Privacy Policy

1. Who we are and when this policy applies

HQE Systems Inc. ("HQE," "we," or "us") operates QaiS, QRM Workspaces, qais.app, and related web and mobile applications (the "Service"). This policy explains how HQE handles personal information in the Service and on our public sites.

For workspace content and personnel records submitted by an organization ("Customer Data"), the organization generally decides why and how the information is used, and HQE acts as its service provider or processor. For account registration, billing, security, support, sales, and our public sites, HQE may act as the business or controller. Users should also consult their organization's privacy notices.

2. Information we collect

• Account and contact information: name, business email, username, phone number, profile image, job details, workspace, authentication identifiers, and support or sales communications.
• Customer Data: messages, files, tasks, projects, leads, customer and vendor records, tickets, invoices, workforce records, calendar items, forms, and other content a user or integration submits.
• Usage, device, and security information: IP address, browser and device type, operating system, timestamps, pages and features used, session and authentication events, diagnostics, audit events, approximate location derived from IP, and precise or attendance location when an enabled feature requests it.
• Transaction information: plan, purchased seats, subscription and invoice status, and Stripe customer references. Payment processors receive payment-card details directly; HQE does not store full card numbers.
• Connected-service information: data and tokens needed for integrations Customer enables, such as email, calendar, communications, cloud storage, or financial-account connections.
• AI inputs and outputs: prompts, selected workspace context, generated results, feedback, and operational metadata when a user invokes an AI feature.
• Cookies and local storage: session, security, workspace routing, preferences, and similar information needed to operate the Service. We do not use third-party behavioral advertising cookies.

We receive information from users, Customer administrators, devices and browsers, enabled integrations, payment and infrastructure providers, and service logs. Customers choose much of the information placed in their workspace.

3. How we use information

• Provide, personalize, maintain, and support the Service.
• Create accounts, authenticate users, route workspaces, enforce permissions, and process subscriptions.
• Deliver requested communications, integrations, AI results, and automation.
• Protect users and the Service; prevent abuse, fraud, and security incidents; debug and monitor reliability.
• Analyze and improve performance, usability, and features using Customer instructions and aggregated or de-identified information.
• Respond to sales, support, privacy, and legal requests and enforce our agreements.
• Comply with law and establish, exercise, or defend legal claims.

HQE does not use or license Customer Data to train general-purpose AI models unless Customer gives an explicit written or in-product opt-in. AI providers may process only the content needed to return the feature a user requests, subject to applicable provider and Customer settings.

4. When we disclose information

We disclose personal information only as reasonably needed for the purposes above:

• Customer and authorized users: workspace administrators and users according to Customer's configuration and permissions.
• Service providers and subprocessors: hosting, databases, storage, security, communications, support, analytics, AI processing, and software operations.
• Payments: Stripe and related financial institutions for subscriptions, invoices, fraud prevention, and payment support.
• Customer-enabled integrations: a connected provider when a user or administrator enables and uses that integration. For example, Plaid may connect selected financial accounts; Slack or email/calendar providers may exchange selected workspace content.
• Professional and legal recipients: auditors, insurers, advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, or investigate abuse.
• Business transfers: a buyer, investor, lender, or successor in a financing, merger, reorganization, or sale, subject to appropriate confidentiality and continued protection.

HQE does not sell or share personal information for cross-context behavioral advertising, does not rent personal information, and does not disclose it to third parties for their independent direct marketing. If this practice changes, we will update this policy and provide legally required choices before the change applies.

5. Financial-account connections

If Customer enables a financial connection through Plaid, bank credentials are entered directly with Plaid and are not provided to HQE. HQE may receive the selected account's name, type, masked number, balance, and transaction details to provide imports, categorization, and reconciliation. Disconnecting stops new retrieval; already imported business records remain under Customer's control and applicable retention. Plaid handles information under its End User Privacy Policy.

6. Retention and deletion

We retain information while needed to provide the Service, fulfill Customer instructions, secure accounts, meet contractual and legal obligations, resolve disputes, and enforce agreements. Retention varies by information type, workspace settings, subscription status, and legal requirements. Security and audit records may be retained after account closure. Backups are protected and removed on their normal rotation.

A user may initiate account deletion in the mobile app or use our web deletion instructions. Removing an individual account ends that user's access, but an organization may retain shared business records it controls, subject to law and its own instructions. Workspace owners should export needed data and cancel billing separately before closing a workspace.

7. Security

We use safeguards designed for the nature and sensitivity of the information, including encrypted network transport, authentication and session controls, tenant and role authorization, logging, restricted administrative access, and backup and recovery practices. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. Please report suspected incidents to security@qais.app.

8. Privacy choices and rights

Depending on where you live and subject to exceptions, you may have rights to know or access personal information; obtain a portable copy; delete it; correct inaccurate information; limit certain uses of sensitive personal information; opt out of sale, sharing, or targeted advertising; and receive equal service without unlawful discrimination. We do not currently sell or share personal information as those terms are defined by California law.

Submit a request through your organization administrator, the deletion page, or privacy@qais.app. State the account email, workspace, request, and state or country. We may verify identity and authority, including an authorized agent's authority. If HQE processes the information only for an organization, we may direct the request to that organization. We will respond within the period required by applicable law and explain any denial or available appeal.

Because we do not sell or share personal information for behavioral advertising, we do not offer a separate sale/sharing opt-out link. We treat a recognized Global Privacy Control signal consistently with this stated practice.

9. International use and children

The Service is operated from the United States. Information may be processed in the United States and other locations where our providers operate, subject to contractual and legal safeguards where required. Enterprise customers needing specific data-location or transfer terms must address them in an order form or data-processing addendum.

The Service is for organizations and is not directed to children under 16. We do not knowingly collect personal information directly from children under 16. Contact us if you believe a child supplied information without appropriate authorization.

10. Changes

We may update this policy as the Service or law changes. We will post the new effective date and provide reasonable notice of material changes. We will not materially expand use of previously collected Customer Data without a lawful basis and appropriate notice or choice.

11. Contact