Privacy Policy

Overview

This Privacy Policy explains how [TO CONFIRM: legal entity name], registered at [TO CONFIRM: registered address] (“Quint Ally”, “we”), handles personal data on quintally.com and, when available, our mobile apps. We are the controller of that data. Our representative in the EU and UK: [TO CONFIRM: EU and UK representative, if required].

We collect what the network needs and nothing more. We show no ads, we don’t sell personal information, and there is no member directory.

What we collect

Getting in: your invitation code, or your waitlist application (name, work email, company and, if you give one, who referred you); your work email; and one-time sign-in codes, which are stored hashed and expire after 10 minutes if unused.

Verification: your business’s legal name, country and registration number (in the US, the state file number — never the EIN), your full name and role, and, if you choose, your website and LinkedIn URLs. If you send your company’s registration document while you are in review, we keep the company name, trade name and registration number read from it with your application; the file itself goes to our reviewers and we do not keep it. To read it, a PDF, JPEG or PNG is sent to xAI only, never to a fallback provider; xAI keeps API requests for up to 30 days and does not train on them, and if xAI is unavailable the document goes to our reviewers unread. We never ask for identity documents.

Nally: your conversations with her, and the notes she keeps about your business, the problems weighing on you (“burdens”) and what you could offer others (“gifts”). Please don’t share health or other sensitive details, or passwords — Nally doesn’t need them.

The network: your Asks and Answers, how you respond to introductions, messages in direct rooms, reports and blocks, and your place in the invitation tree (who invited you and whom you invite).

Technical: IP address, browser and device details for your sessions, sign-in rate limits and security logs, error reports, and product analytics events that carry your member id only — never your content or contact details.

Paid subscriptions, when available: Stripe processes your payment. We receive your subscription status, not your full card number.

Verified deal badges, when available: if you upload a closed, paid invoice, it is read in volatile memory by AWS Textract and never stored. We keep only the amount, the counterparty and the date.

From others: official registry records and web-search results about your business, and the invitation your inviter issued.

How we use it, and our legal bases

To let you in and keep you signed in — codes, email and sessions. Legal basis: performing our contract with you.

To verify your business — registry checks, email-domain, website and LinkedIn checks, and human review of borderline cases. Legal basis: contract, and our legitimate interest in keeping the network to real, registered businesses.

To run Nally and the network — conversation, notes, routing Asks and proposing introductions. Legal basis: contract.

To keep members and the service safe — rate limits, masking checks, reports, moderation and appeals, security logs. Legal basis: legitimate interests.

To fix and improve the product — error reports and id-only analytics. Legal basis: legitimate interests. You can object.

To send service email — sign-in codes, verification results, and notifications you control per category in Settings. Legal basis: contract.

To bill paid subscriptions, when available. Legal basis: contract, and legal obligations for tax and accounting records.

To comply with the law and establish or defend legal claims. Legal basis: legal obligation and legitimate interests.

A small team at Quint Ally accesses member data only to review verification, support requests, reports and appeals, and to keep the service running. Administrative actions are logged.

Nally and AI processing

Nally’s language work — conversation, keeping notes, masking, judging matches, the web search used to verify businesses outside the countries with official registry checks, and reading the company name and number printed on a registration document you choose to send while you are in review — runs on Grok models from xAI, a US company, and is processed in the US. If xAI is unavailable, Amazon Web Services (Amazon Bedrock, US West – Oregon) serves the same Grok models instead.

Text sent to these providers is minimised to what each request needs and never includes another member’s unmasked content. [TO CONFIRM: xAI and Amazon Bedrock retention and no-training terms for member text].

The vector representations (embeddings) we use for matching are computed on our own servers; that text does not go to a third party.

Nally’s notes are used only to route Asks and propose introductions within the network. No other member ever sees them. You can review and delete them in “Nally knows”, and a deleted note is gone from her next reply.

Verification can be decided automatically. You can ask for a person to review a rejection by writing to support@quintally.com. Moderation restrictions can be appealed the same way.

What other members see

No one can browse or search for you. When Nally routes your Ask, a few members see it masked, with identifying details removed; Answers come back masked the same way.

Introductions are double-blind: each side sees a masked description, and names, companies and contact details are revealed only when both of you accept.

Statistics about the network are shown only for groups of at least five members, so a number can never point at one person.

If you share an invitation link, the page shows your company name to whoever opens it. Your inviter can see that their code has been used.

Who we share it with

Service providers who process data for us under contract — listed by name below.

Official registries, to verify your business: we send your business name and registration number to UK Companies House, the Australian Business Register, the EU VIES service or the New Zealand Business Register, depending on your country.

Other members, only as described in “What other members see”.

Authorities or other parties when the law requires it, or to protect members, the public or Quint Ally from harm; and a successor if our business is reorganised or sold, under this Policy.

We do not sell personal information, and we do not share it for advertising.

Service providers

These companies process personal data on our behalf. Providers marked “when available” or “if used” receive data only once that feature or tool is in use.

International transfers

Our servers are in New York (DigitalOcean), and our AI providers process data in the US. If you are in the EEA, the UK or Switzerland, your data is transferred to the United States.

We protect those transfers with [TO CONFIRM: safeguard for transfers to the US, e.g. Standard Contractual Clauses].

How long we keep it

Conversations with Nally: while your account exists. You can delete them at any time; notes drawn from them stay until you delete those too.

Nally’s notes, burdens and gifts: until you delete them or your account.

Embeddings and other derived data used for matching: rebuilt continuously and deleted with your account. They are never shared.

Asks and Answers: while your account exists. When it is deleted, your unmasked text is deleted; the masked version stays in the other member’s thread.

Direct rooms: archived after 30 days of silence or when a participant leaves, then deleted one year after archival, with 30 days’ warning.

Business verification details: with your membership while your account exists. Unverified and waitlist applications: [TO CONFIRM: retention period for unverified and waitlist applications].

Verified deal badges, when available: the invoice is never stored; the amount, counterparty and date stay with your account.

Logs, error reports and analytics events: [TO CONFIRM: retention periods for logs, error reports and analytics events].

Deleting your account: in Settings → Data & privacy, or by writing to us. We act on deletion requests within 48 hours and erase your data across the service, except the masked Ask and Answer text above, an anonymised node in the invitation tree, and records the law requires us to keep. Copies in backups expire after [TO CONFIRM: backup retention period].

Cookies

We use only cookies the service needs: an httpOnly access cookie that lasts 15 minutes, an httpOnly refresh cookie that keeps you signed in for up to 30 days, and a cookie that remembers your light or dark theme.

There are no advertising cookies and no cross-site tracking.

Security

Access controls in our database let each member reach only their own data; your burdens, gifts and unmasked Ask and Answer text are readable only by you. Connections use HTTPS, sessions are short-lived and revocable, sign-in attempts are rate-limited, and administrative actions are logged.

No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authorities as the law requires.

Your rights

Wherever you live, you can see and delete what Nally remembers in “Nally knows”, delete conversations, and export your data as JSON or delete your account in Settings → Data & privacy.

If the GDPR or UK GDPR applies to you, you also have the right to access your data, have it corrected (rectification), have it erased, receive it in a portable format, restrict its processing, object to processing based on our legitimate interests, and have a person review a decision made solely by automated means.

You can complain to the data protection supervisory authority where you live or work. We would welcome the chance to put things right first.

To use any right, write to support@quintally.com from the work email on your account so we can confirm it is you. We reply within one month, and act on deletion requests within 48 hours.

California residents

Under the CCPA, as amended by the CPRA, you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and not to be treated differently for using these rights. You may act through an authorised agent; we will verify the request with you. We respond within 45 days.

We collect: identifiers (name, work email, IP address); professional information (business name, registration number, role, website and LinkedIn URLs); the content of your conversations, Asks, Answers and messages; inferences (Nally’s notes about your burdens and gifts); internet activity (sessions, security logs, id-only analytics); and, when paid subscriptions are available, commercial information (subscription status). Sources, purposes and retention are set out above, and we disclose this information only to the service providers listed, for those purposes.

We do not sell personal information and do not share it for cross-context behavioural advertising. We do not use sensitive personal information to infer characteristics about you.

Children

Quint Ally is for adults acting for a registered business. We do not knowingly collect data from anyone under 18, and we delete it if we learn we have.

Changes to this Policy

The version date shows which Policy is current. If we make a material change, we will tell you in the app or by email before it takes effect.

Contact

Privacy questions and requests: support@quintally.com. By post: [TO CONFIRM: legal entity name], [TO CONFIRM: registered address].