Privacy Policy
Version 2026-11-13 · Last updated
Overview
This Privacy Policy explains how Quintally Private Limited (“Quint Ally”, “we”) handles personal data on quintally.com and, when available, our mobile apps. We are the controller of that data. Quintally Private Limited is a company registered in Haryana, India (CIN U62090HR2026PTC148708), with its registered office at Tower J-303, 3rd Floor, Ruhil Residency, Bahadurgarh, Haryana 124507, India.
We have not appointed a representative in the European Union or the United Kingdom under Article 27 of the GDPR or of the UK GDPR. Wherever you are, you can reach us directly at support@quintally.com.
We collect what the network needs and nothing more. We show no ads, we don’t sell personal information, and there is no member directory.
What we collect
Getting in: your invitation code, or your waitlist application (name, work email, company and, if you give one, who referred you); your work email; and one-time sign-in codes, which are stored hashed and expire after 10 minutes if unused.
Verification: your business’s legal name, country and registration number (in the US, the state file number — never the EIN), your full name and role, and, if you choose, your website and LinkedIn URLs. If you send your company’s registration document while you are in review, we keep the company name, trade name and registration number read from it with your application; the file itself goes to our reviewers and we do not keep it. To read it, a PDF, JPEG or PNG is sent to xAI only, never to a fallback provider; xAI keeps API requests for up to 30 days and does not train on them, and if xAI is unavailable the document goes to our reviewers unread. We never ask for identity documents.
Nally: your conversations with her, and the notes she keeps about your business, the problems weighing on you (“burdens”) and what you could offer others (“gifts”). Please don’t share health or other sensitive details, or passwords — Nally doesn’t need them.
The network: your Asks and Answers, how you respond to introductions, messages in direct rooms, reports and blocks, and your place in the invitation tree (who invited you and whom you invite).
Asking Nally on our home page, before you join: the questions you type and her answers. Before they are kept, any email address, phone number, handle or link in them is removed, and nothing that identifies you is kept with them: no IP address, no cookie and no account. We use them only to improve her answers.
Technical: IP address, browser and device details for your sessions, sign-in rate limits and security logs, error reports, and product analytics events that carry your member id only — never your content or contact details.
Paid membership, when available: Stripe processes your payments and keeps any card you save, one saved with a request to join included. We receive the status of your payments, never your full card number. The shipping address for the metal card stays with Stripe, and we read it only to ship the card.
Verified deal badges, when available: if you upload a closed, paid invoice, it is read in volatile memory by AWS Textract and never stored. We keep only the amount, the counterparty and the date.
From others: official registry records and web-search results about your business, and the invitation your inviter issued.
How we use it, and our legal bases
To let you in and keep you signed in — codes, email and sessions. Legal basis: performing our contract with you.
To verify your business — registry checks, email-domain, website and LinkedIn checks, and human review of borderline cases. Legal basis: contract, and our legitimate interest in keeping the network to real, registered businesses.
To run Nally and the network — conversation, notes, routing Asks and proposing introductions. Legal basis: contract.
To keep members and the service safe — rate limits, masking checks, reports, moderation and appeals, security logs. Legal basis: legitimate interests.
To fix and improve the product — error reports and id-only analytics. Legal basis: legitimate interests. You can object.
To send service email — sign-in codes, verification results, and notifications you control per category in Settings. Legal basis: contract.
To bill paid subscriptions, when available. Legal basis: contract, and legal obligations for tax and accounting records.
To comply with the law and establish or defend legal claims. Legal basis: legal obligation and legitimate interests.
A small team at Quint Ally accesses member data only to review verification, support requests, reports and appeals, and to keep the service running. Administrative actions are logged.
Nally and AI processing
Nally’s language work — conversation, keeping notes, masking, judging matches, the web search used to verify businesses outside the countries with official registry checks, and reading the company name and number printed on a registration document you choose to send while you are in review — runs on Grok models from xAI, a US company that is now part of SpaceX. xAI does not promise where it processes a request: it may do so in the US or route it to another of its regions. If xAI is unavailable, we may use Amazon Web Services (Amazon Bedrock, US West – Oregon), which also serves Grok models, instead.
Text sent to these providers is minimised to what each request needs and never includes another member’s unmasked content. xAI keeps API requests and responses, encrypted, for up to 30 days so it can investigate suspected abuse, then deletes them automatically, and does not train its models on them. Amazon Web Services does not use what passes through Amazon Bedrock to train any model, does not share it with the model’s maker, and may keep it for a limited time only to detect abuse.
The vector representations (embeddings) we use for matching are computed on our own servers; that text does not go to a third party.
Nally’s notes are used only to route Asks and propose introductions within the network. No other member ever sees them. You can review and delete them in “Nally knows”, and a deleted note is gone from her next reply.
Verification can be decided automatically. You can ask for a person to review a rejection by writing to support@quintally.com. Moderation restrictions can be appealed the same way.
What other members see
No one can browse or search for you. When Nally routes your Ask, a few members see it masked, with identifying details removed; Answers come back masked the same way.
Introductions are double-blind: each side sees a masked description, and names, companies and contact details are revealed only when both of you accept.
Statistics about the network are shown only for groups of at least five members, so a number can never point at one person.
If you share an invitation link, the page shows your company name to whoever opens it. Your inviter can see that their code has been used.
Service providers
These companies process personal data on our behalf. Providers marked “when available” receive data only once that feature is in use.
We use no outside error-tracking or analytics service: error reports and analytics events stay on our own servers.
| Provider | Purpose | Location |
|---|---|---|
| xAI | Grok models for Nally’s language work: conversation, notes, masking, matching, verification web searches and reading the company name and number on a registration document you send. xAI is now part of SpaceX | United States; xAI may route a request to another of its regions |
| Amazon Web Services — Amazon Bedrock | A fallback we may use for Grok models when xAI is unavailable | United States (US West – Oregon, us-west-2) |
| Amazon Web Services — AWS Textract | Reads uploaded invoices in volatile memory for verified deal badges, when available; invoices are never stored | The AWS region we choose when verified deal badges become available; the feature is not live yet |
| DigitalOcean | Hosting: our servers, database and backups | Canada (Toronto, TOR1); backups in the United States (New York, NYC3) |
| Resend | Transactional email: sign-in codes, verification results and notifications | United States |
| Stripe | Payments for paid membership, when available, including a card saved with a request to join and the metal card’s shipping address | United States |
International transfers
We are a company in India and collect your data directly, so our team works with it from India. Our servers are in Toronto, Canada, and our backups in New York, United States (both DigitalOcean). Our other providers process data in the United States, and xAI may route a request to another of its regions.
If you are in the EEA, the UK or Switzerland, your data therefore goes to Canada, which the European Commission and the UK recognise as protecting personal data adequately, and to the United States.
We protect transfers to our other providers with the safeguards in each provider’s data processing agreement: the European Commission’s Standard Contractual Clauses, with the UK Addendum and the Swiss amendments, and, where the provider is certified, the EU-U.S. Data Privacy Framework with its UK Extension and the Swiss-U.S. Data Privacy Framework. xAI’s data processing agreement covers only requests it keeps no copy of, which we have not switched on, so transfers to xAI are covered by xAI’s terms of service for its API instead: it keeps requests for up to 30 days to investigate abuse and does not train its models on them. You can ask us for a copy of these terms at support@quintally.com.
How long we keep it
Conversations with Nally: while your account exists. You can delete them at any time; notes drawn from them stay until you delete those too.
Nally’s notes, burdens and gifts: until you delete them or your account.
Embeddings and other derived data used for matching: rebuilt continuously and deleted with your account. They are never shared.
Asks and Answers: while your account exists. When it is deleted, your unmasked text is deleted; the masked version stays in the other member’s thread.
Direct rooms: archived after 30 days of silence or when a participant leaves, then deleted one year after archival, with 30 days’ warning.
Business verification details: with your membership while your account exists.
Applications that do not lead to membership, waitlist applications included: kept until you ask us to delete them, which we do within 48 hours. When requests to join are available, a request closes after 30 days; a card saved with it is then released, and your customer record at Stripe deleted.
Verified deal badges, when available: the invoice is never stored; the amount, counterparty and date stay with your account.
Questions asked of Nally on our home page, and her answers: 90 days, then deleted by a daily job.
Product analytics events: 400 days, then deleted by a daily job. They carry your member id, never your content or contact details, and the id is removed from them when your account is deleted.
Error reports and server logs: errors are recorded only in our own server logs, never sent to another company, and those logs record events by id, never what you write. Server logs rotate: each of our services keeps only its most recent 30 MB of logs, and older entries are overwritten.
Deleting your account: in Settings → Data & privacy, or by writing to us. We act on deletion requests within 48 hours and erase your data across the service, except the masked Ask and Answer text above, an anonymised node in the invitation tree, and records the law requires us to keep. Copies in backups are deleted within 35 days: encrypted database backups are kept for 7 days, and weekly backups of our server’s disk, which can hold a nightly copy of the database, for four weeks.
Security
Access controls in our database let each member reach only their own data; your burdens, gifts and unmasked Ask and Answer text are readable only by you. Connections use HTTPS, sessions are short-lived and revocable, sign-in attempts are rate-limited, and administrative actions are logged.
No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authorities as the law requires.
Your rights
Wherever you live, you can see and delete what Nally remembers in “Nally knows”, delete conversations, and export your data as JSON or delete your account in Settings → Data & privacy.
If the GDPR or UK GDPR applies to you, you also have the right to access your data, have it corrected (rectification), have it erased, receive it in a portable format, restrict its processing, object to processing based on our legitimate interests, and have a person review a decision made solely by automated means.
You can complain to the data protection supervisory authority where you live or work. We would welcome the chance to put things right first.
To use any right, write to support@quintally.com from your account’s work email so we can confirm it is you. We reply within one month, and act on deletion requests within 48 hours.
California residents
Under the CCPA, as amended by the CPRA, you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and not to be treated differently for using these rights. You may act through an authorised agent; we will verify the request with you. We respond within 45 days.
We collect: identifiers (name, work email, IP address); professional information (business name, registration number, role, website and LinkedIn URLs); the content of your conversations, Asks, Answers and messages; inferences (Nally’s notes about your burdens and gifts); internet activity (sessions, security logs, id-only analytics); and, when paid subscriptions are available, commercial information (subscription status). Sources, purposes and retention are set out above, and we disclose this information only to the service providers listed, for those purposes.
We do not sell personal information and do not share it for cross-context behavioural advertising. We do not use sensitive personal information to infer characteristics about you.
Children
Quint Ally is for adults acting for a registered business. We do not knowingly collect data from anyone under 18, and we delete it if we learn we have.
Changes to this Policy
The version date shows which Policy is current. If we make a material change, we will tell you in the app or by email before it takes effect.
Contact
Privacy questions and requests: support@quintally.com. By post: Quintally Private Limited, Tower J-303, 3rd Floor, Ruhil Residency, Bahadurgarh, Haryana 124507, India. Every way to reach us is at quintally.com/contact.