Privacy policy

1. Controller and privacy contact

The controller within the meaning of the General Data Protection Regulation is:

Anel Alicic, trading as qasb
Neue Mainzer Straße 84
60311 Frankfurt am Main, Germany
Email: support@qasb.ai

Privacy inquiries can be sent to this address. No data protection officer is currently appointed. If the organization or its processing activities change, the need for an appointment will be reassessed and documented; if an officer is appointed, their contact details will be published here.

2. Roles in organization and workspace use

qasb is the controller for its own website, account, security, billing and product operation purposes. For content that an organizational customer enters in a workspace for its own purposes, the customer may be the controller and qasb the processor, insofar as qasb processes the data solely on documented instructions. The allocation of roles does not follow from the product name alone, but from the purpose, actual processing, decision-making authority and contract.

Before qasb processes personal data on behalf of an organizational customer, the specific allocation of roles, any required data processing agreement, instructions, technical and organizational measures, and the applicable subprocessor list must be documented. The public DPA information does not replace an agreement validly concluded by both parties.

3. Purposes and legal bases

We process personal data in particular for:

• providing the website, account, workspace, chat, analyses, files, artifacts and support to perform a contract or take pre-contractual steps (Article 6(1)(b) GDPR),
• billing, bookkeeping, and records required under tax and commercial law (Article 6(1)(b) and (c) GDPR),
• IT security, prevention of misuse, error analysis and defense of legal claims on the basis of legitimate interests (Article 6(1)(f) GDPR),
• optional, authenticated and data-minimizing daily aggregation of events for public page views and sign-up steps and of normalized Core Web Vitals only with consent (Article 6(1)(a) GDPR and section 25(1) TDDDG),
• handling data subject rights requests, withdrawals, cancellations and reports of illegal content to meet legal obligations, verify identity and prevent misuse, and perform the contract (Article 6(1)(b), (c) and (f) GDPR).

Where we rely on Article 6(1)(f) GDPR, our legitimate interests include in particular secure, stable and economically viable operations, protection against attacks, prevention of misuse, and the establishment, exercise or defense of legal claims. A user entering data into a free-text field does not in itself create another legal basis or a change of purpose.

4. Website visits and technical logs

Visits involve the processing of technically necessary connection data, in particular IP address, time, requested URL, referrer where transmitted, browser and device information, response status, and security and error data. These data are necessary to deliver content, detect attacks and operate the service reliably (Article 6(1)(f) GDPR).

Cloudflare, Inc. provides hosting, edge delivery and content delivery functions. Due to global delivery networks, processing outside the EU or EEA cannot be ruled out in every case. The applicable region, log configuration, subcontractors and transfer mechanisms depend on the configuration actually used and the associated agreed documentation.

5. Account, sign-in and communication

For an account, we process email address, user ID, authentication events, session and security metadata, settings, plan status and, where applicable, organization or workspace assignments. Sign-in uses an email link or Google OAuth; qasb does not store a separate account password. The legal bases are Article 6(1)(b) and (f) GDPR.

Google provides the OAuth identity service. If Google sign-in is chosen, the technical data required for the OAuth process are transmitted to Google; qasb receives the identity and profile data authorized by the user. The scope and further processing also depend on the Google account used and the consent dialog shown there.

Supabase provides, in particular, the database, authentication and file storage. Transactional emails may be sent through Supabase and Resend. Recipient address, message content, and delivery and error data are processed for this purpose.

6. Chat, analysis, workspace and artifact data

During use, we process in particular inputs and chat histories, selected roles and analysis depths, source requests, research results, assessments, feedback, status and usage metadata, workspace assignments, and generated analyses, plans, documents and other artifacts, including their versions. The purpose is to provide the service requested by the user and store their work results (Article 6(1)(b) GDPR).

qasb does not deliberately use customer content to train its own general-purpose foundation model. Whether and how an external AI provider stores content or uses it for its own purposes depends on the specific provider service, configuration and contractual terms agreed. A zero-data-retention or no-training commitment applies only if it is expressly agreed and technically effective for the specific data flow.

For personal qasb chats and Orbit, the wording of customer inputs and file, workspace, Orbit, account and billing data are not transmitted to Perplexity. Research on a question may, however, trigger search queries to Perplexity that qasb derives from the question; details are set out in section 9. A separate service for obtaining public, non-personal sources is not a recipient of customer, account, authentication, chat, file, workspace, Orbit or billing data. The recipients applicable to a particular subscribed function are set out in the current provider information and, where required, the agreed DPA.

7. Organizational analyses and employee data

The contractual purpose of qasb's organizational analyses is limited to roles, tasks, skills and aggregated organizational structures. qasb is not intended to assess or rank identified or identifiable applicants or employees, or to make decisions on hiring, promotion, performance monitoring, dismissal or the allocation of tasks to individuals.

Names, personnel numbers, email addresses, CVs, and performance, behavioral, health or disciplinary data must not be entered or uploaded for such purposes. In the intended analysis path for organizational data, recognized records are processed into role aggregates; raw rows are not intended to be used as model context, and groups of fewer than five units are to be suppressed. These technical safeguards do not prevent every incorrect input and do not replace a legal basis or an organizational review.

Before any processing of employee data, the organizational customer must review in particular necessity and the legal basis under the GDPR and employee data protection law, information obligations, erasure, data subject rights, and the involvement of employee representatives. The need for a data protection impact assessment must be examined before processing begins, and an assessment carried out where the conditions are met. Consent in an employment relationship is not automatically freely given because of the relationship of dependence.

Further binding limits are set out under AI transparency and in the acceptable use policy.

8. Files, extracted content and special categories of data

For uploads, we process file name, file type, file size, storage path, file content, security status, extracted text and the results generated from it. Before use, files may be checked for supported formats, size and identifiable security risks. Depending on the file type, the necessary content may be transmitted to an appointed service provider for OCR or model processing (Article 6(1)(b) and (f) GDPR).

Users may upload only content that they are legally entitled to have processed. Without an expressly documented data flow covered by law and contract, users must not transmit, in particular, health data, biometric data, data on religion or trade union membership, criminal offense data, professional secrets, trade secrets or personal employee data. The mere existence of an upload field does not authorize the processing of special categories of data.

9. AI processing and web research

• Mistral AI SAS, France: Where Mistral AI is used for the subscribed function, the prompts, selected parts of conversations, artifacts and file content needed for a response may be processed. The endpoint, region, contract, subcontractors and retention agreed for the specific data flow are decisive. Mistral's public Data Processing Addendum distinguishes processing on behalf of customers from its own purposes, including abuse monitoring and, under certain conditions, model training. Any contractual or configured exclusion from training, and exceptions for feedback sent to Mistral, must be checked for the specific service used. This link does not establish any special arrangement agreed by qasb.
• OpenAI: Where text generation with GPT-6 Luna is enabled, qasb sends the prompts, selected conversation content, stored user and workspace instructions and approved source passages required for it to the OpenAI API. If a user adds files or saved results to an analysis, their contents may also be transmitted; for files, this is the text extracted from them. The global endpoint api.openai.com used does not provide an assurance of EU data processing. For Chat Completions, qasb sets store: false; this is not an assurance of Zero Data Retention. According to the information on API data controls API content is not used for model training without express permission. Abuse monitoring logs may be retained for up to 30 days by default and longer in the exceptional cases described there; prompt caches may require additional, time-limited processing. Different retention or regional processing requires separate contractual and project settings that have actually been enabled.
• OpenAI Decisions (source review): Where source review is enabled, qasb sends the claim to be checked, selected passages from public original sources and technical source identifiers to the OpenAI Decisions API with GPT-6 Luna. The claim is usually derived from the question as a fixed test claim with a public subject, such as an occupation title, without copying the wording of the question. If a user confirms their own test claims before starting, that text is transmitted. An assessment of whether a passage supports a claim, contradicts it or is insufficient for it remains an indication, not independent confirmation of an effect or authorization of a numerical score. qasb checks the source, rights and cited passage separately. Private Case fit checks remain blocked without a current purpose release explicitly granted for OpenAI and consent for the relevant Case. Following that separate approval, the Case name, selected public claim and an excerpt of the saved analysis, together no more than 2,500 characters, and internal identifiers of the Case and consent may also be transmitted. Earlier TypeSafe releases do not permit this transmission to OpenAI. The global api.openai.com endpoint guarantees neither EU processing nor zero data retention; the data controls actually agreed and enabled are decisive.
• TypeSafe (Jev, historical): New review requests are no longer sent to TypeSafe. Existing source reviews and billing receipts remain traceable to their original provider and model; they are not presented as new OpenAI reviews. The data flows and applicable retention and deletion rules in force at the time continue to govern earlier transmissions.
• OpenAlex: To search for original scientific sources, qasb sends search queries to the OpenAlex API. For automatically planned research, they consist of fixed search terms and, where applicable, a public subject such as an occupation title or the publicly registered name of a product or organization; qasb derives them from the question but does not adopt its wording. If a user formulates their own search queries and confirms them before the start, that text is transmitted. OpenAlex does not receive account, file, workspace or billing data. Results are literature leads, not verified evidence. Processing outside the EU is possible; logging and retention of search queries are governed by the provider's terms.
• Perplexity AI, Inc.: qasb may use the Perplexity search API to find public original sources for research or case monitoring. Perplexity receives search queries that qasb derives from the question or, for case monitoring, from the area and the titles of the sources behind the selected public claims of the case, limited to a fixed vocabulary. They consist of fixed search terms and, where applicable, a public subject such as an occupation title. The wording of the question, search queries formulated by the user, files, case content, and account, workspace and billing data are not transmitted to Perplexity. The topic and subject of a search query may nevertheless allow inferences about the question asked. The results are unqualified leads and may be incorporated into customer results only after a separate review of the source, rights, attribution and substantive validity. A Perplexity output is neither a source nor a subject-matter authority.

The legal basis for AI processing requested by the user is generally Article 6(1)(b) GDPR. Security and abuse filters may additionally rely on Article 6(1)(f) GDPR. For organizational data, the specific role and instructions must also be considered. Information on the system's purpose and human oversight is available under AI transparency.

Public sources and personal data

For its research knowledge base, qasb processes publicly accessible publications and licensed datasets, such as scientific publications, official statistics, company reports and documented expert contributions. These may in particular contain the names and professional roles of authors or publicly quoted experts, statements attributed to them and information about publicly documented matters. This information comes from the respective publications rather than directly from the people concerned.

Where personal data are processed, the purpose is source-based research, attribution and understandable assessment of AI impacts. The legal basis is Article 6(1)(f) GDPR insofar as the documented balancing test supports this information interest against the rights and interests of the people concerned. Public accessibility alone is neither a legal basis nor permission for unrestricted reuse. Source origin, publication status and attribution are made traceable with the evidence; processing uses the research, AI and infrastructure data flows described in this policy.

This information also applies to people without a qasb account whose details appear in a source. Rectification, erasure, restriction and objection may be requested through the channels listed in section 18. Source-related personal data are retained only for as long as necessary and lawful for the documented research and evidence purpose. An exemption from individually informing people under Article 14 GDPR is not assumed solely because of the volume or public origin of the data; its conditions and the required safeguards must be assessed and documented separately for the dataset concerned.

10. Voice input and public sharing

Where supported by the browser, voice input uses the Web Speech API. Through this function, qasb generally receives the recognized text, not an audio recording intentionally stored by qasb. Whether audio data are processed locally or by a browser or operating system provider's service depends on the browser, device and its settings. The function is optional and requires microphone permission.

If a user enables sharing, selected results may become publicly accessible or accessible to people with the sharing link. Users must first remove personal, confidential and protected content. qasb processes sharing status, technical identifier and access data to provide this function and prevent misuse (Article 6(1)(b) and (f) GDPR).

11. Payments and subscription management

Where Stripe is used for a paid plan, Stripe processes in particular contact, billing, payment, tax, subscription and fraud prevention data. Full card details are not stored in qasb systems. Depending on the transaction, qasb receives, among other things, email address, customer and subscription identifiers, payment status, amount, currency and legal checkout metadata. The legal bases are Article 6(1)(b), (c) and (f) GDPR.

12. Data subject rights, withdrawals, cancellations and reports

Through the Data subject rights, Withdrawal, Cancellation and Report illegal content pages, we process the identification, contract, contact and explanatory data required there, the data subject right asserted, receipt time, a case reference, and identity, delivery and processing status. Name and email address are not required for reports concerning suspected offenses of child sexual abuse or child sexual exploitation. Without an email address, a subsequent electronic decision cannot be delivered.

The data are used to receive, acknowledge, review, carry out and provide legally required evidence of the respective process (Article 6(1)(b) and (c), and, for defense of legal claims, (f) GDPR).

13. Cookies and local browser storage

Technically necessary cookies or comparable storage technologies are used only for sign-in, session security, an expressly chosen language or appearance, requested OAuth/checkout/analysis handoffs, local drafts and results, restoring the interface, and reliably applying the privacy decision. Classification as 'necessary' under section 25(2) TDDDG does not replace the legal basis required under Article 6 GDPR for subsequent personal data processing. The names, triggers, contents, recipients and validity of every currently reachable key are listed in the cookie policy.

The device-specific browser consent record, version 2026-08-31, contains only the version, a yes/no value for optional statistics, and the precise decision time. It is valid for no more than 180 days. After expiry, it is no longer accepted as a valid choice and a new decision is required. An older entry may physically remain until the next choice or manual deletion in the browser, but is not used for statistics.

For signed-in users, qasb also synchronizes this browser decision to a separate current account projection containing account ID, version, yes/no value, decision time, source and server time. A separate immutable consent record additionally contains a random request ID, one-way checksums of the data subject reference and payload, and the projection status. It contains no name, email address, IP address or user agent. In particular, the account projection is used to suppress statistics on the server where the account decision differs, is outdated or has been withdrawn.

qasb does not load any script from an external statistics provider. Optional statistics are sent exclusively to a Supabase Edge endpoint controlled by qasb. This requires a current affirmative browser record, an authenticated non-anonymous user session, and an exactly matching affirmative account projection. Anonymous public events are not aggregated. Events for page views and sign-up steps are allowed only for a fixed list of public, non-sensitive route templates. In addition, Core Web Vitals may be counted for a sample of normalized public and specified app route templates. DNT or GPC technically blocks all of these processes even if consent is still stored in the browser.

The Edge endpoint processes the user JWT and exact decision time to verify the session and account consent. Only a UTC daily aggregate of the permitted event name, normalized route template, four finite dimension keys and a counter is stored permanently. For Core Web Vitals, the metric name (LCP, INP or CLS), deterministic rating, navigation type, completion flag, and count, sum, minimum and maximum of the measured value are added. The aggregate contains no user ID, IP address, user agent, raw URL, query string, URL fragment, referrer, JWT, free text, payload, or individual event or decision timestamp. Specific app object IDs are replaced with placeholders in the route template. Sign-in, admin, private sharing, laboratory, data subject rights, withdrawal, reporting, contact, accessibility and support paths, and paths with sensitive token parameters, are excluded.

Consent can be changed at any time through 'Privacy settings' with effect for the future. Refusal does not affect sign-in, basic functions, service scope or prices.

14. Recipients, subprocessors and third-country transfers

Recipients may include Cloudflare, Supabase, Google, Mistral AI, OpenAI, TypeSafe (for historical transmissions), OpenAlex, Perplexity, Stripe, Resend and documented subcontractors of these providers, insofar as required for the respective data flow and documented in the current provider or contractual information. Data may also be transmitted to advisers, courts or authorities where legally required.

Supabase is the only external technical recipient for optional statistics: the production Supabase Edge endpoint authenticates the session and checks account consent before the qasb-controlled database path increments only the account-free daily aggregate. No separate Plausible or other third-party statistics service is loaded. Normal connection and security data that may technically arise when the Edge endpoint is called are covered by the technical log information in section 4 and are not part of the daily aggregate.

Within the service scope described here, Perplexity receives only the search queries described in section 9 that are derived from a question or Case. A separate service for obtaining public sources is limited to public, non-personal data. For Perplexity, OpenAlex and OpenAI, and for such a service, the provider's role, contractual basis and any third-country transfer must be documented separately for the respective data flow.

The subprocessor list applicable to a specific processing arrangement must contain names, services, data categories, processing locations, transfer mechanisms and the change procedure. A mere list of technically possible integrations is insufficient. Before a B2B contract is concluded, the providers and data regions actually used must be consistent with the DPA, security documentation and product configuration.

Some providers or subcontractors may process data outside the EU or EEA. Where no adequacy decision under Article 45 GDPR applies, the transfer requires appropriate safeguards, in particular EU standard contractual clauses under Article 46 GDPR, and an assessment of any necessary supplementary measures. Information on a specific recipient can be requested via support@qasb.ai, including a copy of the relevant safeguards or information on where they are available.

15. Retention, erasure and backups

Data are stored only for as long as necessary for the respective purpose, contract performance, security, defense of legal claims or statutory retention. Account and product content is generally retained until deletion by the user, account deletion, or the end of a documented contractual and recovery period. Deleted data may remain in encrypted backups for a limited, documented rotation period and must not be restored from them for normal product purposes.

Invoice and bookkeeping data are retained in accordance with the applicable tax and commercial law periods. Security and abuse logs and legal requests are subject to retention periods defined by data category. The periods and exceptions applicable to a particular subscribed service are set out in the associated product and contractual information; general statements on this page do not shorten statutory retention obligations.

Account closure can be requested in the account settings. Erasure is first scheduled for seven days; until it starts, you can withdraw the request there. We inform you by email about the request, the scheduled erasure date and how to withdraw it. An active subscription must be canceled first. If the account owns an organization with other active members, or a payment is still being resolved, erasure is postponed until the matter is settled; the reason is shown in the request status. When erasure is carried out, sign-in is permanently blocked, and account and product content such as chats, analyses, dossiers, files, workspaces and settings is deleted.

Records that we retain because of statutory retention obligations (Art. 6(1)(c) GDPR) or to evidence billing, usage and security (Art. 6(1)(f) GDPR) are not deleted upon account closure but pseudonymized. These include in particular bookkeeping, usage and payment records as well as review and security logs. The email address, name and other profile details are removed or replaced with a placeholder; the records then remain linked to each other only through a randomly generated internal identifier. This is pseudonymization, not anonymization: through the customer reference held by our payment provider Stripe and through one-way checksums, the link to you can be restored in individual cases, for example for a tax audit or the defense of legal claims. The customer and payment data held by Stripe are not changed by the account closure; the information in section 11 applies to them. The pseudonymized records are not used for product purposes, are stored until the applicable retention period expires and are deleted afterwards. As long as no shorter period has been defined for a type of record, we conservatively assume a retention period of up to ten years. Technical logs of our sign-in and hosting services may still contain the email address for their limited retention period. Registering again with the same email address or the same Google account is possible and creates a new account with no connection to the deleted content.

The browser record and the counting permission based on it are valid for 180 days. Daily aggregates are also limited to no more than 180 UTC calendar days; a daily database job and, additionally, each permitted write delete older days. For aggregates, the period starts with the respective UTC calendar day, not the decision time of the browser record. The current account projection is deleted with the account when the account is deleted. For the immutable consent record, the direct account ID is detached upon account deletion; one-way checksums may remain for the documented evidence retention period. Daily aggregates have no account reference and can neither be attributed to an account nor selectively removed from a counter when that account is deleted. The specific retention periods for consent records and technical Edge logs must be separately defined and evidenced in the production erasure policy.

16. Profiling and automated decisions

qasb does not make a solely automated decision that produces legal effects concerning a data subject or similarly significantly affects them (Article 22 GDPR). Scores and AI outputs provide information and decision support. Users must not use them to make automated decisions about individual employees or applicants.

Role and task analyses may identify patterns, scenarios or priorities at an aggregated level. They are not intended for personal profiling. A function that assesses, predicts or categorizes natural persons requires a separate review of profiling, relevance under Article 22, data protection impact assessment and high-risk classification.

17. Required data and security

Certain data are required to conclude a contract and provide the service, in particular email address, authentication data and the inputs necessary for a requested function. Without these data, the respective service cannot be provided. Optional information and optional audience measurement are not prerequisites for basic functions.

qasb uses technical and organizational measures, including access restrictions, separated roles, encryption in transit, logging, rate limits, security checks on uploads and controlled administrative access. Their scope and effectiveness must be reviewed regularly. Security issues can be reported to support@qasb.ai.

18. Data subject rights

Data subjects have, in particular, the following rights:

• access under Article 15 GDPR,
• rectification under Article 16 GDPR,
• erasure under Article 17 GDPR,
• restriction of processing under Article 18 GDPR,
• data portability under Article 20 GDPR,
• objection under Article 21 GDPR to processing based on Article 6(1)(e) or (f) GDPR,
• withdrawal of consent with effect for the future under Article 7(3) GDPR.

Your right to object

You may object at any time to processing based on Article 6(1)(e) or (f) GDPR on grounds relating to your particular situation. We will then stop processing the data unless we demonstrate overriding compelling legitimate grounds or need the data for legal claims. You may object to processing for direct marketing at any time without giving reasons, including related profiling. The data will then no longer be processed for such marketing.

Requests and withdrawal of consent

To exercise these rights, use the 'Data subject rights' form or email support@qasb.ai. An acknowledgment of receipt does not confirm identity, substantive entitlement or completion of processing. To prevent unauthorized disclosure, we may request appropriate proof of identity. For organization accounts, qasb may forward a request to the organizational customer acting as controller or assist it in handling the request, insofar as qasb acts as processor.

We will inform you of action taken on your request without undue delay, generally within one month of receipt at the latest. For complex or numerous requests, this period may be extended by up to two further months; we will inform you of the extension and the reasons within the first month. If we refuse a request, we will explain the reasons and the available complaint and judicial remedies. Requests are generally free of charge; statutory exceptions remain unaffected.

Withdrawal of consent does not affect the lawfulness of processing before withdrawal. For optional audience measurement, you can use 'Privacy settings'; you can withdraw other consents through the contact given above.

You may lodge a complaint with a data protection supervisory authority, in particular in your place of habitual residence, place of work or the place of the alleged infringement (Article 77 GDPR). The authority generally responsible for qasb is the Hessian Commissioner for Data Protection and Freedom of Information. Its complaint form and guidance on secure submission are available online. Postal address: Postfach 3163, 65021 Wiesbaden, Germany.

19. Minors and changes

qasb is not directed at persons under 18. If we learn that an account is being operated for a minor without valid authorization, we will assess suspension and deletion, taking statutory obligations into account.

We update this privacy policy when data flows, functions, service providers or the law change. Material changes affecting existing users will be communicated appropriately. The version published on this page applies.