Privacy Policy

Last updated: March 2025

1. Introduction

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our Customer Portal. We are committed to protecting your privacy and handling your data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Data Controller

The data controller responsible for your personal data is:

• Company: Gothenburg Quantum Analytics AB
• Address: Alingsåsvägen 20, 449 50 Alafors, Sweden
• Email: [email protected]

3. What Data We Collect

We collect and process the following categories of personal data:

3.1 Account Information

• Email address - Used for account identification, login, and communication
• Name - Display name for personalization (optional)
• Avatar URL - Profile picture from OAuth provider (optional)
• Business information - Company name and tax identification number (optional, for business accounts)

3.2 Authentication Data

• OAuth provider account IDs - Links your account to Google, GitHub, or GitLab
• OAuth tokens - Encrypted tokens for authentication (automatically refreshed)

3.3 Technical Data

• IP address - For security and session management
• User agent - Browser/device information for session identification
• Session data - Login timestamps and activity
• Approximate location - Country-level location derived from your IP address, used solely for displaying prices in your local currency

3.4 Purchase & Payment Data

• Order information - Order numbers, items purchased, prices, and order status
• Billing address - For order fulfillment and tax calculation
• Shipping address - For hardware delivery (if applicable)
• Stripe customer ID - Links your account to Stripe for payment processing
• Payment records - Transaction amounts, dates, and status (we do not store card numbers)
• Tax calculation data - Tax jurisdiction, applicable tax rates, and transaction identifiers for tax compliance
• Invoice records - Generated invoice documents stored securely for your access
• Refund records - If applicable, refund amounts and reasons
• Promo code usage - Records of promotional codes applied to your orders
• Display currency - Your preferred or detected currency for price display, and exchange rates used at time of purchase

3.5 Device & Hardware Data

• Device serial numbers - For device registration and entitlement management
• Hardware purchase records - Warranty information, shipping details, claim history
• API keys - Generated keys for device authentication (stored as secure hashes)
• API usage logs - Endpoint accessed, timestamps, IP addresses (for security and debugging)

3.6 Subscription Data

• Subscription plan - Your current plan and tier level
• Billing interval - Monthly or yearly billing preference
• Subscription status - Active, cancelled, paused, or past due
• Billing periods - Current period start/end dates
• Subscription history - Plan changes, upgrades, downgrades, and cancellation reasons

3.7 Download & Usage Data

• Download history - Records of files you have downloaded, including timestamps
• IP address at download - For security monitoring and abuse prevention
• User agent at download - Browser/device information for troubleshooting

3.8 Support Data

• Support tickets - Subject, category, priority, and status
• Ticket messages - Communication content between you and our support team
• Satisfaction ratings - Optional feedback on support quality
• Warranty claims - Claim descriptions, status, and resolution details

3.9 Security Data

• Multi-factor authentication - Encrypted MFA configuration data, recovery codes, and trusted device preferences (if MFA is enabled)
• Session security data - Information used to detect unauthorized session use
• Login attempt records - For fraud prevention and account security

3.10 Preferences

• Notification settings - Your email notification preferences
• Shopping cart - Items saved in your cart (for logged-in users)

3.11 Guest Session Data

If you browse or make purchases without logging in:

• Session token - Temporary identifier for your browsing session
• Guest cart - Items added to cart during your session
• Email - If provided during checkout

Guest session data expires and is automatically deleted after a period of inactivity.

3.12 Organization Data

If you create or join an organization:

• Organization details - Name, description, and logo
• Membership data - Your role within the organization, join and leave dates
• Organization billing - Billing address and tax information for the organization
• Invitation records - Email addresses used for organization invitations
• Organization API keys - Keys generated for organizational use, with associated usage logs (endpoints accessed, timestamps)
• Organization hardware - Devices registered to the organization and claim/revocation history
• Organization subscriptions - Seat-based subscription plans, billing intervals, and member allocations

4. How We Use Your Data

We process your personal data for the following purposes:

5. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes for which it was collected:

• Account data: Until you delete your account
• Session data: 30 days after session expiry
• API usage logs: 90 days (for security monitoring)
• Download history: Duration of your account (for support and license verification)
• Support tickets: 3 years after ticket closure (for quality and legal purposes)
• Purchase and order records: 7 years (legal/tax requirements)
• Subscription history: 7 years after subscription ends (legal/tax requirements)
• Warranty claims: Duration of warranty period plus 3 years
• Guest session data: Automatically deleted after session expiry (typically 7 days of inactivity)

6. Data Sharing

We may share your data with the following third parties:

• Stripe, Inc. - Payment processing and tax calculation. Stripe receives your email, billing address, payment details, and tax identification information (if provided) for payment processing and tax compliance. See Stripe's Privacy Policy.
• OAuth Providers (Google, GitHub, GitLab) - For authentication only
• Cloud Infrastructure - For secure data storage and file hosting
• Email Service (Resend) - For sending transactional and notification emails
• Internal Notifications (Discord) - For internal team alerts related to support tickets and order events. Limited personal data (such as email address) may be included for operational purposes.

We do not sell your personal data to third parties.

We may also disclose your data when required by law, to protect our rights, or to comply with legal processes.

7. International Transfers

Your data may be processed in countries outside the European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions.

8. Your Rights

Under the GDPR, you have the following rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Restrict Processing: Request limitation of data processing
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time

How to Exercise Your Rights

You can exercise most of these rights directly from your Account Settings:

• Data Export: Download all your data using the "Download My Data" button
• Data Deletion: Delete your account and all associated data using the "Delete My Account" option
• Manage Preferences: Update your notification preferences
• Update Information: Edit your display name and manage connected accounts

For other requests or if you need assistance, please contact us at [email protected].

9. Cookies

We use the following types of cookies:

• Authentication Cookies: Required for login sessions and secure authentication. These cannot be disabled.
• Security Cookies: Used for multi-factor authentication flows and trusted device recognition, helping to protect your account.
• Guest Session Cookies: Allow unauthenticated users to browse and maintain a shopping cart.
• Preference Cookies: Remember your settings (e.g., theme preference). These are stored locally in your browser.

We do not use tracking, analytics, or advertising cookies.

10. Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Industry-standard password hashing and token security
• Multi-factor authentication options
• Regular security assessments
• Access controls and role-based permissions
• Secure cloud infrastructure

11. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you.

12. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting a notice on our website or sending you an email. The "Last updated" date at the top of this policy indicates when it was last revised.

14. Contact & Complaints

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

• Email: [email protected]

You also have the right to lodge a complaint with your local data protection authority if you believe we have not handled your data appropriately.