Privacy Policy
Effective 4 October 2026 · Last updated 4 October 2026
Draft: business details still to be added (proprietor's legal name, registered business address, city for courts' jurisdiction, Grievance Officer's name, confirmed domain and email addresses).
In short. We collect what we need to run your account and the Service: your email, workspace and settings, billing references from Razorpay (never your card number), and security logs. We count visits without cookies. We don't sell or share your data for advertising. You can see, correct, export or delete your data by emailing privacy@qynion.ai.
1. Who is responsible for your data
Qynion (sole proprietorship; proprietor's name to be added), based in India ("QYNION", "we"), decides how and why your personal data is used when you use the QYNION website, dashboard, API, emails and paid plans (the "Service"). We are the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the "controller" under the EU and UK GDPR.
Contact for anything in this policy: privacy@qynion.ai. Our Grievance Officer and address are on the Contact page.
This policy does not cover the public information we analyse about AI companies, models and projects (for example, company announcements or model benchmarks): that is about organisations, not about you.
2. What we collect
You give us
- Account: your email address and sign-in details, handled by our authentication provider. We never see your password if you use a sign-in link or single sign-on.
- Workspace: workspace name, members' emails and roles, invitations, API key names (keys are stored only as one-way hashes), webhook addresses and alert settings.
- Your settings and content: saved AI stacks, watchlists, alert rules, preferences and email choices.
- Billing: your plan, subscription status, payment and invoice references and amounts, received from Razorpay. Card and bank details are entered on Razorpay's secure form and never reach us.
- Requests and messages: what you send us by email, the API access form or the referral programme (including a payout email address if you join it).
Collected automatically
- Security and audit logs: for actions in a workspace (such as creating keys, inviting members or changing billing), the time, the account and the IP address and browser type used. Our servers also process IP addresses briefly for rate limiting and abuse prevention.
- API usage: request counts per key per day and endpoint group, to apply plan limits and show you your usage.
- Cookieless usage counts: page views and a few actions (such as running the Stack Analyzer or starting checkout). To count visitors without cookies, our server combines your IP address and browser type with a secret that changes every day and keeps only the resulting code; it does not store your IP address or browser type, and visits on different days cannot be linked. If you are signed in, these events are linked to your account. If your browser sends Global Privacy Control or Do Not Track, nothing is recorded.
- Error reports: if the website crashes, a technical report: the page path (with query strings and tokens removed), the error message and the browser type.
Stored in your browser
We use your browser's local storage, not advertising or tracking cookies, for: your sign-in session, an API key or admin key you enter, recently viewed pages, dismissed notices, your language, and the website or campaign that first brought you to QYNION. Clearing site data removes them.
3. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR / DPDP) |
|---|---|
| Provide your account, workspace, alerts, emails you ask for, and the API | Contract; your consent or a legitimate use for the service you asked for (DPDP) |
| Take payments, issue receipts, handle refunds and keep tax records | Contract; legal obligation |
| Keep the Service secure: rate limits, abuse prevention, audit logs | Legitimate interests; legal obligation |
| Understand and improve the Service with cookieless usage counts | Legitimate interests (you can opt out with Global Privacy Control or Do Not Track) |
| Product and onboarding emails about your account (with one-click unsubscribe) | Legitimate interests or consent, as local law requires |
| Respond to requests, complaints and legal claims | Legal obligation; legitimate interests |
Where we rely on consent, you can withdraw it at any time, as easily as you gave it. We do not use your data for automated decisions with legal or similarly significant effects, and we do not sell personal data or use it for cross-context behavioural advertising.
5. International transfers
Our main servers are in the United States. Transfers from India are made as the DPDP Act permits. Transfers from the EU, UK and Switzerland rely on the European Commission's Standard Contractual Clauses (and the UK addendum), or on the EU-US Data Privacy Framework where a provider is certified, with additional safeguards such as encryption in transit and at rest.
6. How long we keep it
- Account, workspace and settings: while your account is open; deleted within 30 days of a deletion request or account closure.
- Billing records and invoices: as long as tax and accounting law requires (generally up to 8 years in India).
- Workspace audit logs: 365 days.
- Cookieless usage events: 400 days.
- API usage counts: as long as needed to show usage history and enforce plan limits.
- Server and error logs: on a rolling basis set by our hosting providers, typically up to 90 days.
- Emails and requests to us: as long as needed to handle them and any follow-up.
7. Your rights
Wherever you are, you can ask us to:
- tell you what personal data we hold about you and give you a copy (in a portable format where required);
- correct, complete or update it;
- delete it, or close your account;
- stop or restrict a use of it, or object to it, including direct marketing (every marketing email also has an unsubscribe link);
- withdraw consent you have given.
Email privacy@qynion.ai from your account's address. We may need to confirm your identity. We respond within one month (within the time the law sets where it is shorter), free of charge.
India (DPDP Act 2023)
You also have the right to grievance redressal through our Grievance Officer (see Contact) and to nominate another person to exercise your rights if you die or become unable to. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
European Union, UK and Switzerland (GDPR)
You also have the right to data portability and to lodge a complaint with the data-protection authority where you live or work.
United States (including California, Virginia, Colorado and other states)
You have the rights to know, access, correct, delete and port your personal information, and not to be discriminated against for using them. We do not sell or "share" personal information (as California law defines it), and we honour Global Privacy Control. You can use an authorised agent; if we decline a request, you can appeal by replying to our decision.
Other countries
If you live elsewhere, you have at least the rights above and any others your local law gives you. Contact us and we will apply them.
8. Security and breaches
We use encryption in transit (HTTPS) and at rest, store API keys and sign-in secrets only as hashes, sign webhooks, limit staff access, keep audit logs, and test our access controls automatically. No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires, including the Data Protection Board of India and, where GDPR applies, the competent authority within 72 hours.
9. Children
The Service is for professionals and is not intended for anyone under 18. We do not knowingly collect data from children; if you believe a child has given us personal data, contact us and we will delete it.
10. Changes to this policy
We will post updates here with a new date, and tell you by email or in the Service before material changes take effect.
11. Contact
Privacy requests and questions: privacy@qynion.ai. Grievance Officer and postal address: see Contact.