Privacy contact: [email protected].
Effective date: 26 September 2026.
Who is responsible.
QualiRelay is currently offered to businesses in the United States and Canada. Our Privacy Officer is accountable for our privacy practices and can be reached at [email protected]. Contact the Privacy Officer for questions, complaints, our privacy policies, accountable operator details or information about transfers and safeguards. For general service questions, contact [email protected].
When you contact QualiRelay, request an assessment or use an account, QualiRelay handles its own prospect, account and service records. This is separate from inquiry data a customer submits to a workspace: we process that data on the customer’s instructions. Requests about customer-controlled inquiries are directed to the responsible customer, with tracked assistance where applicable. You do not need a workspace or a customer’s permission to ask about QualiRelay’s own records.
What we collect and why.
An email or assessment request provides contact and business information: name, business email, company, declared country, optional state or province, workflow question and optional self-reported source. We use it to respond, assess fit and provide support. Do not send prospect lists, sensitive personal information, card details or credentials in a public request.
Account and workspace records include identity-provider identifiers, verified contact details, membership, permissions, authentication events and customer-approved settings. Workspace processing uses the inquiry information, CRM evidence and delivery or response events authorized by the customer to qualify inquiries, assign ownership and record the handoff. Billing records include plan, usage, invoice and payment status; Stripe handles payment details through its hosted payment services.
We also process technical request and security information, such as network addresses, request timestamps, validation results and limited diagnostic records, to operate the service, prevent abuse, investigate incidents and meet applicable obligations. Application diagnostics are designed to exclude form bodies, contact information and secrets.
Educational marketing requires separate optional consent. Requesting an assessment does not subscribe you to a campaign, accept workspace processing terms or authorize payment. We use consent and suppression records to respect communication choices.
Service providers and customer connections.
Cloudflare provides site delivery, network protection, inbound email routing and, where configured, private object storage. A hosting provider supplies application, worker and database infrastructure. Clerk handles identity, sessions and authentication emails; Stripe handles payments, subscriptions and invoicing; Resend delivers application and administrative emails when that feature is configured. An email inbox provider receives and stores correspondence sent to our contact addresses. Service providers receive the information needed for their role, subject to applicable processing terms and enabled features.
HubSpot and Slack are customer-connected systems. Customers authorize the relevant CRM fields, mappings and Slack channels; their own agreements and privacy practices apply to those systems. Optional enrichment and model assistance begin disabled and require separate approval. The provider register describes these roles and optional services.
We may disclose necessary information to comply with law, protect people or the service, or carry out an authorized business transfer with applicable safeguards. We do not sell personal information or share it for cross-context behavioral advertising. This does not prevent the service-provider processing or customer-directed connections described above.
International processing.
Personal information may be processed, stored or accessed outside your jurisdiction by QualiRelay and its service providers. Applicable laws there may permit access by courts, law enforcement or other authorities. We use applicable contractual, organizational and technical safeguards and assess transfers as required. Email [email protected] to obtain our written policies on service providers outside your jurisdiction, including the processing countries, purposes and applicable safeguards, or to ask the Privacy Officer about those practices.
Optional measurement and browser signals.
The public site has no advertising pixels, fingerprinting, session replay or external visitor-analytics vendor. Necessary form operation does not depend on optional tracking permission.
If you enable optional attribution, the site can retain a clean landing path, an allowlisted search-referrer hostname, content reference and timestamp for up to 90 days. An expiring context token can associate that consented context with an assessment or a new workspace. It provides no account access or payment authority. Arbitrary query strings and prospect message bodies are excluded.
Preference storage records your choice, not a unique visitor identifier. Refusal stops optional attribution collection. Withdrawal clears optional context in this browser and requests revocation and removal of linked server context. If that cannot be confirmed, contact the Privacy Officer. Global Privacy Control prevents optional attribution without disabling necessary functions. Do Not Track browser signals do not change how the site operates; the site does not track visitors across other websites for advertising.
Review or withdraw your preferences. Clearing storage or changing browsers can reset your choice. Email marketing preferences are handled separately through the authorized preference link or the Privacy Officer.
Retention and deletion.
Assessment request content has a default retention period of 180 days, subject to a documented hold. Optional attribution has a maximum 90-day lookback. For customer inquiry processing, technical defaults are 30 days for accepted raw intake and permitted raw provider payloads, 365 days for permitted normalized inquiry and decision history, and 14 days for diagnostics. Customer settings, contractual requirements and provider rights can shorten these periods.
We retain other correspondence, account and service records only as long as needed for their purpose and applicable obligations. Minimal consent, suppression, security, dispute and financial evidence can have a separate retention period. Backup retention and contractual schedules are addressed in the applicable service arrangements; a backup is not a reason to restart erased processing.
Authorized erasure suppresses further relevant processing and schedules removal of permitted active copies. A restore must reapply deletion records before access and outbound work resume. Customer-retained or forwarded copies require the customer’s own process; we cannot remotely recall every copy.
Your rights and how to use them.
Under the law that applies, you may request access or a copy, correction, deletion, withdrawal of consent, or assistance with an objection or restriction. You may complain to the Privacy Officer or the applicable privacy regulator, and we do not discriminate against you for exercising applicable rights.
Email [email protected] or use the privacy request form. Email is also available if the form cannot submit. We verify identity proportionately, record the applicable jurisdiction and deadline, and explain any lawful limit or refusal. Do not include identification documents in the initial request. An authorized representative can contact us about the verification and authority needed for a request.
Account correction follows the managed sign-in profile and verified email. Before account deletion, ownership of an active workspace must be resolved through an authorized transfer or completed workspace deletion. Removing an individual account does not authorize erasing a customer’s records. Account completion depends on the identity provider’s confirmed result; uncertain outcomes require reconciliation.
Security and children.
Role-based access, tenant-scoped database controls, protected credentials and validated provider callbacks limit access and processing. Our security page explains the boundaries. No system can guarantee absolute security.
QualiRelay is a business service and is not directed to children under 18. We do not knowingly collect children’s personal information for their use of the service. Contact the Privacy Officer if you believe a child has provided personal information so we can investigate and take appropriate action.
Changes to this notice.
We update this notice when our practices or applicable requirements change and revise the effective date above. We provide additional notice or obtain consent for material changes where required.