This Privacy Policy explains how [Legal entity name] ("we", "us", "our"), [Registered business address], collects, uses, and shares personal data when you use Quiralo and the website at quiralo.com (the "Service"). We are the data controller for the personal data described here.
1. Data we collect
Information you give us
- Account details: name, email address, password (stored hashed), or your Google profile if you sign in with Google.
- Your content: documents, chapters, comments, style samples, uploaded files, and chat messages you create in the Service.
- Publishing settings: details of external platforms you connect and the API keys you generate.
- Support messages: anything you send us by email.
Information collected automatically
- Usage data: features used, AI credit consumption, and timestamps.
- Technical data: IP address, browser type, device information, and logs needed for security and debugging.
- Cookies: essential cookies and local storage to keep you signed in. We do not use advertising cookies.
Payment information
Payments are processed by Paddle, our Merchant of Record. We never see or store your full card details. Paddle shares limited information with us, such as your name, email, country, subscription status, and the last digits of your card, so we can manage your subscription. Paddle's handling of your data is described in thePaddle Privacy Notice.
2. How we use your data
- To provide the Service, including running the AI features you request (performance of contract).
- To manage your account, subscription, and AI credits (performance of contract).
- To send service emails such as verification, password reset, and billing notices (performance of contract).
- To keep the Service secure, prevent abuse, and fix bugs (legitimate interests).
- To understand how the Service is used so we can improve it (legitimate interests).
- To meet legal, tax, and accounting obligations (legal obligation).
We do not sell your personal data, and we do not use your writing to train our own AI models.
3. AI processing
When you use an AI feature, the relevant part of your document and your instructions are sent to a third-party AI provider to generate a response. We use these providers through their APIs under terms that limit their use of the data to providing the service to us. Do not put sensitive personal information in your documents unless you are comfortable with it being processed this way.
4. Who we share data with
We share personal data only with service providers that help us run the Service:
- Paddle: Checkout, payment processing, tax, and invoicing (Merchant of Record)
- DeepSeek, OpenAI, and Alibaba Cloud (Qwen): AI text generation, style analysis, and article extraction
- Linkup: Web search for the research panel
- Google Firebase: Sign in with Google
- Resend: Transactional email (verification, password reset, billing notices)
- Amazon Web Services: File and image storage
We may also disclose data when required by law, to protect our rights or users' safety, or as part of a merger or acquisition, in which case we will notify you.
5. International transfers
Our providers may process data in countries other than yours, including the United States and China. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.
6. Retention
We keep your account data and content for as long as your account is active. When you delete content or your account, we delete it from our active systems, and it is removed from backups within 30 days. We keep billing records for as long as tax and accounting laws require.
7. Security
We use encryption in transit (HTTPS), hashed passwords, access controls, and monitoring to protect your data. No system is perfectly secure, so we cannot guarantee absolute security.
8. Your rights
Depending on where you live (including under the GDPR, UK GDPR, and CCPA), you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these rights, emailprivacy@quiralo.com. We will respond within 30 days. You also have the right to complain to your local data protection authority.
9. Children
The Service is not intended for children under 16. We do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
10. Changes to this policy
We may update this policy from time to time. If a change is material, we will notify you by email or in the app. The effective date at the top shows when it was last updated.
11. Contact
For privacy questions or requests, email privacy@quiralo.com.