Two different kinds of data
| Our own visitors and users | Customer assurance data | |
|---|---|---|
| What | People who visit eval.qa, book a readiness review, apply to the Evaluator Guild, use the qabit console, or contact us | Schema metadata, generated SQL, evidence and bundles produced in an assurance engagement, which may contain a customer’s users’ personal data |
| Our role | Controller | Processor, on the customer’s instructions and evidence mode |
| Governed by | This policy | The Data Processing Addendum |
If you are an end user of a product whose agent a customer has asked us to verify, we hold no relationship with you and, in the default evidence mode, none of your data. Contact that company, or contact us and we will route it.
What we collect about our own users
- Readiness-review and contact forms: name, work email, company, role, warehouse, agent type, deployment stage, and anything you type in the message field.
- Reviewer applications: the above plus what is needed to qualify and pay you: SQL/dbt background, country and processing location, identity verification, tax status and payment details, and your qualification-battery results.
- Console accounts (qabit): name, email, organisation, and a single-sign-on identifier.
- Notary checks: the hash you submit and your IP address, in a rate-limit log kept for 30 days. A hash identifies a bundle, not a person.
- Usage and security logs: pages viewed and API calls made, with IP address and user agent.
- Analytics: Google Analytics, for aggregate traffic patterns.
We do not buy personal data, and we do not run advertising or profiling.
Why, and on what basis
| Purpose | Basis (UK/EU GDPR) |
|---|---|
| Replying to a readiness-review request or enquiry | Legitimate interests; contract where an engagement follows |
| Running a console account and delivering the service | Contract |
| Qualifying, onboarding and paying reviewers | Contract, and legal obligation for tax records |
| Security, abuse prevention, rate limiting | Legitimate interests |
| Aggregate analytics | Legitimate interests (consent where local law requires it) |
| Product and engagement email | Legitimate interests, with an unsubscribe in every non-contractual message |
Who we share it with
Only the service providers we need to run the business, listed by name on the subprocessors page, plus professional advisers and anyone we are legally required to disclose to. We do not sell personal data or share it for anyone else’s marketing. We do not use your data, or your customers’ data, to train or fine-tune any model.
How long we keep it
- Enquiries and readiness-review requests: 24 months.
- Console account data: while the account is open, then 12 months.
- Reviewer records: while active, then 12 months — except tax and payment records, kept for the period the law requires. Qualification results are kept while you are on the roster.
- Customer assurance data: per the DPA and the evidence mode — Mode 2 diagnostics 14 days; hashes and signatures indefinitely, because they contain no personal data.
- Security and rate-limit logs: 12 months (notary rate-limit log: 30 days).
Your rights
Depending on where you live, you can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, ask for it in a portable format, and withdraw consent where consent was the basis. If you are in California you can also ask what we collected, ask for deletion, and opt out of “sale” or “sharing” — we do neither.
Email [email protected]. We reply within 30 days and will not treat you differently for asking. If you are unhappy with the answer you can complain to your data protection authority.
Where the data is
We operate from the United States and our reviewers work in more than one country; a reviewer’s processing location is recorded per engagement. Where personal data moves out of the UK or EEA we rely on the European Commission’s standard contractual clauses with a transfer impact assessment, and customer transfers are covered by the DPA.
Cookies
A session cookie in the console so you stay signed in, and Google Analytics cookies for aggregate traffic. No advertising cookies and no cross-site tracking. The public pages set no cookies of their own; the qabit embedded form sets no third-party cookies on your users.
Children
Not directed at under-16s, and we do not knowingly collect their data. Tell us if you think we have and we will delete it.
Changes
The date at the top changes when this page does. If a change materially affects how we use your data, we will email account holders rather than quietly reposting.