Privacy Policy
Version 2026-07 · QUONtech LLC. This describes what data QUONlab actually collects, where it actually lives, and what we actually do with it - written to match the platform, not a template.
1. What we collect
Account: your email, name, and - if you add it - a phone number. Profiles never ask for financial details, government IDs, or anything sensitive. Organization: the legal details submitted at registration (name, legal name, address, EIN, founder, phone). Work: the answers, scores, messages, orders, and unlocks your organization records while using the platform. Technical: the minimum operational logs needed to run and secure the service.
2. Where it lives - the actual services
Sign-in and sessions: Clerk. Database and records: Supabase (hosted in the United States). Application hosting: Google Cloud / Firebase App Hosting. Payments: Stripe - card numbers go to Stripe directly and never touch us. Email delivery: Resend (with Brevo as fallback). SMS, when the team texts you: Twilio. The Skippy chat widget: Voiceflow - what you type to Skippy is processed there to answer you. Each processes data only to provide its function for us.
3. Records are append-only - by design
A.C.T.U.A.L. and related modules keep permanent, append-only records: new answers supersede old ones and history remains. Deleted messages move to Trash and disappear from view after 10 days, but are not destroyed - nothing on QUONlab is silently erased, and consequential actions are written to a permanent audit log. This permanence is the product's core promise to your organization.
4. Organization isolation
Every organization's answers, purchases, wallets, and unlocks are its own. You only ever see the organizations you are a member of, and access control is enforced in the database itself - deny-by-default, for every table, always.
5. What we do - and don't do - with data
We use data to run the platform, fulfill purchases, keep records honest, and support you. We do not sell data. We do not run ads. We do not use your organization's recorded content to market to anyone. Truth Reports and compliance outputs are generated from your recorded answers solely for your organization.
6. How we contact you - your switch
The platform talks to you primarily through the Message Center. Email notifications about new messages are on by default, throttled to at most one per hour, never contain the message content, and can be turned off any time on your profile. Purchase confirmations are always sent - they are part of the record. SMS is rare, sent by a human on the team, and mirrored into your Message Center so nothing exists off the record.
8. Security
Row-level security is forced on every database table; the application can only reach data through audited, purpose-built functions. Secrets live in a managed secret store. Payment credentials never touch our systems. If you find a security problem, tell us through Messages immediately - we take reports seriously.
9. Retention and your choices
Because the platform's value is its permanent record, organizational records are retained as described in section 3 even after subscriptions end - renewal restores access to them. For questions about your personal account data, corrections, or account closure, write to us via Messages or info@quon.tech; we respond to every request and honor applicable legal rights.
10. Changes and contact
Material changes bump this policy's version. QUONtech LLC · info@quon.tech · Messages inside the platform. Jurisdiction-specific counsel review is pending, as with the Terms; the practices described here are in force today.