Privacy Policy

Qooly AI Inc. is a Delaware corporation headquartered in New York, United States. For personal information described in this policy that we decide how and why to process (website visitors, prospects, job applicants and our customers' account users), Qooly is the controller (under the GDPR) and the business (under the CCPA).

Questions about this policy or our privacy practices can be sent to privacy@qooly.ai.

Our customers are businesses. When a customer uses Qooly to import, enrich, manage and distribute its product and catalog data ("Customer Data"), we process that data on the customer's behalf, as a processor (GDPR) or service provider (CCPA), under our agreement with that customer and our Data Processing Addendum (DPA). The customer is responsible for its own privacy notices and for the lawful basis of that processing. If you are an individual whose information is in a customer's catalog, please contact that customer directly; we will help them respond.

This policy does not cover third-party sites, marketplaces or channels you connect to Qooly; their own policies apply.

Information you give us

• Contact and demo requests: first and last name, work email, company, job title, country, phone number (optional), topic and your message.
• Newsletter sign-ups: your email address and, if you sign up through a contact or demo form, your name, company and job title.
• Job applications: name, email, the team you are applying to, where you would work from, a LinkedIn, GitHub or portfolio link, and your message. Please do not send sensitive information (for example health, religion or immigration status) unless we ask for it.
• Account information: name, work email, role, company, login credentials and workspace settings.
• Billing information: billing contact, company address and tax/VAT number. Card details are collected and processed by our payment provider; we do not store full card numbers.
• Communications: support requests, feedback, survey answers and anything else you send us.

Information collected automatically

• Log and device data: IP address, browser and device type, operating system, referring URL, pages viewed and timestamps, collected by our hosting provider to deliver and secure the site.
• Privacy-friendly analytics: aggregated page-view and performance measurements (Vercel Web Analytics and Speed Insights). These do not use cookies and do not track you across other sites.
• Google Analytics: analytics cookies that show how the site is used. In the EU, UK and Switzerland they are set only if you allow them; elsewhere they are on unless you reject them. If you reject, it runs in a cookieless, consent-denied mode under Google Consent Mode.
• How you found us: the page you first arrived on, the site that referred you and any campaign tags in the link (for example utm_source). This is kept in your browser and sent to us only with a form you submit, so we know which channel brought your enquiry. It is not kept if you reject analytics cookies.
• Platform usage: features used, actions taken, errors and audit-trail events inside the Qooly platform.

Information from other sources

• Channels, marketplaces and systems you or your company connect to Qooly (for example an ERP, storefront or marketplace account)
• Your employer or colleague, when they invite you to a workspace
• Event organisers, partners and resellers, and publicly available business sources such as company websites and professional profiles

Sensitive information

We do not intentionally collect special-category or sensitive personal information (such as health, biometric, racial or ethnic origin, religious or political views). If it reaches us by mistake, for example in a message or CV, we use it only to deal with the request it came with and then delete it.

• Provide, operate, maintain and secure the Services, including authentication and fraud prevention
• Respond to enquiries, schedule demos and provide customer support, and keep a record of sales conversations in our customer relationship management (CRM) system
• Send our newsletter to people who subscribe to it
• Process subscriptions, invoices and payments
• Evaluate job applications and communicate with candidates
• Understand how the site and Services are used, fix problems and improve them
• Send service notices, security alerts and, where permitted, product news and marketing (you can opt out at any time)
• Comply with legal obligations, enforce our agreements and defend legal claims

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Where the GDPR, UK GDPR or Swiss Federal Act on Data Protection applies, we rely on the following legal bases:

Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for more information about that assessment.

Qooly uses AI agents to enrich, validate, translate and distribute product data. When those features run, Customer Data is processed only to provide the Services to that customer. We do not use Customer Data to train AI models that are made available to other customers, and we do not sell it.

AI processing may be performed by carefully selected model providers acting as our subprocessors under written contracts. AI-generated output can be inaccurate; customers stay in control through review, approval rules and audit trails before anything publishes. Where AI is used to interact with you directly, we will make that clear, consistent with the EU AI Act's transparency requirements.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We disclose it only as follows:

• Service providers and subprocessors who act on our instructions, for example cloud hosting and analytics (Vercel), form and transactional email delivery (Resend), business email (Microsoft 365), our CRM for sales enquiries and demo requests (Close), newsletter delivery and subscriber management (Brevo), optional analytics (Google, with consent where required), interactive 3D content on our homepage (Spline), payment processing, customer support and AI model providers. A current subprocessor list is available on request.
• Channels you connect: when you or your company connect a marketplace, storefront or other system, we send it the data you direct us to.
• Within our corporate group and to professional advisers (lawyers, auditors, insurers) under confidentiality obligations.
• Business transfers: in a merger, acquisition, financing or sale of assets, subject to this policy.
• Legal and safety: where required by law or valid legal process, or to protect the rights, property or safety of Qooly, our users or the public.
• With your consent or at your direction.

We use only the cookies and storage needed to run the site and remember your choice, plus analytics cookies (opt-in in the EU, UK and Switzerland; you can reject them anywhere). We use no advertising or retargeting cookies. Full details, and the control to change your choice, are on our Cookie Settings page.

Global Privacy Control: we honour GPC browser signals as a valid request to opt out of sale and sharing. Because we neither sell nor share personal information, no further action is needed. Our site does not respond differently to legacy "Do Not Track" signals, as there is no common standard for them.

Qooly is based in the United States and works with providers in other countries, so your information may be processed outside the country where you live. When we transfer personal data out of the EEA, UK or Switzerland to a country without an adequacy decision, we use appropriate safeguards (the European Commission's Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum and Swiss equivalents) or rely on a recipient's certification under the EU-U.S. Data Privacy Framework, its UK Extension or the Swiss-U.S. framework. You can ask us for a copy of the relevant safeguards.

We keep personal information only as long as needed for the purposes above, then delete or anonymise it:

• Account and Customer Data: for the life of the subscription, then deleted within 30 days of termination unless the customer asks for an export or the law requires us to keep it
• Sales and contact enquiries: for up to 24 months after our last interaction
• Newsletter subscriptions: until you unsubscribe; after that we keep only your email address on a suppression list so we do not email you again
• Job applications: for up to 12 months after the role is filled, or longer if you ask us to keep you in mind for future roles
• Invoices and tax records: for the period required by tax and accounting law (generally up to 7 years)
• Server logs: for a short period needed for security and troubleshooting

We protect information with encryption in transit (TLS) and at rest, role-based access controls, least-privilege access for staff, audit logging, and security controls designed around ISO 27001. No method of transmission or storage is completely secure. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.

You have the right to:

• Access your personal data and receive a copy
• Correct inaccurate or incomplete data
• Erase your data (the "right to be forgotten")
• Restrict our processing
• Receive your data in a portable, machine-readable format
• Object to processing based on legitimate interests, and to direct marketing at any time
• Withdraw consent at any time, without affecting earlier processing
• Not be subject to decisions based solely on automated processing with legal or similarly significant effects

You can also lodge a complaint with your local data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the authority in your country (list of EU authorities). We would appreciate the chance to address your concern first.

Depending on where you live (including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia), you may have the right to:

• Know and access the personal information we hold about you, including the categories and specific pieces
• Correct inaccurate personal information
• Delete personal information
• Obtain a portable copy of your personal information
• Opt out of the sale of personal information, targeted advertising and profiling with legal or similarly significant effects (we do none of these)
• Limit the use of sensitive personal information (we use it only as permitted without that right applying)
• Appeal our decision on your request
• Not be discriminated against for exercising your rights

If we deny your request, you can appeal by replying to our decision or emailing privacy@qooly.ai with "Appeal" in the subject line. If you are not satisfied with the outcome, you may contact your state attorney general.

In the past 12 months we collected the following categories of personal information, from the sources and for the purposes described in sections 3 and 4. We disclosed each category for business purposes to the recipients in section 7. We have not sold or shared any category, and we have no actual knowledge of selling or sharing information of consumers under 16.

We do not use sensitive personal information to infer characteristics about you. You may use an authorised agent to make a request; we will ask the agent for proof of authority and may ask you to verify your identity directly.

If you live elsewhere, for example in Canada (PIPEDA and provincial laws), Brazil (LGPD), Australia, Japan, Switzerland or Türkiye (KVKK), you may have similar rights to access, correct, delete or port your information and to withdraw consent. We honour those rights as local law requires; contact us using the details below.

Email privacy@qooly.ai from the address associated with your request. We will verify your identity, which may involve confirming information we already hold, and respond within one month in the EEA/UK (extendable by two months for complex requests) and within 45 days in the U.S. (extendable by 45 days where permitted). Requests are free unless they are manifestly unfounded or excessive.

If your information is Customer Data that we process for one of our customers, we will pass your request to that customer and support them in responding.

We send business-to-business product news and event invitations where the law permits, with consent where required (for example under the EU ePrivacy rules and UK PECR) and in line with the U.S. CAN-SPAM Act. Our newsletter is sent through Brevo, which reports whether an email was delivered, opened or clicked so we can improve it. Every marketing email includes an unsubscribe link, or you can email privacy@qooly.ai. We will still send service and security messages you need.

The Services are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact privacy@qooly.ai and we will delete it.

We may update this policy as our Services or the law change. We will post the new version here with a new "Last updated" date and, for material changes, notify account holders by email or in the platform before they take effect.

For privacy questions, requests or complaints: