Privacy Policy

1. Introduction

Qu Platforms, Inc. ("we", "our", "us") operates Qu Review, an independent AI-powered review service for AI conversations and other material you want independently reviewed. Qu Review is accessible through the web dashboard at app.qureview.ai, within ChatGPT and Claude, and through any MCP-compatible application.

This Privacy Policy explains how we collect, use, share, and protect your information when you use Qu Review. It applies to our websites qureview.ai and app.qureview.ai and any interactions with the Qu Review service regardless of how you access it.

2. Information We Collect

Account Information

Email address and password (hashed) provided during registration.

Submitted Content

The material you send us for review. This is usually an AI conversation question and the response being reviewed, but it may be anything you choose to submit, including source code and diffs, test and build output, documents, and drafts -- whether via the web dashboard, ChatGPT, Claude, another MCP-compatible application, or our API.

Review Results

AI-generated review output produced for your Submitted Content.

Payment and Subscription Data

Payment transactions are processed by Stripe. We store your subscription status and transaction history but do not store your credit card details.

Usage Data

Review counts, timestamps, and subscription status associated with your account.

Technical Data

Collected via Google Analytics 4 in cookieless mode: anonymized IP address, browser type, and pages visited. No personally identifiable information is collected through analytics.

3. How We Use Your Data

• Review generation -- Submitted Content is sent to independent AI providers for analysis. The specific providers used depend on the platform through which you access Qu Review (see Section 4).
• Account management and authentication -- To create and maintain your account, verify your identity, and provide access to your review history.
• Payment processing and subscription management -- To process payments through Stripe and manage your subscription status.
• Transactional emails -- To send essential communications such as password resets via SendGrid.
• Bot protection -- Cloudflare Turnstile is used during signup to prevent automated abuse.
• Service improvement -- Aggregated, anonymized metrics help us improve the quality and reliability of the service.
• Quality assurance and correct operation -- Authorized personnel may access individual Submitted Content and Review Results where it is necessary to diagnose a fault, confirm the service is operating correctly, or investigate abuse or a breach of our Terms. Access is limited to the people who need it for that purpose, and we do not publish content that identifies you or your material.
• Understanding how the service is used -- Authorized personnel may read Submitted Content and Review Results in order to understand what people use Qu Review for, which parts of it work well, and what we should build next. Access is limited to the people who need it for that purpose. What we keep from this work are findings about how the service is used overall, recorded in aggregate; we do not publish content or findings that identify you or your material. We do not use Submitted Content to train or fine-tune any AI model, for this or any other purpose.
• Testing changes to how reviews are produced -- Before we change our review prompts, our synthesis logic, or which AI models we use, we re-run stored Submitted Content through the proposed change and compare the results, so that a change cannot make reviews worse without us noticing. The reviews produced this way are internal: they are never delivered to you or anyone else, never shown to other users, never added to your review history, and reported only in aggregate. This processing uses the same AI providers under the same no-training terms described in Section 5. It reads Submitted Content from your account rather than from a separate copy, so a deleted account is excluded from future tests. We do not use Submitted Content to train or fine-tune any AI model, for this or any other purpose.

4. How Your Data Flows

Qu Review can be accessed in multiple ways. Here is how your data flows in each case:

Web Interface (app.qureview.ai)

1. You submit content directly through the Qu Review dashboard.
2. Qu Review sends it to independent AI providers for analysis.
3. Qu Review synthesizes the results into a review, which is returned and stored in your account.

AI Chat Platforms (e.g. ChatGPT, via MCP)

1. You engage with the host AI and elicit its responses.
2. When you request a review, the host platform provides a high-fidelity representation of the conversation to Qu Review's server via MCP (Model Context Protocol). The content transmitted may be summarized or adapted by the host platform rather than passed verbatim.
3. Qu Review sends this content to independent AI providers -- chosen to be different from the host platform -- for analysis.
4. Qu Review synthesizes the results into a review and returns it through the same chain back to the host platform.

Each host platform's handling of data is governed by its own privacy policy. For example, OpenAI's handling of data within ChatGPT is governed by OpenAI's Privacy Policy.

Other MCP-Compatible Applications

Qu Review is an MCP server and may be used by any application that supports the protocol. The data flow follows the same pattern as above: the host application provides content, Qu Review sends it to independent AI providers for analysis, synthesizes the results, and returns the review to the host application. The host application's handling of your data is governed by its own privacy policy.

5. AI Data Processing

Your Submitted Content is sent to AI providers to generate your review, and, as described in Section 3, to test a change to how reviews are produced before that change takes effect. It is not sent to them for any other purpose. To ensure independence, Qu Review uses AI providers that are different from the platform where the content originated. We are committed to the following:

• OpenAI does not use data submitted via its API to train its models (when API data usage is opted out, which is the default for API access).
• Google does not use data submitted via the Gemini API to train its models.
• Anthropic does not use data submitted via the Claude API to train its models.
• Qu Review does not use your Submitted Content to train any AI models.
• Data is processed transiently by AI providers and is not stored by them beyond the duration of the request.

6. Third-Party Services

We use the following third-party services to operate Qu Review:

• OpenAI -- Host platform (ChatGPT) and/or independent review generation, depending on how you access the service. OpenAI Privacy Policy
• Google Gemini API -- Host platform and/or independent review generation, depending on how you access the service. Google Privacy Policy
• Anthropic Claude API -- Host platform and/or independent review generation, depending on how you access the service. Anthropic Privacy Policy
• Stripe -- Payment processing. We do not store your card details. Stripe Privacy Policy
• Google Cloud / Firebase -- Hosting, authentication, and database. Google Cloud Privacy Notice
• SendGrid (Twilio) -- Transactional emails such as password resets. Twilio Privacy Policy
• Cloudflare -- Bot protection (Turnstile) during signup. Cloudflare Privacy Policy
• Google Analytics 4 -- Cookieless, anonymized website analytics. Google Privacy Policy
• Reddit Pixel -- Advertising measurement and audience building on marketing pages reached from our Reddit ads (currently the parents and gate landing pages only). Collects page-visit events and device information; may set cookies or use similar identifiers. Never present in the Qu Review application itself. Reddit Privacy Policy

7. Data Sharing

We do not sell, rent, or share your personal data for marketing or advertising purposes.

We share data only in the following circumstances:

• Service providers -- With the third-party services listed above, acting as data processors on our behalf, solely to provide the service.
• Legal requirements -- When required by law, regulation, legal process, or governmental request.
• Business transfers -- In connection with a merger, acquisition, reorganization, or sale of assets, in which case your data may be transferred to the successor entity. We will notify you of any such change.

8. Data Retention

• Account and review data -- Retained while your account exists.
• Payment records -- Retained as required by applicable tax and accounting law.
• Analytics data -- Aggregated and anonymized; retained indefinitely.
• Aggregated and de-identified data -- Findings, statistics, and comparison results that have been aggregated or de-identified, so that they no longer identify you or your account, are retained indefinitely and are not removed when you delete your account. Once data has reached that state it can no longer be linked back to you, and we do not attempt to do so.
• Pipeline test data -- Testing a change to how reviews are produced (Section 3) reads Submitted Content from your account rather than from a separate copy, so it is covered by the retention and deletion terms above and deleting your account removes it from future tests. The comparison results we keep are aggregate.

On account deletion, all personal data is permanently removed from active systems, other than data that has already been aggregated or de-identified as described above. Data may be retained briefly in encrypted backups, isolated from further processing, until those backups are rotated and deleted.

9. Your Rights

All users have the following rights regarding their personal data:

• Access -- Request a copy of the personal data we hold about you.
• Correction -- Request correction of inaccurate personal data.
• Deletion -- Request deletion of your account and all associated data.
• Data portability -- Request a machine-readable export of your data.
• Object -- Ask us to stop processing your data where we rely on legitimate interests. If you object, we will exclude your account from reading for quality assurance, from our work to understand how the service is used, and from tests of changes to how reviews are produced. We may continue processing that is necessary to investigate abuse or a breach of our Terms, to keep the service secure, and to meet our legal obligations.

To exercise any of these rights, contact us at support@quplatforms.com. We will respond within 30 days.

10. Rights for EEA/UK Residents (GDPR)

If you are located in the European Economic Area or the United Kingdom, the following additional rights and information apply:

Lawful basis for processing:

• Performance of contract -- Processing your Submitted Content to generate reviews is necessary to provide the service you have requested.
• Legitimate interest -- Aggregated analytics for service improvement, fraud prevention, and security; quality assurance and confirming the service is operating correctly; understanding how the service is used so that we can improve and develop it; and testing a change to how reviews are produced before it takes effect, so that a change cannot degrade the quality of the reviews you receive. We have assessed these interests against your rights and freedoms; you may object to processing on this basis, as described below.

Additional rights:

• Restrict or object to certain processing of your data.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your local data protection supervisory authority.

Your data is processed in the United States. We ensure appropriate safeguards are in place for international transfers.

11. Rights for California Residents (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to know -- You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purposes, and the categories of third parties with whom we share it.
• Right to delete -- You may request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to opt-out of sale -- We do not sell your personal information. We have not sold or shared personal information in the preceding 12 months.
• Right to limit use of sensitive personal information -- You may request that we limit the use of sensitive personal information to what is necessary to provide the service.
• Right to non-discrimination -- We will not discriminate against you for exercising any of your CCPA rights.

Verification: When you submit a request, we will verify your identity by matching information you provide against information we have on file. If we cannot verify your identity, we may ask for additional information. We will respond to verifiable requests within 45 days.

Authorized agents: You may designate an authorized agent to submit requests on your behalf. We may require the agent to provide proof of authorization and may still verify your identity directly.

Opt-out processing: We will process opt-out requests within 15 business days.

"Shine the Light": California Civil Code Section 1798.83 permits California residents to request information regarding the disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

12. Security

• All data is transmitted over HTTPS using TLS encryption.
• Application data is stored in Google Cloud Firestore, protected by Firebase security rules.
• Server secrets and API keys are managed via Google Secret Manager.
• Access to user data is restricted by role-based access controls.

While we implement commercially reasonable security measures to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your information.

13. Cookies and Tracking

Qu Review uses a single session token cookie (accessToken) for authentication purposes. This cookie is required to keep you logged in while using the service. Google Analytics 4 is configured in cookieless mode and does not set any cookies on your device.

On marketing pages reached from our advertising (currently the landing pages at qureview.ai/parents and qureview.ai/gate), we use the Reddit Pixel, an advertising measurement tool that may set cookies or use similar identifiers to measure ad performance and build advertising audiences. The Reddit Pixel is not present in the Qu Review application itself, and is never present on any page a student uses. Outside of that advertising pixel, we do not use tracking cookies or advertising cookies.

14. Do Not Track

There is currently no uniform standard for interpreting Do Not Track (DNT) browser signals. We do not currently respond to DNT signals. However, as described above, we do not use tracking or advertising cookies outside of the advertising pixel on our marketing pages described in Section 13.

15. Children's Privacy

You must be at least 13 years old to use Qu Review. Users between 13 and 17 years of age may use the service only with the permission and supervision of a parent or legal guardian who accepts our Terms of Service on their behalf. Purchases and billing must be handled by an adult 18 years of age or older.

Children under the age of 13 may not use Qu Review. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will delete it promptly.

If you believe a child under 13 has provided us with personal information, please contact us at support@quplatforms.com.

16. International Data Transfers

Your data is processed and stored in the United States using Google Cloud infrastructure. By using Qu Review, you consent to the transfer and processing of your data in the United States, which may have different data protection laws than your country of residence.

17. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected on this page with an updated "Last updated" date. For material changes, we may notify you via email or a prominent notice on our website. Continued use of the service after changes constitutes acceptance of the revised policy.

18. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Qu Platforms, Inc.
support@quplatforms.com