use customer content to train general-purpose AI models, and we select providers that do not use API data for training.

AI output can be wrong. Customers control their agents' instructions, knowledge and escalation rules and are responsible for reviewing how their agents behave.

Where the GDPR or similar laws apply, we rely on: performance of a contract (to provide the Service), legitimate interests (to secure and improve the Service and to market to business customers), consent (for optional cookies and certain marketing), and legal obligation (for tax and accounting records).

We do not sell personal data. We share it only with:

• service providers that help us run the Service, such as cloud hosting, AI model providers, email delivery, payment processing, error monitoring and analytics, bound by contracts that limit their use of the data;
• integrations you choose to connect, which receive data according to your settings;
• authorities or other parties where the law requires it, or to protect rights and safety;
• a buyer or successor in a merger or acquisition, subject to this policy.

A current list of subprocessors is available on request.

Our providers may process data outside your country. When personal data leaves the EEA, UK or Switzerland, we use safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

We keep account data while your account is active. Customer content is kept for as long as the customer keeps it in the Service and is deleted within 30 days after a workspace is deleted, except for backups, which roll off on a fixed schedule, and records we must keep by law.

We protect data with encryption in transit and at rest, access controls, logging and regular review of our systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, and we will notify affected customers of a personal data breach as the law requires.

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, to withdraw consent, and to complain to a data protection authority. California residents have the right to know, delete and correct personal information and to opt out of its sale or sharing; we do not sell or share personal information for cross-context advertising.

To exercise these rights, contact us at [Privacy contact email]. End users of our customers should contact the business they interacted with.

We use essential cookies and local storage to keep you signed in and remember preferences such as the theme. With your consent, we may use analytics cookies to understand how the website is used. You can change cookie choices in your browser at any time.

The Service is not directed to children under 16, and we do not knowingly collect their personal data as a controller.

We may update this policy. If a change is material, we will notify account owners by email or in the dashboard before it takes effect.

[Legal entity name], [Registered address]. Privacy questions: [Privacy contact email].