Privacy Policy

Effective date: April 1, 2026

Qhubio ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use our platform at qhubio.com.

1. Data Controller

The controller responsible for processing your personal data is:

2. What Data We Collect

We collect the following categories of personal data:

• Account data: email address, name (if provided), authentication credentials.
• Usage data: pages visited, features used, timestamps, browser and device information.
• Uploaded documents: files you upload for FMEA generation (e.g., PDF, DOCX, XLSX). These are processed temporarily and deleted automatically after generation completes.
• Generated content: FMEA records, audit data, and documents created through the platform.

3. Why We Process Your Data

We process personal data for the following purposes:

• To provide and maintain the Qhubio platform and its features.
• To authenticate users and manage accounts.
• To process uploaded documents and generate FMEA analyses.
• To improve our services through aggregated, anonymized analytics.
• To communicate with you about your account or service changes.
• To comply with legal obligations.

4. How Uploaded Documents Are Handled

We do not retain copies of your source documents beyond the processing lifecycle. Generated FMEA records remain in your account until you delete them or delete your account.

5. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy:

• Account data: retained while your account is active. Deleted when you delete your account.
• Uploaded documents: deleted automatically after processing completes.
• Generated records: retained until you delete them or your account.
• Backups: data may persist in encrypted backups for up to 30 days after deletion.

For full details, see our Data Retention & Deletion Policy.

6. Third Parties & Subprocessors

We use the following categories of subprocessors:

• Cloud infrastructure: Supabase (database, authentication, storage) — EU/US regions.
• AI processing: OpenAI / language model providers — for FMEA generation.
• Analytics: Google Analytics — for aggregated usage insights.
• Hosting: Lovable / Vercel — for serving the web application.

We do not sell or share your personal data with third parties for marketing purposes.

7. International Data Transfers

Your data may be processed in Switzerland, the European Economic Area, or the United States depending on the subprocessor. Where data is transferred outside Switzerland or the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions.

8. Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS) and at rest.
• Row-level security on database tables.
• Role-based access controls.
• Automatic deletion of temporary files after processing.
• Regular security reviews.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your data and account.
• Portability: request your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests.
• Restriction: request restricted processing under certain conditions.

To exercise any of these rights, contact us at info@qhubio.com.

10. Account Deletion

You can permanently delete your account from the Dashboard. This triggers an irreversible process that removes:

• All uploaded files from storage.
• All FMEA records, documents, and profile data from the database.
• Your authentication record from our identity provider.

After deletion, data may persist in encrypted backups for up to 30 days before being permanently purged.

11. Cookies & Tracking

Qhubio uses a small set of cookies and browser storage. Strictly necessary items (Supabase authentication token, language preference, cookie consent record, post-login redirect) are always active. Optional Google Analytics (GA4, ID G-7NM0GZV83N) is loaded only after you explicitly accept analytics in the cookie banner; if you reject or do nothing, the GA4 script is never injected.

You can change your cookie choice anytime via the "Cookie preferences" link in the footer. For the full inventory of cookies and storage, see our Cookie Policy.

Key Service Providers

• Supabase — authentication, database (with row-level security), and file storage. Auth token is stored in your browser's localStorage.
• Google Analytics (GA4) — aggregated usage analytics. Loaded only with your consent.
• Google OAuth — used only when you click "Sign in with Google". Google sets cookies on its own domain at that point.
• Stripe — payment processing. Invoked server-side via secure edge functions; no Stripe.js client tracker is loaded in your browser.
• OpenAI — AI processing for FMEA generation, called server-side from our edge functions.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the platform or via email. The effective date at the top of this page indicates the last revision.

13. Contact

For any privacy-related questions, requests, or complaints, contact us at: info@qhubio.com.