Privacy Policy

Who we are

Quaestra Limited (“Quaestra”, “we”, “us”, “our”) operates Quaestra.ai. We are a company registered in England and Wales and we are the data controller for the personal data described in section 2 as being under our control.

Privacy questions, data subject requests, and complaints should go to info@quaestra.ai.

Scope and our role

This policy covers personal data we handle when you visit our website, contact us, request access, or use the Quaestra.ai service. It applies wherever you are in the world.

Where we are the controller

We decide how and why data is used for: website visitors, people who contact us or request access, account and sign-in records, billing, security logging, and service administration. For that data, this policy is the notice required by UK GDPR Articles 13 and 14.

Where we are a processor

Where an organisation runs a Quaestra.ai workspace, that organisation decides what documents go into its corpus, who can access it, and how long it is kept. For personal data inside that workspace — including documents, questions, and answers — the organisation is the controller and we act as its processor, handling the data only on its documented instructions under a data processing agreement.

This policy does not cover third-party websites we link to, or third-party services your organisation connects to the product.

Personal data we collect

• Identity and contact data — name, work email address, organisation, job role or persona, and anything you choose to tell us in an enquiry.
• Account and authentication data — sign-in records, one-time email codes, single sign-on identifiers where your organisation uses Google or Microsoft sign-in, session tokens, roles and permissions, and integration or API keys you create.
• Content data — documents and files uploaded to a library, material ingested from a connected source or an inbound email address, questions asked, conversation history, attachments, feedback and answer ratings, and configuration such as frameworks and question banks. See section 5.
• Usage data — features used, questions and requests counted against quota, model selections, exports and downloads, timestamps, and error and diagnostic events.
• Technical data — IP address, approximate location derived from it, browser and device type, operating system, referring page, and similar log information.
• Billing data — plan, subscription status, invoices, and billing contact. Payments are processed by our payment provider; we do not receive or store full payment card numbers.
• Communications data — emails and support correspondence with us, and whether service or digest emails were delivered, opened, or clicked.

We do not ask for special category data (such as health, biometric, or political data). Please do not put it into the service unless we have agreed in writing that your configuration is suitable for it.

Most data comes from you directly. Some is generated automatically as you use the service, and some may come from your organisation’s administrator when they invite or configure your account.

How and why we use it

Under UK GDPR and EU GDPR we must have a lawful basis for each use. Ours are:

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and you can object at any time (see section 12). Where we rely on consent, you can withdraw it at any time without affecting processing already carried out.

We do not sell personal data, and we do not use your data for third-party advertising.

Your documents and questions

Documents, questions, answers, and attachments are stored so that the service can retrieve, cite, and display them back to you, and so your history remains available.

Content is held within your organisation’s workspace and is separated from other organisations’ data. Access is governed by the roles and visibility settings your administrator configures. Administrators can see workspace content and activity, including per-user question history where the product provides it.

Where a workspace connects a cloud drive as a source, we read the files and folders you nominate in order to bring them into the library. We do not modify, move, or delete anything in the source system, and access can be revoked at any time from the connected account or from within the product.

Where an inbound email address is enabled, messages and attachments sent to it are processed to add documents to the library, and sender details are recorded so administrators can audit what was ingested.

A small number of our staff may access workspace content where strictly necessary to provide support you have requested, to investigate a security incident, or to comply with the law. Such access is limited, logged, and carried out under confidentiality obligations.

Model training and AI processing

To produce an answer, relevant passages from your corpus and your question are sent to a language model provider for processing. That processing is carried out under contractual terms that prohibit using the material for training and require deletion after the request is served. Where a provider supports zero data retention, and your organisation has selected that option, the provider retains nothing after the response is returned.

The service is model-agnostic. Your organisation chooses which providers and models are available, and may supply its own provider keys, in which case that provider relationship is your organisation’s. Where a question calls for a web search and your plan includes it, the search query — not your corpus — is sent to a search provider.

We use only aggregated and anonymised statistics, from which individuals cannot be identified, to understand how the service performs.

Cookies and similar technologies

We use cookies and similar technologies such as local storage. There are three kinds:

• Strictly necessary — sign-in sessions, security and anti-abuse protection, load balancing, and remembering your cookie choices. These are required for the service to work and are set without consent, as permitted by the Privacy and Electronic Communications Regulations.
• Preference — remembering choices such as your workspace, persona, or interface settings.
• Analytics and session insight — understanding how pages and features are used so we can improve them, including optional session insight tooling where an organisation enables it. These are set only with your consent.

Where consent is required, we ask for it through a cookie banner and you can change or withdraw your choice at any time using the same control. You can also block or delete cookies in your browser settings, though strictly necessary cookies cannot be turned off without affecting sign-in.

Our marketing emails and optional digests may contain standard delivery and open tracking so we can tell whether a message arrived and was useful. You can unsubscribe from any non-essential email using the link it contains.

Who we share data with

We share personal data only where necessary, and only with recipients bound by confidentiality and data protection obligations. Categories of recipient:

• Cloud hosting and infrastructure providers that run the service and store its data.
• Language model and AI providers that process a question and the retrieved passages to generate an answer, under no-training terms (see section 6).
• Email delivery providers for sign-in codes, service notices, and digests.
• Payment and subscription providers that take payment and manage billing.
• Analytics and error-monitoring providers that help us understand usage and diagnose faults.
• Professional advisers — lawyers, accountants, auditors, and insurers — where needed.
• Your organisation, where you use the service through a workspace it controls.
• Authorities, where we are legally required to disclose, or where disclosure is necessary to establish, exercise, or defend legal claims. We will challenge requests we consider overbroad and, where lawful, tell you about them.
• A buyer or successor, if we are involved in a merger, acquisition, or sale of assets — in which case this policy continues to apply until you are told otherwise.

A current list of the providers we use to deliver the service is available on request from info@quaestra.ai. Organisations with a data processing agreement in place are notified of changes to that list as their agreement requires.

International transfers

We are based in the United Kingdom and the service is available worldwide. Some of our providers, and some of our customers, are located outside the UK and the European Economic Area — including in the United States.

Where personal data leaves the UK or EEA, we make sure a lawful transfer mechanism is in place, which will be one of:

• a UK adequacy decision or an EU adequacy decision for the destination country;
• the UK International Data Transfer Agreement, or the UK Addendum to the European Commission’s Standard Contractual Clauses;
• the European Commission’s Standard Contractual Clauses, with supplementary technical and organisational measures where a transfer risk assessment shows they are needed.

You can ask us for a copy of the safeguards that apply to a particular transfer by emailing info@quaestra.ai. Where an organisation requires data residency in a specific region, we can discuss a private deployment.

How long we keep data

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires.

• Account data — for as long as the account is active, then deleted or anonymised within 90 days of closure.
• Workspace content — for as long as the controlling organisation keeps it. Deletion requested by an administrator takes effect in the live service promptly and works through routine backups within 30 days.
• Security and access logs — typically up to 12 months.
• Billing and tax records — 6 years after the end of the financial year they relate to, as UK law requires.
• Enquiries and support correspondence — up to 24 months after the last contact, unless it relates to a contract or a claim.

Where data is no longer needed but cannot be deleted immediately — for example within a backup — it is isolated and protected until deletion happens.

Security

We take appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls and role-based permissions, separation of each organisation’s workspace and data, audit logging of sensitive administrative actions, least-privilege access for our staff, and confidentiality obligations for everyone who works on the service.

No system is completely secure. You also have a part to play: keep your sign-in method and any integration keys private, use single sign-on where your organisation offers it, and tell us promptly at info@quaestra.ai if you suspect a problem.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours of becoming aware of it where required, and will tell affected individuals and controllers without undue delay.

Your rights

Under UK GDPR and EU GDPR you have the right to:

• Be informed about how your data is used — this policy.
• Access a copy of the personal data we hold about you.
• Rectify data that is inaccurate or incomplete.
• Erase your data where there is no continuing reason for us to hold it. Account deletion is also available from within the product.
• Restrict processing while a concern is investigated.
• Portability — receive data you gave us in a structured, commonly used, machine-readable format, or have it sent to another provider where technically feasible. Conversations and history can also be exported from the product.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time where processing is based on it.

To exercise a right, email info@quaestra.ai. We will respond within one month, and will tell you if we need longer because a request is complex. There is no fee unless a request is manifestly unfounded or excessive. We may need to verify your identity first.

If your data sits inside an organisation’s workspace, that organisation is the controller and we will forward your request to it and assist as its processor.

If you are unhappy with how we have handled your data, please tell us so we can put it right. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113, or to the supervisory authority in your country of residence or work.

Automated decision-making

We do not make decisions producing legal or similarly significant effects about you by automated means alone. The service generates answers automatically, but those answers are research material for you to review and verify — they are not decisions we make about you.

Children

The service is intended for professional and organisational use and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact info@quaestra.ai and we will delete it.

Regional information

United Kingdom and European Economic Area

We work to UK GDPR and EU GDPR standards for everyone, wherever they are. UK and EEA residents have the rights described in section 12, including the right to complain to a supervisory authority.

United States

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in US state privacy laws. Residents of California and other states with comparable laws may request access to, correction of, or deletion of their personal information, and may ask about the categories collected and disclosed, by emailing info@quaestra.ai. We will not discriminate against you for exercising a privacy right.

Elsewhere

If local law in your country gives you stronger rights than this policy describes, those rights apply. Contact us and we will honour them.

Changes to this policy

We may update this policy to reflect changes to the service, our providers, or the law. The “last updated” date at the top shows when it was last changed.

Where a change is material, we will give notice by email or in the product before it takes effect. Please check this page from time to time.

How to contact us

For any privacy question, data subject request, or complaint, email info@quaestra.ai or write to us at the address below. Our Terms and Conditions govern the wider relationship, and a data processing agreement is available on request.