Privacy Policy

This Privacy Policy explains how Quantum AI Research And Development ("Quantum", "we", "us") collects, uses, and protects information when you use the QuantumPortal platform (the "Service"). By creating an account or using the Service, you agree to the practices described here.

1. Who this applies to

QuantumPortal is a business-to-business platform used by reseller companies and their team members to manage projects, corrections, updates, flowcharts, and communications. Each company account is administered by that company's own administrator; Quantum acts as the platform provider.

2. Our role: controller and processor

• For the personal data a company submits about its own staff and clients, that company is the data controller (a "Data Fiduciary" under India's DPDP Act) and Quantum acts as a data processor, handling the data only to operate the Service on the company's instructions.
• For data we collect directly to run the platform (such as account registration details, security logs, and any billing information), Quantum is the controller.

3. Information we collect

• Account & company details — company name, website, GSTIN, contact person, email address, mobile and phone numbers, and business address.
• Authentication data — your password (stored only as a secure hash, never in plain text) and one-time passcodes (OTPs) used for sign-in verification.
• Content you create — projects, corrections, progress updates, flowcharts, chat messages, and any files you upload.
• Usage & technical data — sign-in activity, last-seen/presence timestamps, IP address (used for security and login throttling), and basic browser information required to operate the Service.

4. How we use your information

• To provide, operate, and secure the Service and your account.
• To authenticate you, including sending one-time passcodes by email.
• To enable collaboration within your company account and any projects you are allocated to.
• To protect against unauthorized access, abuse, and fraud (for example, throttling repeated failed sign-in attempts).
• To communicate important account, security, or service notices.

5. Legal bases for processing

Where the GDPR applies, we rely on the following legal bases: performance of a contract (to provide the Service you or your company signed up for); our legitimate interests (to secure, maintain, and improve the Service); compliance with legal obligations; and consent where specifically requested. Under India's DPDP Act, we process personal data for lawful purposes for which the relevant individual has provided consent or which are otherwise permitted by law.

6. Cookies

We use a single essential session cookie to keep you signed in and to protect forms against cross-site request forgery. We do not use third-party advertising or tracking cookies. Disabling the essential cookie will prevent the Service from functioning.

7. How information is shared

We do not sell your personal information. Information is shared only:

• Within your own company account — your details and content are visible to your company's administrators and to team members allocated to the same projects.
• With the platform super administrator, who provides oversight of companies, users, and projects across the platform.
• With service providers (sub-processors) who help us operate the Service (for example, email delivery for passcodes and hosting infrastructure), under obligations of confidentiality and data protection.
• Where required by law, regulation, or valid legal process.

8. International data transfers

We are based in India and may process and store data there and with service providers located in other countries. Where personal data is transferred across borders, we take steps to ensure it receives an appropriate level of protection as required by applicable law (for GDPR transfers, this may include Standard Contractual Clauses or another lawful transfer mechanism).

9. Data retention

• Account and content data is retained while your account is active and as needed to provide the Service.
• Chat attachments are automatically deleted approximately 24 hours after they are sent. A countdown is shown on each attachment.
• When an account is cancelled or disabled, data is handled as described in our Terms of Service (a grace period for export, followed by deletion, except where retention is required by law).

10. Security

We apply industry-standard safeguards, including password hashing (bcrypt), one-time-passcode verification at sign-in, CSRF protection on forms, parameterized database queries to prevent injection, login-attempt throttling, and role-based access controls that limit data to the company account it belongs to. No system is perfectly secure, so we cannot guarantee absolute security.

11. Your privacy rights

Depending on where you live, you may have some or all of the following rights over your personal data. Under the GDPR these include the rights to access, rectification, erasure, restriction, data portability, and to object to certain processing, as well as the right to withdraw consent. Under India's DPDP Act, you have rights to access, correction, and erasure of your data, to grievance redressal, and to nominate another person to exercise your rights.

• You can review and update your company and profile details from the Profile & Account area once signed in.
• To exercise any of these rights, contact us using the details below. Because much of the data belongs to your company account, we may direct certain requests to your company administrator (the controller).
• You also have the right to lodge a complaint with your local data-protection authority — for EU residents, your national supervisory authority; in India, the Data Protection Board.

12. Children

The Service is intended for business use and is not directed to individuals under the age of 18. We do not knowingly collect information from children.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by the "Last updated" date above, and where appropriate we will provide additional notice.

14. Contact us

Questions about this Privacy Policy, or to exercise your privacy rights, contact us at support@quantumserves.com.