Privacy Policy

1. Introduction

Qu Platforms, Inc. ("we", "our", "us") operates Qu Review, an independent AI-powered review service for AI conversations. Qu Review is accessible through the web dashboard at app.qureview.ai, within ChatGPT, and through any MCP-compatible application.

This Privacy Policy explains how we collect, use, share, and protect your information when you use Qu Review. It applies to our websites qureview.ai and app.qureview.ai and any interactions with the Qu Review service regardless of how you access it.

2. Information We Collect

Account Information

Email address and password (hashed) provided during registration.

Conversation Content

AI conversation questions and responses you submit for review, whether via the web dashboard, ChatGPT, or another MCP-compatible application.

Review Results

AI-generated review output produced for your submitted content.

Payment and Subscription Data

Payment transactions are processed by Stripe. We store your subscription status and transaction history but do not store your credit card details.

Usage Data

Review counts, timestamps, and subscription status associated with your account.

Technical Data

Collected via Google Analytics 4 in cookieless mode: anonymized IP address, browser type, and pages visited. No personally identifiable information is collected through analytics.

3. How We Use Your Data

• Review generation -- Conversation content you submit is sent to independent AI providers for analysis. The specific providers used depend on the platform through which you access Qu Review (see Section 4).
• Account management and authentication -- To create and maintain your account, verify your identity, and provide access to your review history.
• Payment processing and subscription management -- To process payments through Stripe and manage your subscription status.
• Transactional emails -- To send essential communications such as password resets via SendGrid.
• Bot protection -- Cloudflare Turnstile is used during signup to prevent automated abuse.
• Service improvement -- Aggregated, anonymized metrics help us improve the quality and reliability of the service. We do not use your conversation content for this purpose.

4. How Your Data Flows

Qu Review can be accessed in multiple ways. Here is how your data flows in each case:

Web Interface (app.qureview.ai)

1. You submit content directly through the Qu Review dashboard.
2. Qu Review sends it to independent AI providers for analysis.
3. Qu Review synthesizes the results into a review, which is returned and stored in your account.

AI Chat Platforms (e.g. ChatGPT, via MCP)

1. You engage with the host AI and elicit its responses.
2. When you request a review, the host platform provides a high-fidelity representation of the conversation to Qu Review's server via MCP (Model Context Protocol). The content transmitted may be summarized or adapted by the host platform rather than passed verbatim.
3. Qu Review sends this content to independent AI providers -- chosen to be different from the host platform -- for analysis.
4. Qu Review synthesizes the results into a review and returns it through the same chain back to the host platform.

Each host platform's handling of data is governed by its own privacy policy. For example, OpenAI's handling of data within ChatGPT is governed by OpenAI's Privacy Policy.

Other MCP-Compatible Applications

Qu Review is an MCP server and may be used by any application that supports the protocol. The data flow follows the same pattern as above: the host application provides content, Qu Review sends it to independent AI providers for analysis, synthesizes the results, and returns the review to the host application. The host application's handling of your data is governed by its own privacy policy.

5. AI Data Processing

Your conversation content is sent to AI providers solely for the purpose of generating your review. To ensure independence, Qu Review uses AI providers that are different from the platform where the conversation originated. We are committed to the following:

• OpenAI does not use data submitted via its API to train its models (when API data usage is opted out, which is the default for API access).
• Google does not use data submitted via the Gemini API to train its models.
• Anthropic does not use data submitted via the Claude API to train its models.
• Qu Review does not use your conversation content to train any AI models.
• Data is processed transiently by AI providers and is not stored by them beyond the duration of the request.

6. Third-Party Services

We use the following third-party services to operate Qu Review:

• OpenAI -- Host platform (ChatGPT) and/or independent review generation, depending on how you access the service. OpenAI Privacy Policy
• Google Gemini API -- Host platform and/or independent review generation, depending on how you access the service. Google Privacy Policy
• Anthropic Claude API -- Host platform and/or independent review generation, depending on how you access the service. Anthropic Privacy Policy
• Stripe -- Payment processing. We do not store your card details. Stripe Privacy Policy
• Google Cloud / Firebase -- Hosting, authentication, and database. Google Cloud Privacy Notice
• SendGrid (Twilio) -- Transactional emails such as password resets. Twilio Privacy Policy
• Cloudflare -- Bot protection (Turnstile) during signup. Cloudflare Privacy Policy
• Google Analytics 4 -- Cookieless, anonymized website analytics. Google Privacy Policy

7. Data Sharing

We do not sell, rent, or share your personal data for marketing or advertising purposes.

We share data only in the following circumstances:

• Service providers -- With the third-party services listed above, acting as data processors on our behalf, solely to provide the service.
• Legal requirements -- When required by law, regulation, legal process, or governmental request.
• Business transfers -- In connection with a merger, acquisition, reorganization, or sale of assets, in which case your data may be transferred to the successor entity. We will notify you of any such change.

8. Data Retention

• Account and review data -- Retained while your account exists.
• Payment records -- Retained as required by applicable tax and accounting law.
• Analytics data -- Aggregated and anonymized; retained indefinitely.

On account deletion, all personal data is permanently removed from active systems. Data may be retained briefly in encrypted backups, isolated from further processing, until those backups are rotated and deleted.

9. Your Rights

All users have the following rights regarding their personal data:

• Access -- Request a copy of the personal data we hold about you.
• Correction -- Request correction of inaccurate personal data.
• Deletion -- Request deletion of your account and all associated data.
• Data portability -- Request a machine-readable export of your data.

To exercise any of these rights, contact us at support@quplatforms.com. We will respond within 30 days.

10. Rights for EEA/UK Residents (GDPR)

If you are located in the European Economic Area or the United Kingdom, the following additional rights and information apply:

Lawful basis for processing:

• Performance of contract -- Processing your conversation content to generate reviews is necessary to provide the service you have requested.
• Legitimate interest -- Aggregated analytics for service improvement, fraud prevention, and security.

Additional rights:

• Restrict or object to certain processing of your data.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your local data protection supervisory authority.

Your data is processed in the United States. We ensure appropriate safeguards are in place for international transfers.

11. Rights for California Residents (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to know -- You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purposes, and the categories of third parties with whom we share it.
• Right to delete -- You may request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to opt-out of sale -- We do not sell your personal information. We have not sold or shared personal information in the preceding 12 months.
• Right to limit use of sensitive personal information -- You may request that we limit the use of sensitive personal information to what is necessary to provide the service.
• Right to non-discrimination -- We will not discriminate against you for exercising any of your CCPA rights.

Verification: When you submit a request, we will verify your identity by matching information you provide against information we have on file. If we cannot verify your identity, we may ask for additional information. We will respond to verifiable requests within 45 days.

Authorized agents: You may designate an authorized agent to submit requests on your behalf. We may require the agent to provide proof of authorization and may still verify your identity directly.

Opt-out processing: We will process opt-out requests within 15 business days.

"Shine the Light": California Civil Code Section 1798.83 permits California residents to request information regarding the disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

12. Security

• All data is transmitted over HTTPS using TLS encryption.
• Application data is stored in Google Cloud Firestore, protected by Firebase security rules.
• Server secrets and API keys are managed via Google Secret Manager.
• Access to user data is restricted by role-based access controls.

While we implement commercially reasonable security measures to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your information.

13. Cookies and Tracking

Qu Review uses a single session token cookie (accessToken) for authentication purposes. This cookie is required to keep you logged in while using the service. We do not use any tracking cookies or advertising cookies. Google Analytics 4 is configured in cookieless mode and does not set any cookies on your device.

14. Do Not Track

There is currently no uniform standard for interpreting Do Not Track (DNT) browser signals. We do not currently respond to DNT signals. However, as described above, we do not use tracking or advertising cookies.

15. Children's Privacy

Account holders must be 18 years of age or older. Minors between 13 and 17 years of age may use the service only with the permission and supervision of a parent or legal guardian.

Children under the age of 13 may not use Qu Review. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will delete it promptly.

If you believe a child under 13 has provided us with personal information, please contact us at support@quplatforms.com.

16. International Data Transfers

Your data is processed and stored in the United States using Google Cloud infrastructure. By using Qu Review, you consent to the transfer and processing of your data in the United States, which may have different data protection laws than your country of residence.

17. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected on this page with an updated "Last updated" date. For material changes, we may notify you via email or a prominent notice on our website. Continued use of the service after changes constitutes acceptance of the revised policy.

18. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Qu Platforms, Inc.
support@quplatforms.com