Privacy Policy

2. Information We Collect

We only collect information we have a genuine reason to collect — to run the Services, to communicate with you, or to make QBRBuilder better. We collect information in three ways: what you give us directly, what we collect automatically, and what we receive from third parties you connect to QBRBuilder.

• Account information. When you sign up, we collect your name, work email address, password (stored securely, never in plain text), and job title or role, if provided.
• Business and QBR data. To generate your reports, you provide us with account, usage, and performance data about your own customers — for example, metrics, notes, goals, and related business content (“Your Data”). This is the data our AI features process to produce Output.
• Payment information. If you purchase a paid plan, our payment processor collects your billing details. See Section 14 below.
• Communications. If you contact support, respond to a survey, or otherwise write to us, we keep a record of that communication so we can help you and improve our Services.
• Automatically collected information. Like most online services, we automatically collect technical information such as your IP address, browser type, device identifiers, operating system, referring pages, and the actions you take within the Services (log and usage data).
• Cookies and similar technologies. We use cookies and comparable technologies to keep you logged in, remember your preferences, and understand how the Services are used. See Section 7.

3. How We Use Your Information

We process your information for purposes including:

• Providing the Services — creating and maintaining your account, generating AI Output from Your Data, processing payments, and delivering customer support.
• Improving and securing the Services — understanding how QBRBuilder is used so we can fix problems, build better features, and detect and prevent fraud or abuse.
• Communicating with you — sending account, billing, and service-related notices necessary to operate your account and the Services (for example, sign-in confirmations, billing receipts, and team invitations). We do not currently send marketing or promotional email; if that changes, we will update this Policy and give you a way to opt in and out before we do.
• Complying with the law — meeting our legal, tax, and regulatory obligations, and responding to lawful requests from authorities.

4. Legal Bases for Processing (GDPR)

If you’re located in the European Economic Area, the UK, or Switzerland, data protection law requires us to identify the legal basis we rely on to process your personal information. Depending on the circumstances, we rely on:

• Performance of a contract — to provide the Services you’ve signed up for, such as hosting your account and generating your reports.
• Legitimate interests — to secure and improve our Services, prevent fraud, and communicate with you about your account, where these interests aren’t outweighed by your rights.
• Consent — for optional things like certain non-essential cookies (see Section 7), which you can withdraw at any time.
• Legal obligation — where we need to process information to comply with the law, such as tax and accounting requirements.

5. Artificial Intelligence & Your Data

Generating QBR Output is the core of what QBRBuilder does, so please read this section carefully.

• Your data is used to serve you — not to train public models. We process Your Data through artificial intelligence solely to generate the reports and Output you request. We do not use your business data to train, fine-tune, or improve any public or third-party AI model, and we do not use it to improve models made available to other customers.
• Third-party AI providers. We use third-party AI infrastructure providers (such as Anthropic) to power our AI features. These providers process Your Data as our processor, under contractual terms that prohibit them from using it to train their own models or for any purpose other than providing the service to us.
• Data minimization. We send AI providers only the data reasonably necessary to generate your Output, and we don’t use AI processing for automated decisions that produce legal or similarly significant effects about individuals.
• Retention of AI inputs. Information submitted for AI processing is used to generate your Output and is not retained by us for model-training purposes.

6. How We Share Information

We don’t sell your personal information. We share information only in the following circumstances:

• Service providers. We share information with vendors who help us run QBRBuilder, each limited to the role described: Vercel (application hosting — runs the QBRBuilder web application), Supabase (database, authentication, and file storage), Stripe (payment processing — see Section 14), Anthropic (AI infrastructure that generates your Output — see Section 5), Resend (delivering the transactional emails described in Section 3), and Cloudflare (bot-abuse prevention on our forms). These providers are contractually bound to use your information only to provide their services to us.
• Analytics, with your consent. If you opt in to analytics cookies, we use Google Analytics to understand site traffic. Google Analytics is off by default and only receives data after you consent; see Section 7 and our Cookie Policy for exactly what it collects and how to control it.
• Legal and safety reasons. We may disclose information if required by law, to respond to valid legal process, or where we believe in good faith it’s necessary to protect the rights, property, or safety of QBRBuilder, our users, or the public.
• Business transfers. If QBRBuilder is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy or a policy that offers at least equivalent protections.
• With your direction. We may share information with third parties when you specifically ask us to, such as connecting a third-party integration to your account.

7. Cookies & Tracking Technologies

We use cookies and similar technologies to keep you signed in, remember your settings, and understand how the Services are used so we can improve them. Some cookies are essential to the Services working properly; others (like analytics cookies) are optional. You can control cookies through your browser settings, though disabling essential cookies may affect how well the Services work.

8. International Data Transfers

QBRBuilder and the third-party providers we use may process information in countries other than your own, including the United States. Where we transfer personal information out of the European Economic Area, the UK, or Switzerland, we rely on appropriate safeguards recognized under applicable law, such as the European Commission’s Standard Contractual Clauses, to ensure your information continues to receive an adequate level of protection.

9. Data Retention

We keep personal information only for as long as we need it for the purposes described in this Policy, unless a longer period is required or permitted by law (for example, tax or accounting rules). Generally, this means we retain account information and Your Data for as long as your account is active, plus a reasonable period afterward to allow for account recovery, dispute resolution, and legal compliance. When we no longer need information, we delete it or render it anonymous.

When you delete your account, we delete your workspace’s account, review, and evidence data, including uploaded files, and any share links you created stop working immediately. Two narrow exceptions: (1) to prevent the same free plan from being claimed repeatedly, we keep a one-way cryptographic hash of the email address used (never the email address itself, your name, or any other account content) together with a usage count; and (2) our payment processor, Stripe, may retain billing, invoice, and transaction records after your account is deleted, as required for its own tax, accounting, and fraud-prevention obligations — that data is governed by Stripe’s own Privacy Policy (see Section 14).

10. Security

We use reasonable technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is 100% secure, so while we work hard to protect your information, we can’t guarantee absolute security.

11. Your Privacy Rights (EU/UK/GDPR)

If you’re located in the European Economic Area, the UK, or Switzerland, data protection law gives you the following rights over your personal information, subject to certain exceptions:

• Right of access — to obtain a copy of the personal information we hold about you.
• Right to rectification — to have inaccurate or incomplete information corrected.
• Right to erasure — to have your personal information deleted, subject to certain legal exceptions.
• Right to restriction of processing — to ask us to limit how we use your information in certain circumstances.
• Right to data portability — to receive your information in a structured, commonly used format, or have it transferred to another provider.
• Right to object — to object to processing based on our legitimate interests, including for direct marketing.
• Right to withdraw consent — where processing is based on consent, at any time, without affecting processing that already took place.

To exercise any of these rights, contact us using the details in Section 16. You also have the right to lodge a complaint with your local data protection supervisory authority — for example, the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), if you’re located in Czechia.

12. US State Privacy Rights

If you’re a resident of a US state with a comprehensive privacy law (such as California, Colorado, Connecticut, Virginia, or others), you may have rights to know what personal information we’ve collected about you, to access or obtain a copy of it, to correct or delete it, and to opt out of certain processing, such as targeted advertising or the sale of personal information. We do not sell personal information. You can exercise these rights by contacting us using the details in Section 16; we may need to verify your identity before responding.

13. Children’s Privacy

Our Services are intended for business use by professionals and are not directed at, or knowingly offered to, anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

14. Payment Information

Payments for QBRBuilder subscriptions are handled by our third-party payment processor, Stripe, Inc. We don’t store your full card or bank account details on our own servers — that information is submitted directly to Stripe and is governed by Stripe’s own Privacy Policy. We receive limited transaction information from Stripe, such as confirmation of payment and billing contact details, to manage your subscription.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our Services or applicable law. If we make material changes, we’ll notify you — for example, by posting a notice on our website or emailing you — and update the “Last updated” date above. Your continued use of the Services after a change takes effect means you accept the updated Policy.

16. Contact Us

If you have questions about this Privacy Policy or want to exercise any of the rights described above, please contact us at:

QBRBuilder
Email: contact@qbrbuilder.com