Privacy Policy

Global InTech AS (“we,” “us,” or “our”), organisasjonsnummer NO 935 706 998, is the data controller responsible for the processing of personal data collected through the QNNEAL platform and this website. We are committed to protecting your privacy and processing your personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (Personopplysningsloven).

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights regarding your data.

• Contract performance (Art. 6(1)(b)): Processing necessary to provide the QNNEAL platform services you have subscribed to.
• Legitimate interest (Art. 6(1)(f)): Processing for analytics, security, fraud prevention, and service improvement, where our interests do not override your fundamental rights.
• Consent (Art. 6(1)(a)): Processing for marketing communications and non-essential cookies, based on your explicit consent.
• Legal obligation (Art. 6(1)(c)): Processing required to comply with Norwegian tax, accounting, and regulatory requirements.

• AI Providers: When you use the QNNEAL platform, your prompts and workflow data are routed to third-party AI providers (e.g., OpenAI, Anthropic, Google) as necessary to deliver the service.
• Payment Processors: Stripe processes payment information on our behalf under their own data processing agreement.
• Infrastructure Providers: Cloud hosting and infrastructure services necessary to operate the platform.
• Legal Authorities: When required by Norwegian or EU law, court order, or regulatory request.

For transfers of personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

• Account data: retained for the duration of your account plus 12 months after deletion.
• Payment records: retained for 5 years in accordance with Norwegian bookkeeping legislation (Bokføringsloven).
• Usage and analytics data: retained in anonymized form for up to 24 months.
• Communication records: retained for 24 months after the last interaction.

Under GDPR and Norwegian law, you have the following rights:

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion of your personal data (“right to be forgotten”).
• Right to restrict processing (Art. 18): Request limitation of how we process your data.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interest or direct marketing.
• Right to withdraw consent: Withdraw consent at any time without affecting the lawfulness of prior processing.

Self-Service Data Controls: QNNEAL provides built-in tools to exercise your data rights directly from your account:

• Data Export: Request a complete export of your personal data, usage history, and API key metadata from Profile → Data & Privacy → Request Data Export. Exports are delivered in machine-readable JSON format.
• Account Deletion: Permanently delete your account and all associated data from Profile → Data & Privacy → Delete Account. This action is irreversible and removes all workflows, API keys, optimization history, and audit logs.
• Profile Management: Edit or remove personal information at any time from your Profile settings.

To exercise any of these rights, contact us at privacy@qnneal.dev or use the self-service tools in your dashboard. We will respond within 30 days as required by GDPR.

We use cookies and similar technologies to operate our website and platform. You can manage your cookie preferences at any time through the cookie settings banner on our website.

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Multi-factor authentication (TOTP) for user accounts
• Role-based access control (Owner, Admin, Developer, Viewer) with per-user data isolation
• API keys stored as SHA-256 hashes (never in plaintext)
• Session management with device tracking, IP logging, and remote revocation
• Comprehensive audit logging of all security-relevant events, retained 90 days
• Rate limiting on authentication endpoints to prevent brute-force attacks
• Account lockout after 5 failed login attempts (30-minute cooldown)

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet):

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on our website. The “Effective Date” at the top of this page indicates when the policy was last revised.

For privacy-related inquiries: privacy@qnneal.dev