Privacy policy

This policy explains what personal data QUORIAN - F.Z.E collects, why we collect it, who we share it with, and what you can ask us to do about it. It covers quorian.com and the client portal.

Drafted to match how the product actually works, but not yet reviewed by a qualified lawyer. Have counsel check it before your first client. [CONFIRM]

1. Who is responsible

QUORIAN - F.Z.E
Office C1 - 1F - SF10967
Ajman Free Zone C1 Building
Ajman Free Zone
Ajman, United Arab Emirates
Makani 4442612247
privacy@quorian.com

We are registered in the United Arab Emirates and are subject to UAE Federal Decree Law No. 45 of 2021 on the Protection of Personal Data. Where we handle data about people in the UK or the European Economic Area, the UK GDPR and the EU GDPR also apply to that handling, and this policy is written to meet both.

2. Two different roles, and why it matters to you

We handle personal data in two distinct ways, and your rights differ depending on which one applies.

• As controller. For data about our clients and the people who work for them, we decide what is collected and why. This policy governs that data.
• As processor.For data about a client’s prospects, the client decides who is contacted and why. We only act on their instructions. See section 8.

3. What we collect as controller

• Account data. Name, work email, organisation name, and role.
• Onboarding data. Company profile, ideal customer profile, offer, competitors, buyer questions, and tone notes.
• Files you upload. Brand assets and email exports, stored in a location isolated to your organisation.
• Connected sources you authorise. Accessed only to deliver the modules you bought, and only with the permissions you grant.
• Billing data. Handled by Stripe. We receive confirmation of payment and the last four digits of the card. We never see the full number.
• Service records. Logs of what the system did for you, kept so we can investigate faults and show you what happened.

We do not run advertising trackers or third party analytics on this site. See our Cookie policy.

4. Why we use it, and our lawful basis

• To deliver the service you bought. Basis: performance of our contract with you.
• To bill you and keep accounting records. Basis: legal obligation and contract.
• To keep the service secure and diagnose faults. Basis: our legitimate interest in running a service that works.
• To send service email such as approval requests, alerts and scan results. Basis: contract. These are not marketing and cannot be switched off while your account is active.

We do not sell personal data. We do not use your data, or your prospects’ data, to train AI models, and our AI providers are engaged on terms that do not permit them to train on it either.

5. Who we share it with

Only the providers we need to run the service. Each is bound by contract to protect the data and to use it only for the service they provide to us. The current list, with what each one handles and where it is located, is published at quorian.com/subprocessors.

We will also disclose data where we are legally required to. If that happens and we are permitted to tell you, we will.

6. Where your data is held

Our providers operate internationally, so personal data may be processed outside the United Arab Emirates, including in the European Union and the United States. Where data protected by the UK or EU GDPR leaves that area, transfers are covered by Standard Contractual Clauses or another approved mechanism in our agreements with each provider. [CONFIRM the hosting regions you select in Supabase and Vercel]

7. How long we keep it

• Account and onboarding data: while your account is active, then 12 months after it closes, so it can be restored if you come back. After that it is deleted.
• Campaign and reporting history: while your account is active, then deleted with the account at the end of the same 12 months.
• Invoices and accounting records: five years, which is the retention UAE law requires of us. These are kept even if you ask for deletion, because we are not permitted to destroy them.
• Backups: deleted data can persist in encrypted backups for up to 35 days before those roll over. It is not restored into the live service.
• Suppression lists: kept indefinitely. See section 8.

8. Prospect data in PIPELINE

When we send outbound email for a client, the people contacted are not our customers and did not come to us. The client chose them.

For that data the client is the controller and Quorian is the processor. We act only on the client’s documented instructions, under the Data processing agreement. The client is responsible for having a lawful basis to contact each person, as set out in our Acceptable use policy.

If you received an email sent through Quorian and want it to stop, use the unsubscribe link in that email. It works immediately and does not require you to reply. You can also write to privacy@quorian.com and we will pass your request to the client who contacted you and suppress your address on our side.

Suppression works by keeping a record of the address that must not be contacted again. That is why we keep suppression lists indefinitely: deleting the record would let the same address be contacted again, which is the opposite of what was asked for.

9. Security

• Every table in our database enforces organisation level isolation, so one client’s query cannot reach another client’s rows.
• Credentials such as mailbox passwords and API tokens are stored separately from ordinary data and are not readable by any client account, including your own.
• Data is encrypted in transit and at rest by our providers.
• Access to production data is limited to staff who need it.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant regulator within the time limits the law sets.

10. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to a use based on legitimate interest. You can also ask for it in a portable format.

Write to privacy@quorian.com. We will respond within 30 days. We do not charge for this.

If you are unhappy with our response you can complain to the UAE Data Office, or to the data protection authority in your own country if you are in the UK or the EEA.

If your request concerns an email you received from one of our clients, we will forward it to that client, because they hold the decision about that data. We will tell you who they are.

11. Children

This is a business service. It is not directed at children and we do not knowingly collect their data.

12. Changes

We will update this page when our processing changes and move the date at the top. If a change materially affects you we will email you.

13. Contact

privacy@quorian.com for anything in this policy, or write to us at the address in section 1.