Privacy Policy

1. Introduction

QuanaLLP ("we", "us", or "our"), headquartered in Bengaluru, Karnataka, India, is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, store, and disclose your personal information when you use our platform and services (the "Services").

This policy is compliant with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDPA) of India, as applicable.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, company name, and billing address when you register or subscribe.
• Payment Information: Payment details are processed by our third-party payment gateway providers. We do not store your credit/debit card or bank account numbers on our servers.
• Content: Any data, files, or information you upload, create, or generate while using the Services.
• Communications: Information you provide when you contact our support team, submit feedback, or respond to surveys.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, clicks, time spent, and other interaction data.
• Device Information: Browser type, operating system, device type, screen resolution, and language preferences.
• Log Data: IP address, access times, referring URLs, and error logs.
• Cookies & Similar Technologies: We use cookies, local storage, and similar technologies for authentication, preferences, and analytics. See Section 8 for details.

3. How We Use Your Information

We use the collected information for the following purposes:

• To provide, maintain, and improve the Services.
• To process transactions and send related information (invoices, receipts, confirmations).
• To send administrative communications such as service updates, security alerts, and support messages.
• To respond to your enquiries and provide customer support.
• To monitor and analyse usage patterns for performance optimisation.
• To detect, prevent, and address security issues, fraud, or technical problems.
• To comply with legal obligations under Indian law.

4. Legal Basis for Processing

Under the DPDPA 2023 and applicable Indian law, we process your personal data based on:

• Consent: Where you have given us explicit consent to process your data for specific purposes.
• Contractual Necessity: Where processing is necessary to perform our contract with you (i.e., providing the Services).
• Legitimate Uses: As permitted under the DPDPA for purposes such as security, fraud prevention, and compliance with law.
• Legal Obligation: Where processing is necessary to comply with applicable Indian laws and regulations.

5. Data Sharing & Disclosure

We do not sell your personal information. We may share your information with:

• Service Providers: Third-party vendors who assist us in operating the Services (hosting, payment processing, analytics, email delivery). These providers are contractually obligated to protect your data.
• Legal Requirements: When required by law, regulation, legal process, or governmental request by Indian authorities.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction.
• With Your Consent: For any purpose disclosed at the time of collection with your explicit consent.

6. Data Storage & Security

Your data is stored on secure servers. We implement industry-standard security measures, including:

• Encryption of data in transit (TLS/SSL) and at rest.
• Access controls and role-based authentication.
• Regular security audits and vulnerability assessments.
• Secure coding practices aligned with OWASP guidelines.

While we take reasonable precautions, no method of transmission or storage is 100% secure. We comply with the reasonable security practices prescribed under the IT Rules, 2011.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Services. Upon account deletion or subscription cancellation, we will delete or anonymise your data within 90 days, except where we are required to retain it by law (e.g., tax and accounting requirements under Indian law for a minimum of 8 years).

8. Cookies & Tracking Technologies

We use the following types of cookies:

• Essential Cookies: Required for authentication and core functionality.
• Analytics Cookies: Help us understand usage patterns and improve the Services.
• Preference Cookies: Remember your settings and display preferences.

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect your ability to use the Services.

9. Your Rights

Under the DPDPA 2023 and applicable Indian law, you have the right to:

• Access: Request a summary of your personal data being processed.
• Correction: Request correction of inaccurate or incomplete personal data.
• Erasure: Request deletion of your personal data, subject to legal retention obligations.
• Withdraw Consent: Withdraw previously given consent at any time. Withdrawal will not affect the lawfulness of prior processing.
• Grievance Redressal: Lodge a complaint with our Data Protection Officer or the Data Protection Board of India.
• Nomination: Nominate an individual to exercise your data rights in the event of your death or incapacity, as provided under the DPDPA.

To exercise any of these rights, contact us at connect@quana.ai. We will respond within 30 days.

10. Cross-Border Data Transfers

Your data may be transferred to and processed in countries outside India where our service providers operate. We ensure that such transfers comply with the provisions of the DPDPA 2023 and are made only to jurisdictions or entities that provide adequate data protection, or are covered by appropriate contractual safeguards.

11. Children's Privacy

Our Services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has provided personal data, we will take steps to delete such data promptly. As required under the DPDPA, we will obtain verifiable consent from a parent or legal guardian before processing any data of a person below 18 years of age.

12. Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDPA 2023, we have appointed a Grievance Officer to address your concerns:

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through a prominent notice on the Platform at least fifteen (15) days before they take effect. Your continued use of the Services after such changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at: