HereAreI Privacy Policy

Effective date: 2026-09-19
Last updated: 2026-09-21
Applies to: https://www.herearei.com (including the dashboard and editor at https://www.herearei.com/app/), the public demo at https://demo.herearei.com, each site's file manager, customer sites hosted by HereAreI, and, once they are offered, domains and email accounts provisioned through HereAreI.

Plain-English summary #

This summary is for convenience; the full policy below governs.

• Who we are. HereAreI is a hosted website builder operated by QuaalCo, a sole proprietorship based in British Columbia, Canada. Our Privacy Officer can be reached at support@quaal.co.
• What we collect. Your account details (email address and display name; there is no password, because you sign in with a link we email you), the content of the sites you build and the files you upload, technical logs (including IP addresses and bandwidth usage), and the messages you send to support. HereAreI is in beta and nothing can be bought yet; once paid features launch we will also collect billing details (handled by Stripe; we never see your full card number), domain registrant contact details if you buy a domain, and the email accounts you create.
• Why. To provide the service you signed up for (contract), to keep it secure, to meet legal obligations, and, only with your consent, to send you product news.
• Who we share it with. Only the service providers we need to run the platform: DigitalOcean (hosting), Namecheap (sending sign-in and notification email, and our support mailbox), Let's Encrypt (HTTPS certificates; it receives domain names only) and Google Safe Browsing (we may check the web addresses of newly published pages against its list of known phishing and malware sites). Once paid features launch, Stripe (payments) and Openprovider (domain registration and email accounts) will be added. Your data is stored in the United States, in DigitalOcean's San Francisco data centre, so it is subject to US law.
• Domains are special. Once we sell domains, if you register one, your registrant details go to the registrar and the relevant registry, and limited information may appear in public domain lookup services as required by ICANN rules. Personal data is redacted from public lookups by default for most domain types.
• How long we keep it. Server logs: no more than 90 days. Deleted accounts: removed within 30 days (backups roll over within a further 30 days). Some records are kept longer because the law requires it.
• Your rights. You can access, correct, export and delete your data, withdraw consent, and complain to the Office of the Privacy Commissioner of Canada or the Information and Privacy Commissioner for British Columbia.
• Your visitors are your responsibility. If you collect information from visitors to your HereAreI site (for example through a form or a script you add), you are responsible for that data and for having your own privacy policy. We only process it on your behalf.
• No tracking. We do not use analytics or advertising cookies. The only cookies we set are the ones that keep you signed in.
• Not for children. HereAreI is for people 18 and older (or the age of majority where they live, if higher).
• Marketing email. We do not send marketing email today. If we ever do, it will be only with your express consent, and every message will have an unsubscribe link (CASL).

1. Who we are and how to contact our privacy officer #

HereAreI ("HereAreI", "we", "us") is operated by QuaalCo, a sole proprietorship in British Columbia, Canada.

We are responsible ("accountable") for personal information under our control, including information we transfer to service providers for processing. We have designated a person responsible for our compliance with privacy law (our "Privacy Officer"; in Quebec, the "person in charge of the protection of personal information"):

Everything else (support, abuse and copyright reports, legal notices) goes to the same address. We do not publish a postal address; if you need to write to us on paper, email us first and we will tell you where to send it.

This section addresses PIPEDA Principle 1 (Accountability) and Principle 8 (Openness), and the Quebec Law 25 requirement to publish the title and contact details of the person in charge of personal information (see the CAI summary of Law 25).

2. Which laws this policy follows #

• The Personal Information Protection and Electronic Documents Act (PIPEDA), including the ten fair information principles in Schedule 1 (OPC overview).
• Where a province has substantially similar private-sector privacy law (Alberta, British Columbia, Quebec), that law may apply instead of PIPEDA to activities within that province. We are based in British Columbia, whose Personal Information Protection Act (PIPA) may apply to personal information we collect within British Columbia; PIPEDA applies to personal information that crosses provincial or national borders, which includes most of what we handle because our servers are in the United States.
• Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25, for personal information about Quebec residents (see Section 14).
• Canada's Anti-Spam Legislation (CASL) for commercial electronic messages (see Section 13).
• ICANN and registry policies that govern domain registration data, once we offer domains (see Section 4.3).

3. Two roles: when we are the "controller" and when we are the "processor" #

HereAreI handles data about two kinds of people:

1. Site owners (our customers). For your account, billing, domain, email and support data, we decide why and how the data is used. We are the organization responsible under PIPEDA.
2. Visitors to your site. When someone visits a site you built on HereAreI, submits a contact form, or exchanges email with a mailbox you created, you decide why that information is collected and what happens to it. We host and process it only on your instructions, as your service provider. You are responsible for complying with privacy law toward your visitors, including publishing your own privacy policy, obtaining any consent you need, and responding to their requests. Our Terms of Service require this. If a visitor contacts us about data on your site, we will refer them to you unless the law requires otherwise. Section 15 sets out the processing terms that apply.

4. What we collect, and why #

We collect only what we need for the purposes listed here (PIPEDA Principle 2, Identifying Purposes; Principle 4, Limiting Collection). If we want to use your information for a new purpose, we will identify that purpose and ask for your consent first.

4.1 Account information #

4.2 Billing information (via Stripe) #

Nothing can be bought during the beta, so we collect no billing information yet. This section applies once paid features launch.

Payments are processed by Stripe. When you enter card details, they are sent directly from your browser to Stripe's hosted Checkout or Customer Portal; HereAreI never receives or stores your full card number, CVC or bank account number.

We receive and store from Stripe: your Stripe customer ID, card brand and last four digits, expiry month/year, billing name, billing address (including province/country, which we need to charge the correct sales tax), tax ID if you supply one, invoice history, subscription status and the outcome of each charge.

Purposes: charging you, issuing receipts and invoices, calculating GST/HST and provincial sales taxes based on your billing address (the "place of supply" rule for services; see the CRA place-of-supply rules), detecting fraud, and keeping the records tax law requires. Legal basis: contract and legal obligation.

Stripe also collects information directly as an independent business (for example, device and fraud-prevention signals through Stripe Radar). Stripe's own privacy policy applies to that collection: https://stripe.com/privacy.

4.3 Domain registrant data (via our registrar, registries and public lookup services) #

HereAreI does not sell domains during the beta, so we do not collect registrant data yet. If you connect a domain you already own, we store only the domain name and its DNS status. Once domain registration is offered, this section applies.

If you register, renew or transfer a domain through HereAreI, we collect registrant contact information: name, organization (if any), postal address, email address and telephone number, and any additional information a registry requires for the domain you choose.

Here is where that data goes:

• The registrar. Domains will be registered through an ICANN-accredited registrar; we currently intend to use Openprovider (Netherlands). HereAreI is a reseller; the registrar is the sponsoring registrar of record and becomes an independent controller of your registrant data under its registration agreement, which you accept at checkout.
• The registry. The registrar passes registration data to the registry that operates the top-level domain (for example Verisign for .com and .net). Each registry has its own privacy terms.
• ICANN and data escrow. ICANN-accredited registrars must deposit registration data with an ICANN-approved escrow agent and make data available to ICANN on request under the Registrar Accreditation Agreement.
• Public registration data lookup (RDDS/WHOIS/RDAP). Under ICANN's Registration Data Policy, for generic top-level domains the registrar redacts your personal contact details from public lookups by default; however the Organization field, the registrant's state/province and country, and the domain's status and dates may be published. If you enter an organization name, it will be public. Third parties with a legitimate purpose (for example law enforcement or intellectual-property owners) may request disclosure of redacted data through the registrar's process.
• Optional privacy service. Where available for your domain type, an optional privacy or proxy service offered by or through the registrar replaces your details with the service's details in lookups. Availability and price per domain type will be shown at checkout.
• Registrant verification email. ICANN requires the registrar to verify your email address within 15 days of a new registration or a change of contact details. The registrar will email you a verification link; if you do not respond within 15 days, the domain is suspended until you do. We will show a reminder in your dashboard until verification is complete.
• Expiry and renewal notices. The registrar and HereAreI send renewal reminders to your registrant email address, including notices about one month and one week before expiry and one after expiry, as ICANN requires (ICANN's Expired Registration Recovery Policy). These are transactional messages you cannot opt out of while you hold a domain.

Purposes: registering and maintaining your domain in your name (you are the legal registrant, not HereAreI), meeting ICANN and registry rules, and enabling you to transfer the domain away. Legal basis: contract and legal obligation. Providing accurate registrant data is a condition of holding a domain; we cannot register a domain without it.

Retention of domain records is longer than for other data because ICANN's record-keeping rules for registrars and their resellers require registration records to be kept after the domain expires (see Section 8).

4.4 Email accounts (via our email provider) #

Mailboxes are not offered during the beta. When they are offered as a paid add-on, mailboxes on your domain will be provided by our email provider (we currently intend to use Openprovider's email service). To provision them we will send the provider: your domain name, the mailbox addresses you choose, mailbox passwords (set by you; transmitted to the provider at creation and not stored by us in readable form), aliases, forwarding rules and catch-all settings, and an internal customer identifier.

The contents of your mailboxes (messages, contacts, calendar items, attachments) will be stored and processed by the email provider, not on HereAreI servers. We will state where mailbox contents are stored in this policy before mailboxes are offered. The email provider's terms of use and acceptable use policy will apply to your use of email, and you will accept them when creating a mailbox.

Because HereAreI will be the email provider's customer of record, HereAreI will be able to see mailbox names, storage usage, DNS status and delivery information, and to suspend or reset mailboxes for support and abuse handling. We do not read your email except where you ask us to for support, where we are legally required to, or where necessary to investigate abuse (for example spam complaints). The email provider may also access data for its own operations under its terms.

Mail sent to and from your mailboxes will pass through the email provider's spam and malware filters, which examine message content and sender reputation automatically.

4.5 Site content #

Everything you put into the editor (text, images, files, page structure, form definitions, custom domain settings) and every file you upload to your site is stored on our servers so we can publish and serve your site. Published pages are, by design, public on the internet. We do not use your site content for advertising or to train machine-learning models. We may view it to provide support, to investigate abuse reports or legal notices, or to enforce our Acceptable Use Policy.

Contact-form submissions. Every plan, including the Free Plan, can put a contact form on a site. When a visitor sends one:

The message is emailed to the site owner at their account address and is also shown in their dashboard. The email is sent from our own address; if the visitor gave an email address that is safe to use, it is set as the Reply-To, so the owner's reply goes to the visitor and not to us. We do not use anything submitted through a form to market to the visitor, and we never sell it.

For these submissions the site owner is the responsible party and we act only as their service provider (Section 3). If you are a visitor and want a message you sent removed, ask the site owner; if you cannot reach them, write to support@quaal.co and we will pass the request on. If you are a site owner, you must tell your visitors what you collect and why, in your own privacy notice, and you must not use our form to collect passwords, payment-card numbers, government identifiers or health information (Acceptable Use Policy, section 4.3).

4.6 Usage data and server logs (including IP addresses and bandwidth accounting) #

Our web servers (nginx) and application record, for every request to www.herearei.com, demo.herearei.com, each site's file manager and every hosted customer site:

• IP address, date and time, requested URL and hostname, HTTP status, bytes transferred, referrer, and browser user-agent string;
• for the editor and dashboard: your account ID, the actions you take (for example "published site", "changed nameservers"), and errors;
• per-site aggregate bandwidth and storage counters, derived from these logs, used to enforce plan limits and detect abuse.

Purposes: keeping the service running and secure (rate limiting, blocking attacks, diagnosing faults), measuring bandwidth and storage against your plan, investigating abuse and legal notices, and producing anonymous aggregate statistics. Legal basis: contract (delivering and metering the service) and our legitimate need to secure the platform.

Raw logs are kept for no more than 90 days and then deleted (see Section 8). Aggregate counters (for example monthly bandwidth per site) contain no IP addresses and are kept as billing records.

For visitors to customer sites, the IP address and request data in these logs is processed on behalf of the site owner (Section 3). We do not build profiles of visitors or track them across sites.

4.7 Cookies and similar technologies #

We use as few cookies as possible. As of the date of this policy:

We do not set any cookies on customer sites (for example yoursite.herearei.com, or your custom domain). If you add third-party embeds (for example a video player or a map) or your own scripts to your site, those third parties or scripts may set their own cookies and you are responsible for disclosing them to your visitors.

Analytics. We do not use third-party analytics or advertising trackers on www.herearei.com, on the demo or on customer sites. We learn how the service is used only from our own server logs (Section 4.6), which are deleted after no more than 90 days.

5. Consent (PIPEDA Principle 3) #

• Creating an account is your consent to the collection and use of account, billing, content and log data for the purposes in Section 4, which are necessary to provide the service. You cannot use HereAreI without them.
• Registering a domain (once offered) is your consent to the disclosures in Section 4.3, which are required by ICANN and the registries. We will show you what will be published before you complete the purchase.
• Creating a mailbox (once offered) is your consent to the disclosures to our email provider in Section 4.4.
• Marketing email requires separate, express, opt-in consent (unchecked box). It is never a condition of using the service.
• Withdrawing consent. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, by changing your settings, unsubscribing, deleting a domain or mailbox, or contacting support@quaal.co. We will tell you what the consequences are (for example, deleting your account ends your hosting; withdrawing registrant data means we can no longer maintain your domain).
• Sensitive information. We do not ask for sensitive information (such as health, financial account or government ID numbers). Please do not put it in support messages. If you store sensitive information in your site content or mailboxes, you do so as the party responsible for it.
• Quebec residents: consent for any purpose other than those necessary to provide the service is requested separately and in clear, simple language, and privacy settings default to the most protective option (Section 14).

6. How we share personal information (PIPEDA Principle 5, Limiting Use, Disclosure and Retention) #

We do not sell or rent personal information, and we do not share it with advertisers. We share it only as follows.

6.1 Service providers ("processors") #

These companies process data on our instructions under contracts that limit their use of it. During the beta we use:

Once paid features launch (not during the beta), we will add the following, and we will update this table before any of your data is sent to them:

If we change or add a provider that handles personal information, we will update this section.

6.2 Other disclosures #

• Legal requirements. We disclose personal information when required by law, subpoena, court order, or a lawful request from a Canadian or foreign authority with jurisdiction. Where the law allows, we will tell you before disclosing.
• Copyright and abuse notices. Under Canada's notice-and-notice regime (Copyright Act ss. 41.25 to 41.26), when we receive a compliant notice of claimed infringement about your site we must forward it to you and keep records identifying you for six months (one year if the claimant sues and tells us) (Copyright Act s. 41.26). We do not give the claimant your identity without a court order. We have not registered a designated agent under the US DMCA, but we accept notices in the DMCA format; if you send us a counter-notice in response to one, we forward it to the claimant, and it contains your name and address.
• Protecting people and the service. We may disclose information where necessary to investigate or stop fraud, abuse, security incidents or harm to a person, including to a domain registrar, registry, hosting provider or other platform.
• Business changes. If QuaalCo or the HereAreI business is sold, merges, or transfers substantially all of its assets, customer data may be transferred to the successor, who must honour this policy. We will notify you before your data becomes subject to a different privacy policy.
• At your direction. For example, when you transfer a domain to another registrar, we give you the authorization code and the gaining registrar receives your registrant data.

6.3 Cross-border transfers #

Your data is stored in the United States, on our server in DigitalOcean's San Francisco data centre. Our other providers are also in the United States, and some data (email in transit, and, once paid features launch, data handled by our registrar and email provider in the Netherlands and by domain registries) may be processed in other countries. While your information is outside Canada, it is subject to the laws of that country and may be accessible to that country's courts, law enforcement and national-security authorities. We use contracts and technical safeguards to protect it, but we cannot override foreign law. By using HereAreI you acknowledge these transfers. Quebec residents: see Section 14 regarding transfers outside Quebec.

7. Accuracy (PIPEDA Principle 6) #

You can view and edit your account, billing and registrant details in your dashboard at any time, and we rely on you to keep them current. Registrant data must be accurate: ICANN requires you to keep registrant contact data accurate and to update it within seven days of a change; knowingly false data or failure to respond to a registrar accuracy inquiry within 15 days can result in your domain being suspended or cancelled (ICANN Registrants' Benefits and Responsibilities). If you tell us data is wrong we will correct it and, where relevant, pass the correction to the service provider concerned (Section 6.1).

8. How long we keep information (PIPEDA Principle 5) #

We keep personal information only as long as needed for the purposes it was collected for, or as the law requires, then delete or anonymize it. Concrete periods:

9. Security safeguards (PIPEDA Principle 7) #

We protect personal information with safeguards appropriate to its sensitivity. As of the date of this policy:

• Encryption in transit. All traffic to www.herearei.com, the demo, the file manager and hosted sites uses HTTPS/TLS, and so do our connections to our providers, including the connection that sends our email.
• Data at rest. Data is stored on our server and in DigitalOcean's backup service, which only we can access.
• No passwords. You sign in with a one-time link sent to your email address. Links expire quickly, can be used once, and we store only a one-way hash of each link, never the link itself. Once mailboxes are offered, mailbox passwords will be transmitted to the email provider and not retained by us in readable form.
• Access control. Production access is limited to the founder and any staff who need it, using SSH keys and multi-factor authentication on provider accounts; provider API keys are stored outside the code and rotated if exposed.
• Isolation of customer sites. Each customer site is served from its own hostname. Our sign-in cookies are host-only (__Host-) cookies that customer sites cannot read or set, every change made through the dashboard must come from our own pages, and each site's file manager runs on a separate hostname from the site it manages, so that scripts on one site cannot read another site's data or act on your account.
• Monitoring and patching. The server runs supported operating-system and Node.js versions with security updates applied; logs are reviewed for abuse.
• Backups. Nightly database backups and weekly server backups.
• Staff. Everyone with access to personal information is bound by confidentiality obligations and this policy.

No system is perfectly secure. If you find a vulnerability, please email support@quaal.co with "Security" in the subject line and we will respond promptly.

10. Your rights and choices (PIPEDA Principles 9 and 10) #

You have the right to:

• Access. Ask what personal information we hold about you, how it is used, and who it has been disclosed to. Most of it is visible in your dashboard; for anything else, email support@quaal.co. We respond within 30 days (PIPEDA allows one extension of up to 30 days in limited cases, and we will tell you if we need it). Access is free except where the law lets us charge a minimal fee, which we will quote in advance. We may withhold information in the narrow cases the law permits (for example, where it would reveal someone else's personal information or is protected by solicitor-client privilege) and will tell you why.
• Correction. Have inaccurate or incomplete information corrected; where we cannot agree, we will note your disagreement on the record and pass it to third parties who received the data.
• Portability. Download the files you uploaded at any time and, on request, a machine-readable copy of your account data. (Quebec residents have a statutory right to computerized personal information in a structured, commonly used format since September 2024.)
• Deletion. Delete individual sites, connected domains and (once they are offered) mailboxes from your dashboard. To close your account, email support@quaal.co from your account address with "Close account" or "Privacy" in the subject line and we will close it and delete your data on the timelines in Section 8. See Section 8 for what happens next and what we must keep by law. Note that deleting a domain does not refund it and that registrant records are retained for three years after it expires or is transferred away.
• Withdraw consent. See Section 5.
• Opt out of marketing. Use the unsubscribe link or email support@quaal.co. Transactional messages (sign-in links, receipts, renewal notices, ICANN verification, security alerts) cannot be opted out of while you hold an account or domain because they are necessary to the service or required by law.
• Challenge our compliance. Complain to our Privacy Officer at support@quaal.co (put "Privacy" in the subject line). We will acknowledge within 5 business days, investigate, and reply with our findings and any corrective action. If you are not satisfied, you may complain to the regulator:

Office of the Privacy Commissioner of Canada (OPC): website, contact details and online complaint form at https://www.priv.gc.ca

Quebec residents may also complain to the Commission d'accès à l'information du Québec (CAI), https://www.cai.gouv.qc.ca. Residents of British Columbia may also contact the Office of the Information and Privacy Commissioner for British Columbia, https://www.oipc.bc.ca, and residents of Alberta their provincial Information and Privacy Commissioner.

For visitors to customer sites: contact the site owner first (Section 3). If you cannot reach them, email support@quaal.co and we will forward your request to the site owner.

11. Breach notification #

If we discover a breach of security safeguards involving personal information under our control, we will:

1. contain it and assess whether it creates a real risk of significant harm to individuals (considering the sensitivity of the data and the probability of misuse);
2. if it does, report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible, directly (by email to your account address) or, where direct notice is impractical, by a notice on our site, as PIPEDA ss. 10.1 to 10.3 require (PIPEDA s. 10.1);
3. notify any other organization (for example one of our service providers) that may be able to reduce the harm;
4. for Quebec residents, also notify the Commission d'accès à l'information where the incident presents a risk of serious injury, and record it in our confidentiality-incident register;
5. keep a record of every breach, whether or not reported, for at least two years.

If a breach occurs at one of our providers (for example DigitalOcean or our email provider), that provider notifies us under our contract and we follow the same steps for the data we are responsible for. If the breach affects only data you hold about your own visitors, we will notify you promptly so that you can meet your own obligations.

Knowingly failing to report or record a breach is an offence under PIPEDA s. 28 with fines up to $100,000 (PIPEDA s. 28); we take these duties seriously.

12. Children #

HereAreI is for adults. You must be at least 18 years old (or the age of majority where you live, if that is higher) to create an account, buy a domain or create a mailbox, because these are contracts. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, email support@quaal.co and we will delete it. Site owners who publish content aimed at children are responsible for complying with the laws that apply to their audience (for example the US COPPA rule if they target US children under 13).

13. Marketing email and CASL #

Canada's Anti-Spam Legislation (CASL) governs the commercial electronic messages we send. We do not send marketing email today; if we start, these rules apply.

• Consent. We send marketing email (product news, offers) only with your express consent, obtained by a positive opt-in action that is not pre-checked and is separate from accepting our Terms of Service, or with implied consent under an existing business relationship (for example within two years of a purchase) (CASL s. 6 and s. 10). The consent request states the purpose, our business name, mailing address and contact details, and that you can withdraw consent at any time. We keep a record of your consent (Sections 4.1 and 8).
• Identification. Every commercial message identifies QuaalCo, gives our mailing address and an email address or web address to reach us (CRTC regulations SOR/2012-36).
• Unsubscribe. Every commercial message has a one-click unsubscribe link that works for at least 60 days after sending; we act on it immediately and in any case within 10 business days, as CASL s. 11 requires.
• Transactional messages (sign-in links, receipts, invoices, renewal and expiry notices, ICANN verification, security and abuse notices, service changes) provide factual information about your account or complete a transaction you asked for; they are exempt from the consent requirement (CASL s. 6(6)) but still identify us and offer a way to manage preferences. We keep promotional content out of them.
• We never email people to ask for consent, because such a request is itself a commercial message under CASL.
• Your own email. If you use HereAreI mailboxes or forms to send marketing, CASL (and, for foreign recipients, laws such as CAN-SPAM and GDPR) applies to you, and our email provider's acceptable use rules may require bulk senders to publish a complaint address. See our Acceptable Use Policy.

14. Quebec residents (Law 25) #

If you live in Quebec, the Act respecting the protection of personal information in the private sector, as amended by Law 25, applies to your personal information in addition to the above (as of 2026-09-16; see the CAI summary):

• Person in charge. Privacy Officer, QuaalCo, support@quaal.co (Section 1).
• Governance policies. This policy and our internal data-handling, retention and incident-response procedures are our published governance framework; summaries are available on request.
• Consent. Any use beyond providing the service is subject to separate, clear consent; sensitive information requires express consent. Our default settings are the most privacy-protective (for example, marketing opt-in is off and there is no analytics).
• Transfers outside Quebec. Your data is stored in the United States (DigitalOcean, San Francisco) and processed by providers in the United States and elsewhere (Section 6). Before choosing these providers we considered the sensitivity of the data, the purposes for which it is used, the protections in place, including the providers' contractual commitments, and the legal regime of the destination, and we keep that assessment under review.
• Automated decisions. We do not make decisions about you based solely on automated processing, other than automated spam and abuse filtering, which you can ask us to review.
• Your rights. In addition to access and correction, you may request de-indexing or cessation of dissemination in the circumstances the Act allows, and computerized data portability. Requests are answered within 30 days.
• Incidents. See Section 11; we keep a confidentiality-incident register and notify the CAI of incidents presenting a risk of serious injury.
• Complaints. Commission d'accès à l'information du Québec, https://www.cai.gouv.qc.ca.

We apply these protections to Quebec residents as a matter of policy.

15. Data processing terms for site owners #

For personal information about your visitors that we process on your behalf (Section 3):

• we process it only to host, serve, store, back up and deliver your site, forms and email, and to secure the platform;
• we do not use it for our own purposes, other than aggregate, non-identifying service statistics;
• we engage the sub-processors listed in Section 6.1 and will list any changes here;
• we apply the safeguards in Section 9;
• we will assist you, within reason, with visitor access requests and breach notifications;
• on account closure we delete visitor data within the periods in Section 8, and you can export form submissions beforehand;
• you are responsible for the lawfulness of the collection, for your own privacy policy and for any consent your visitors must give.

If you need a signed data processing agreement (for example because your visitors are in the EU or you are subject to Law 25 as a business), email support@quaal.co.

16. Changes to this policy #

We may update this policy as the service, our providers or the law change. For material changes we will give at least 30 days' notice by email to your account address and by a notice in the dashboard before the change takes effect; the "Last updated" date at the top will change. Continued use after the effective date means you accept the revised policy, except where the law requires fresh consent, in which case we will ask for it. Previous versions are available on request.

17. Contact us #

Email support@quaal.co for everything, including privacy questions and access, correction and deletion requests (our Privacy Officer reads this address). Put "Privacy", "Abuse", "Copyright notice" or "Legal notice" in the subject line so your message reaches the right queue. We do not publish a postal address; if you need to write to us on paper, email us first and we will tell you where to send it.