Privacy Policy

1) Who we are

Controller: QualPal (operated by Tolga Varol)

Contact: privacy@qualpal.com

2) Personal data we may collect

• Account data: name, email, organization, role, authentication identifiers.
• Usage data: IP address, device/browser information, logs, and usage events.
• Support data: messages you send us and information you choose to share.
• Customer content: audio/video, transcripts, and notes processed in the Service.
• Billing metadata: plan, invoice IDs, country, taxes (payments handled by Paddle).

3) How we use data

• Provide and secure the Service (authentication, access control, fraud prevention).
• Operate and improve the Service (analytics, performance, debugging).
• Communicate with you (service emails, support, product updates).
• Comply with legal obligations (accounting/tax, lawful requests).

4) Legal bases (GDPR)

• Contract (to deliver the Service you request).
• Legitimate interests (security, service improvement, preventing abuse).
• Consent (where required, e.g., certain cookies/marketing).
• Legal obligation (accounting/tax and compliance).

5) Retention

We keep personal data only as long as needed for the purposes above:

• Account data: while your account is active, then deleted/anonymized within 30 days.
• Customer content: deleted within 90 days after deletion/closure unless required by law.
• Logs: retained for 30 days for security and debugging.

6) Sharing with processors (including Paddle)

We use service providers to run the Service (hosting, email, analytics, customer support). Where these providers process personal data on our behalf, they act as processors.

Payments / Merchant of Record: Purchases are processed by Paddle as Merchant of Record. Paddle processes checkout and payment information to complete transactions. We do not store full payment card details. You can review Paddle’s privacy policy here: https://www.paddle.com/legal/privacy.

7) International transfers

If personal data is transferred outside the EEA/UK, we use appropriate safeguards (e.g., Standard Contractual Clauses or adequacy decisions) and apply security measures.

8) Security

We apply appropriate technical and organizational measures (access controls, encryption in transit, least-privilege access). No online service can guarantee absolute security.

9) Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, object, or port your data. To exercise rights, email privacy@qualpal.com.

10) Cookies

We may use essential cookies for site functionality and optional analytics cookies. You can control cookies via your browser settings.

11) Changes

We may update this policy. We will post the new version and update the effective date above.