QQMBER — PRIVACY POLICY

1. Introduction

Welcome to QQmber.

This Privacy Policy (“Policy”) explains how QQmber collects, uses, stores, processes, shares, protects, and otherwise handles personal data when individuals access or use our website, applications, artificial intelligence features, collaborative editing tools, document management functionality, and related services (collectively, the “Services”).

QQmber is operated by:

YURA IT TECHNOLOGIES S.R.L.

• Trading name: QQMBER
• Company registration number: J40/14152/2022
• Romanian tax identification number (CUI): 46523075
• Registered office: Strada Ion Câmpineanu No. 11, Floor 4, Room 432, Module B, Space 4.03B, Sector 1, Bucharest, 010031, Romania
• Website: qqmber.app
• Contact email: [email protected]

For the purposes of the European Union General Data Protection Regulation (“GDPR”), QQmber generally acts as the data controller in relation to personal data processed through its consumer Services.

Where applicable, this Policy also addresses requirements under the United Kingdom General Data Protection Regulation (“UK GDPR”) and other relevant privacy laws.

This Policy should be read together with our Terms of Service.

By using QQmber, you acknowledge that you have been provided with this Privacy Policy. Such acknowledgment does not constitute consent to processing activities for which separate consent is required.

2. Scope of This Privacy Policy

This Policy applies to personal data relating to:

1. Registered QQmber users.
2. Individuals accessing QQmber through Guest Mode.
3. Visitors to our website.
4. Individuals using collaborative editing and sharing features.
5. Individuals communicating with QQmber support.
6. Individuals purchasing subscriptions or additional credits.
7. Individuals whose personal data is included in notes, documents, images, or other materials uploaded by users.

This Policy covers personal data processed through QQmber’s website, applications, servers, storage systems, AI services, and associated infrastructure.

It does not automatically govern independent services operated by third parties under their own privacy policies.

Where QQmber provides services to organizations under separate agreements, additional data protection terms may apply.

3. Categories of Personal Data We Collect

Depending on how you interact with QQmber, we may collect and process the following categories of information.

3.1 Account Information

When you register, we may collect:

• Email address.
• Display name.
• Account identifier.
• Authentication information.
• Account creation date.
• Subscription status.
• Account preferences.
• Security and authentication records.
• Email-verification status.
• Profile information.
• Password hashes or OAuth credentials and tokens, as applicable.
• Authentication sessions.
• Stripe customer identifiers.

Passwords, where used, are stored as password hashes rather than plaintext. Depending on the authentication method, QQmber may also process OAuth credentials or tokens, email-verification status and hashed verification codes, profile information, authentication sessions, and Stripe customer identifiers.

3.2 User Content

QQmber processes content created, uploaded, stored, edited, imported, shared, or otherwise provided through the Services.

This may include:

• Notes and written text.
• Mathematical formulas and equations.
• Tables and diagrams.
• Drawings and handwritten content.
• Images and illustrations.
• PDF documents.
• DOCX documents.
• Other supported attachments.
• Embedded media.
• Document metadata.
• Revision history.
• Collaborative editing information.
• Content imported from external sources.
• Conflict-free replicated data type (CRDT) editing state.
• AI conversations and agent messages.
• Agent memory.
• Relevant AI tool outputs.

User Content may contain personal data about you or other individuals.

QQmber does not require users to include sensitive personal information in their notes.

3.3 AI Interaction Data

When you use AI-powered features, we may process:

• Prompts and instructions.
• AI-generated responses.
• Relevant note content.
• Attached images and documents.
• Selected document context.
• Tool calls and execution results.
• Model identifiers.
• Usage information.
• Error and diagnostic information.
• Feedback submitted about AI responses.

The amount of note content processed depends on the requested AI functionality.

3.4 Subscription and Payment Information

When you purchase a subscription or credits, we may process:

• Subscription plan.
• Billing interval.
• Subscription status.
• Transaction identifiers.
• Payment status.
• Invoice information.
• Billing country.
• Applicable tax information.
• Purchased credit balances.
• AI usage and credit consumption records.

Payment-card information is processed through our payment service providers.

QQmber does not intend to store complete payment-card numbers or card security codes on its own application servers.

3.5 Technical and Usage Information

We may process technical information necessary to operate, secure, and maintain the Services, including:

• IP address.
• Browser type.
• Device information.
• Operating system.
• Session identifiers.
• Authentication cookies.
• Access timestamps.
• Error logs.
• Security events.
• Feature usage information.
• Network and performance diagnostics.

The specific technical data collected depends on the systems and tools actually deployed.

3.6 Cookies, Local Storage, and Similar Technologies

QQmber uses authentication cookies and Guest or session identifiers where necessary to provide account access, maintain sessions, secure the Services, and support Guest Mode. QQmber also uses browser local storage for interface settings, certain note-related interface state, and locally retained proofreading-dismissal information.

Signing out does not necessarily remove every item stored locally in the browser. Users may manage browser storage through their browser or device controls, although removing strictly necessary information may affect functionality.

QQmber does not currently use advertising or analytics tracking scripts.

If QQmber introduces non-essential cookies, analytics, advertising technologies, or similar processing, this Policy and any consent mechanism required by law will be updated.

3.7 Support Communications

If you contact us, we may process your email address, the contents of your message, attachments you provide, and information necessary to investigate and respond to your request.

4. Sources of Personal Data

We obtain personal data from several sources.

Directly from you: information you provide during registration, through notes, AI interactions, payment flows, settings, or support requests.

Automatically through the Services: session information, technical logs, security records, and usage events.

From other users: information contained in shared notes, collaborative documents, or invitations.

From service providers: information required to process authentication, subscriptions, payments, and other requested functions.

We do not assume that a user uploading personal data about another individual has obtained every permission required for every possible processing purpose.

5. Purposes of Processing

QQmber processes personal data for the following purposes:

1. Providing and maintaining user accounts.
2. Creating, storing, editing, and retrieving notes.
3. Supporting document imports and exports.
4. Providing real-time collaboration.
5. Processing AI requests.
6. Managing subscriptions and credits.
7. Processing payments and invoices.
8. Maintaining security and preventing abuse.
9. Diagnosing technical problems.
10. Responding to support requests.
11. Complying with legal obligations.
12. Developing and improving the Services.
13. Training proprietary AI models where an appropriate legal basis exists.

Providing AI functionality and using content to train QQmber’s proprietary models are separate processing purposes.

Using an AI feature does not automatically mean that you have agreed to the use of your content for optional model training.

6. Legal Bases for Processing

Where GDPR or UK GDPR applies, QQmber processes personal data only where an appropriate legal basis exists.

6.1 Performance of a Contract

Under Article 6(1)(b) GDPR, processing may be necessary to provide requested Services.

Examples include:

• Maintaining your account.
• Saving and retrieving notes.
• Providing collaborative editing.
• Processing requested AI operations.
• Managing purchased subscriptions.

6.2 Legal Obligations

Under Article 6(1)(c), processing may be necessary to comply with legal obligations, including accounting, taxation, and applicable regulatory requirements.

6.3 Legitimate Interests

Under Article 6(1)(f), QQmber may process certain personal data for legitimate interests, subject to an appropriate assessment.

These interests may include:

• Protecting account security.
• Preventing fraud.
• Investigating abuse.
• Maintaining service reliability.
• Diagnosing operational failures.
• Protecting infrastructure.

Such processing must be necessary and proportionate, and must not override applicable rights and freedoms.

6.4 Consent

Under Article 6(1)(a), QQmber may rely on consent for specific optional processing activities.

This may include optional consent recorded for potential future use of eligible User Content to train and improve proprietary AI models. QQmber does not currently conduct such training or maintain separate proprietary AI-training datasets.

Consent must be freely given, specific, informed, and unambiguous.

Users may withdraw consent as described in this Policy.

6.5 Special Categories of Personal Data

Notes may contain information concerning health, religion, political opinions, biometric information, or other special categories of personal data.

Processing such information requires compliance with Article 9 GDPR where applicable.

Ordinary consent to AI training does not automatically satisfy every requirement for processing special-category data, particularly information concerning third parties.

QQmber must apply appropriate safeguards and establish any additional legal conditions before including such information in training activities.

7. Ownership and Processing of User Content

Users retain the rights they hold in their original notes, documents, images, drawings, and other User Content.

QQmber does not claim ownership of users’ original content merely because it is stored through the Services.

To operate QQmber, we process User Content as reasonably necessary to:

• Store and retrieve notes.
• Synchronize edits.
• Render documents.
• Maintain revision history.
• Provide sharing functionality.
• Process requested AI operations.
• Perform authorized imports and exports.
• Maintain security and service reliability.

The operational licence described in our Terms of Service does not independently authorize optional training of proprietary AI models on personal data.

Such training is governed by the separate provisions below.

8. Artificial Intelligence Features

QQmber provides AI-powered functionality that may process user instructions, notes, images, documents, and other relevant content.

When you request an AI operation, the Services may process the information necessary to generate the requested result.

Depending on the feature, this may involve:

• Understanding a prompt.
• Reading relevant note content.
• Processing images.
• Interpreting documents.
• Generating text or code.
• Producing mathematical explanations.
• Performing tool operations.
• Returning generated content to the user.

Some AI operations may be performed using third-party AI providers.

Certain QQmber features rely on third-party AI service providers to process prompts, relevant note content, documents, images, and other information necessary to deliver the requested functionality. Such processing is an integral part of those features and is described in our Privacy Policy.

8.1 Automatic Proofreading

When automatic proofreading is enabled, portions of note text may be transmitted to an external AI provider to generate proofreading suggestions. The proofreading setting in the editor explains that AI proofreading may send text to external AI providers, and the feature can be disabled by the user. Proofreading is not represented as entirely local processing.

The external processing used to provide proofreading is distinct from optional future training of QQmber’s proprietary models.

The processing of content to fulfil a user’s AI request is distinct from the optional use of that content to train QQmber’s proprietary models.

9. Optional AI Model Training and Development

QQmber does not currently train proprietary artificial intelligence models using User Content, and no separate proprietary AI-training datasets currently exist. QQmber records optional AI Training Consent for potential future processing, but recording consent does not mean that training has started.

Participation in QQmber AI Training is voluntary.

If QQmber proposes to begin proprietary model training in the future, eligible User Content may be processed only within the scope of a separate, valid AI Training Consent and after QQmber has verified the applicable legal basis, actual data categories, safeguards, retention rules, treatment of third-party personal data, and any requirements applying to special-category data. Where legally required, QQmber will obtain new consent before materially different future processing begins.

9.1 Categories of Content

Subject to applicable law and the scope of your consent, eligible content may include:

• Private notes.
• Written text.
• Mathematical formulas.
• Tables and diagrams.
• Images.
• Drawings.
• Handwritten content.
• PDF and DOCX documents.
• Attachments.
• Revision history.
• AI prompts and responses where covered by the consent.
• Content that has not been directly submitted to the AI Agent.

This means that, if you opt in, eligible content from private notes may be used for AI training even if you have never asked the AI Agent to read those notes.

9.2 Training Activities

Permitted training-related activities may include:

• Preparing training datasets.
• Cleaning and formatting eligible data.
• Data annotation.
• Generating synthetic examples.
• Supervised fine-tuning.
• Model evaluation.
• Quality testing.
• Improving model capabilities.
• Testing new model architectures.
• Evaluating mathematical, scientific, and language performance.

9.3 Training Infrastructure

No proprietary AI-training infrastructure currently processes User Content and no separate proprietary AI-training datasets currently exist. Before any future training begins, QQmber must document the infrastructure, access controls, data locations, retention arrangements, and any international transfers involved.

Consent to QQmber AI Training does not authorize third-party AI providers to use your content to train their own models.

Third-party providers may nevertheless process information necessary to deliver requested AI functionality, as separately explained in this Policy.

9.4 Consent Requirements

Consent to AI Training must be:

• Separate from acceptance of the Terms of Service.
• Optional.
• Unchecked by default.
• Clearly explained.
• Recorded by QQmber.
• Withdrawable.

Refusing AI Training Consent does not prevent access to ordinary QQmber functionality.

9.5 Consent Records

QQmber records AI Training Consent decisions server-side, including the applicable consent version, timestamps, and withdrawal status. These records document the user’s choice but do not mean that proprietary model training has begun.

Training systems must verify the applicable permission before using content for consent-based training.

9.6 Guest Content

Guest Mode does not automatically provide consent to AI Training.

Guest content must not be used for optional consent-based AI Training solely because a person accessed QQmber without registering.

9.7 Third-Party and Sensitive Information

A user’s consent does not automatically authorize every possible use of personal data belonging to other individuals.

QQmber must assess whether third-party personal data and special-category information can lawfully be included in training datasets.

Where appropriate, such information must be excluded, filtered, anonymized, or processed only under additional lawful conditions.

10. Withdrawal of AI Training Consent

You may withdraw your optional AI Training Consent at any time.

Withdrawal requests may be submitted by contacting:

[email protected]

You may grant or withdraw AI Training Consent through Settings → Privacy or contact QQmber at the email address above.

Withdrawal does not affect the lawfulness of processing completed before withdrawal.

After withdrawal, QQmber will stop further processing that relies on the withdrawn consent.

Where required by applicable law, identifiable personal data must be excluded from future training activities and removed from relevant active training datasets.

QQmber has not currently trained proprietary models using User Content. If such models are created in the future, withdrawal will not automatically make processing lawfully completed before withdrawal unlawful, but QQmber will assess the model and related data in accordance with the law then applicable.

Before future training begins, QQmber must establish procedures for consent withdrawal, erasure, restriction, and other valid data-protection requests involving source content, datasets, derived data, and any resulting model.

We will not treat the withdrawal of consent as permission to continue the same processing under a different legal basis without a lawful and properly disclosed justification.

11. Data Retention and Future AI Training

QQmber applies different retention rules to different data categories. The rules below describe current retention practices. Specific production-backup retention periods are not stated in this Policy.

11.1 Source Content

Notes remain available until deleted by the user or the account is deleted, subject to applicable legal exceptions. Deleting a note moves it to Trash. Trash content is retained until the user permanently deletes it or deletes the account. AI conversations are retained until deleted by the user or until account deletion, subject to applicable legal exceptions. Users can delete individual agent memories, and account deletion removes associated memory records.

11.2 Training Datasets

QQmber does not currently maintain separate proprietary AI-training datasets. Before creating any such dataset, QQmber must establish and document the applicable data categories, legal basis, retention period or criteria, deletion procedures, safeguards, and handling of consent withdrawal and data-subject requests.

No retention period for proprietary AI-training datasets applies at present because no such datasets currently exist.

QQmber may not retain identifiable personal data indefinitely merely because it was previously collected with consent.

11.3 Anonymized Data

Data that has been genuinely and irreversibly anonymized so that individuals are no longer identifiable may fall outside the scope of GDPR.

Such data may be retained and used for model development where lawful.

Removing names, email addresses, or account identifiers does not necessarily make information anonymous.

11.4 Future Trained Models

QQmber has not currently trained proprietary AI models using User Content. If such training begins in the future, QQmber must assess whether trained models contain, reproduce, or otherwise process personal data and must apply the legal requirements and safeguards relevant at that time.

Withdrawal of consent would not make processing lawfully completed before withdrawal unlawful, but it would stop further processing based on that consent and require QQmber to assess retained personal data in source content, active datasets, derived data, and any resulting model.

However, the legal treatment of a trained model depends on whether it contains or can reveal personal data and on the applicable rights and obligations.

QQmber may need to implement appropriate technical or organizational measures in response to valid data protection requests.

Because no proprietary models have currently been trained using User Content, QQmber does not presently rely on any claim that source deletion leaves residual influence in a proprietary trained model. Any future policy on this issue must reflect the actual technology and applicable law before training begins.

We also do not claim an unconditional right to retain personal data in trained models contrary to applicable law.

11.5 Technical, Security, and Abuse-Prevention Records

Where recorded, successful server request trace records are retained for up to seven days and error records for up to 30 days. Guest-creation IP counters used for abuse prevention are retained for 48 hours.

11.6 Billing Records and Account Deletion

QQmber retains billing and transaction information for as long as necessary to meet applicable tax, accounting, payment, fraud-prevention, dispute-resolution, and legal requirements. Account deletion cancels billable Stripe subscriptions before irreversible local account deletion. Stripe may retain billing and transaction records where required by law or its applicable obligations.

Account deletion revokes authentication sessions stored in Redis. A short-lived cached session may remain valid briefly, so QQmber does not represent that every cached session is invalidated instantaneously.

11.7 Backups

Specific production-backup retention periods are not stated in this Policy. Where backup copies are maintained, they remain subject to applicable security, retention, erasure, and restoration obligations.

12. Third-Party Service Providers and Data Processing

QQmber uses third-party service providers to operate, maintain, secure, and deliver certain features of the Services.

Depending on the functionality used, these providers may fall into the following categories:

(a) AI inference and model-processing providers, which process prompts, conversation context, relevant note content, images, documents, and other information necessary to generate AI-assisted responses.

(b) Document-processing and recognition providers, which may process uploaded documents, PDF files, images, handwriting, mathematical expressions, or other supported content to provide OCR, handwriting recognition, document conversion, and related functionality.

(c) Cloud infrastructure, hosting, storage, network-delivery, and security providers, which support the operation, availability, storage, and protection of the Services.

(d) Authentication and identity providers, which process information necessary for account registration, authentication, identity verification, and account security.

(e) Payment and billing service providers, which process payment information, subscription details, transaction records, and information necessary to administer purchases and billing.

(f) Transactional email and communication providers, which process contact information and relevant message content to deliver verification codes, password-reset messages, service communications, and support responses.

(g) Web-search and information-retrieval providers, which may process search queries, URLs, and relevant contextual information necessary to perform user-requested searches or retrieve external information.

Only the information reasonably necessary for the relevant functionality should be transmitted to the applicable provider.

Some AI features may involve multiple providers, including intermediaries that route requests to underlying AI model operators.

Depending on the feature, relevant User Content may be transmitted to those providers.

The specific providers and underlying models may change as QQmber develops its Services.

Processing by external AI providers to deliver QQmber functionality is separate from any potential future training of QQmber’s proprietary AI models.

QQmber does not currently use User Content to train proprietary AI models.

The optional AI Training Consent does not constitute permission for independent third-party providers to train their own models using User Content.

Provider-specific retention periods, processing locations, data-use policies, and contractual arrangements may differ.

QQmber does not represent that all providers operate exclusively within the European Economic Area, apply zero retention, or prohibit all independent model training unless those restrictions are established for the relevant processing arrangement.

Where required by applicable law, QQmber implements appropriate contractual, technical, and organizational safeguards and lawful international-transfer mechanisms.

Users may request information about recipients of their personal data and applicable safeguards by contacting [email protected].

13. Sharing and Collaborative Editing

QQmber allows users to share notes and collaborate on documents.

Depending on the sharing settings selected by a user, other individuals may be able to:

• View shared notes.
• Edit shared content.
• Access images and attachments.
• Observe collaborative changes.
• Receive or use sharing links.

Collaboration may involve processing participant identifiers, document changes, access permissions, and technical synchronization information.

Users should review sharing permissions before distributing links.

Individuals who obtain access to shared content may be able to copy or retain information outside QQmber.

Disabling a sharing link does not necessarily delete copies previously obtained by recipients.

Publicly accessible notes may be discoverable by others depending on the sharing configuration and technical implementation.

14. Guest Mode and Temporary Accounts

QQmber allows limited use without permanent registration.

Guest Mode creates a temporary account identity and associated session.

Guest Mode currently provides:

• Up to three notes.
• One workspace.
• Up to 15 MiB of storage.
• A seven-day account lifetime.

Guest content is stored through QQmber’s infrastructure rather than being guaranteed to remain exclusively on the user’s device.

Unless a Guest account is successfully converted into a registered account before expiry, the Guest account and associated content are scheduled for deletion after the seven-day lifetime. Cleanup runs hourly, but processing and deletion retries mean deletion is not promised at the exact seven-day boundary.

This may include:

• Notes.
• Documents.
• Images.
• Drawings.
• Attachments.
• Associated editing data.

Cleanup may require deletion retries. Registered accounts are protected from Guest cleanup, and successful registration before expiry preserves the associated notes and other Guest content.

Certain security or legally required records may be retained separately for limited periods.

Successful conversion to a registered account is intended to preserve the associated User Content.

Guest Mode does not constitute consent to optional AI Training.

Guest users must have access to the Terms of Service and this Privacy Policy before beginning use.

15. Subscriptions, Payments, and Credits

QQmber offers Free and paid subscription plans.

Paid plans may include Plus, Pro, and Max subscriptions billed monthly or annually.

Payments are processed using third-party payment infrastructure, including Stripe. QQmber does not store complete payment-card numbers or card security codes. QQmber may store Stripe customer and subscription identifiers, the selected plan and billing interval, payment status, card brand and last four digits, and credit usage or ledger records.

QQmber may receive and process:

• Subscription identifiers.
• Customer identifiers.
• Billing interval.
• Subscription status.
• Payment confirmation.
• Invoice information.
• Tax-related information.
• Credit balances.
• Usage records.

QQmber uses credits to measure certain AI operations.

Included credits are associated with subscription entitlement periods.

For annual subscriptions, payment occurs annually while included-credit allowances refresh monthly.

Unused included credits do not accumulate across entitlement periods.

Purchased top-up credits are maintained separately and do not expire merely because a monthly entitlement period ends.

Usage and transaction records may be retained where necessary for billing, dispute resolution, fraud prevention, accounting, and compliance.

16. International Data Transfers

QQmber is operated by YURA IT TECHNOLOGIES S.R.L., a company established in Romania, within the European Union.

Our Services are available internationally. Infrastructure may be located in Germany or other countries, and third-party AI or service providers may process personal data outside Romania or the European Economic Area. International processing depends on the feature, provider, infrastructure, and configuration involved.

16.1. Transfers Outside the European Economic Area

Where personal data originating in the European Economic Area (“EEA”) is transferred to a country outside the EEA, QQmber must ensure that an appropriate legal transfer mechanism and any required supplementary safeguards apply before authorizing the transfer. This Policy describes the mechanisms that may be used and does not claim that a particular mechanism has been executed for every provider unless independently verified.

Depending on the circumstances, these mechanisms may include:

1. An adequacy decision adopted by the European Commission under Article 45 GDPR.
2. Standard Contractual Clauses approved by the European Commission under Article 46 GDPR.
3. Additional contractual, organizational, or technical safeguards where required.
4. Another lawful transfer mechanism permitted under Chapter V GDPR.

Where required, QQmber will assess whether the laws and practices of the destination country affect the effectiveness of the applicable safeguards.

16.2. Transfers Involving the United Kingdom

Where UK GDPR applies, transfers of personal data outside the United Kingdom will be conducted using appropriate transfer mechanisms.

These may include:

• UK adequacy regulations.
• The UK International Data Transfer Agreement.
• The UK Addendum to the EU Standard Contractual Clauses.
• Other mechanisms permitted under applicable UK data protection law.

16.3. Third-Party Infrastructure Providers

QQmber may engage third-party service providers for:

• Cloud infrastructure and hosting.
• Database and object storage.
• Authentication and account security.
• Payment processing.
• Email delivery.
• AI inference and related processing.
• Monitoring, diagnostics, and technical support.

Some providers may operate infrastructure outside Romania or the EEA.

QQmber will assess applicable international transfer requirements before authorizing such processing.

The identities, locations, and roles of relevant providers must be documented in QQmber’s internal data-processing records.

16.4. AI Model Training Infrastructure

QQmber does not currently use User Content to train proprietary artificial intelligence models. If future training begins after the required legal and operational checks, only eligible User Content covered by valid, voluntary consent and any additional applicable legal conditions may be used.

No current proprietary training infrastructure processes User Content. Any future infrastructure and supporting services must be documented, secured, and assessed for applicable international-transfer requirements before processing begins.

QQmber does not use the optional AI Training Consent as authorization for independent third-party AI providers to train their own models on User Content.

This distinction does not prevent QQmber from using third-party AI providers to process requests necessary to deliver requested AI features, as described elsewhere in this Privacy Policy.

Where QQmber-controlled training infrastructure or its supporting services involve international transfers of personal data, the applicable transfer requirements will continue to apply.

16.5. Information About Transfers

Users may request additional information about applicable international transfer safeguards by contacting:

[email protected]

QQmber will provide information required by applicable data protection law.

17. Data Security

QQmber recognizes that User Content may include private notes, academic materials, personal information, confidential documents, and other sensitive information.

QQmber uses technical and organizational measures intended to protect personal data and remains responsible for implementing security appropriate to the risks as required by applicable data-protection law.

17.1. Technical Security Measures

Confirmed measures include authentication, authorization controls, password hashing, encrypted OAuth tokens, hashed email-verification codes, session management, server-side access restrictions, and encryption at rest for most stored User Content using AES-256-GCM. This does not mean that every temporary file, cache, attachment-processing step, or system is encrypted in the same manner.

QQmber does not represent that every file, temporary processing step, cache, or system is encrypted in the same manner; that all staff access is logged; that a specific production-backup schedule applies; or that QQmber holds a security certification not expressly identified in this Policy. No online service can guarantee absolute security.

17.2. Access to User Content

Access to User Content by QQmber personnel or authorized service providers must be limited to circumstances reasonably necessary for legitimate operational, security, support, legal, or user-authorized purposes.

Such purposes may include:

1. Providing requested support.
2. Investigating security incidents.
3. Diagnosing technical failures.
4. Preventing fraud or abuse.
5. Complying with legal obligations.

Access permissions should be limited according to operational responsibilities.

Where appropriate, access to sensitive information should be logged and reviewed.

17.3. AI Training Data Security

Where User Content is lawfully included in proprietary AI training datasets, QQmber will apply appropriate safeguards to reduce the risks of unauthorized access, disclosure, alteration, or misuse.

These safeguards may include:

• Restricted access to training datasets.
• Separation of training environments from production systems.
• Dataset provenance records.
• Controls governing training-data ingestion.
• Verification of applicable AI Training Consent.
• Measures to identify or filter sensitive information.
• Secure storage and transmission.
• Procedures for handling withdrawal and erasure requests.

The precise safeguards will depend on the nature of the data and the risks associated with the relevant processing.

17.4. Security Incidents

If QQmber becomes aware of a personal data breach, it will assess the incident in accordance with applicable law.

Where required by GDPR, QQmber will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a breach that requires notification.

Where a breach is likely to result in a high risk to individuals’ rights and freedoms, affected individuals will be informed when legally required.

17.5. Limitations

No online service can guarantee absolute security.

QQmber cannot guarantee that unauthorized access, software vulnerabilities, infrastructure failures, or other security incidents will never occur.

However, this statement does not limit QQmber’s statutory obligations to implement appropriate security measures or its liability under applicable law.

18. Your Privacy Rights

Depending on your location and the applicable law, you may have rights concerning the personal data QQmber processes about you.

For individuals covered by GDPR or UK GDPR, these rights may include the following.

18.1. Right of Access

You may request confirmation of whether QQmber processes your personal data.

Where applicable, you may also request access to that data and information about:

• The purposes of processing.
• Categories of personal data.
• Recipients or categories of recipients.
• Applicable retention periods.
• Available privacy rights.
• International transfers.
• Relevant automated decision-making.

18.2. Right to Rectification

You may request correction of inaccurate personal data.

You may also request completion of incomplete personal data where appropriate.

18.3. Right to Erasure

You may request deletion of personal data in circumstances provided by applicable law.

This right is not absolute.

QQmber may retain certain information where an applicable legal obligation or other lawful exception permits or requires retention.

When an account is deleted, QQmber cancels billable Stripe subscriptions before irreversible local account deletion. Local User Content, associated agent-memory records, and authentication sessions are then removed through the account-deletion process, subject to short-lived session caching and applicable legal exceptions. Stripe and QQmber may retain billing or transaction records where required by tax, accounting, payment, fraud-prevention, dispute-resolution, or other applicable laws. Account deletion therefore does not necessarily result in immediate destruction of every legally retained financial record.

Where personal data has been used for AI training, QQmber will assess applicable erasure obligations concerning:

1. Original User Content.
2. Identifiable copies within training datasets.
3. Derived personal data.
4. Relevant records associated with training.
5. Personal data that may be retained or reproduced by trained models.

A request to delete an account does not necessarily require the destruction of an entire previously trained AI model.

However, QQmber cannot categorically exclude trained models or training datasets from applicable data protection obligations.

18.4. Right to Restriction of Processing

You may request restriction of processing where applicable legal conditions are satisfied.

For example, restriction may be appropriate while the accuracy of certain personal data is being verified.

18.5. Right to Data Portability

Where applicable, you may request personal data you provided to QQmber in a structured, commonly used, machine-readable format.

You may also request transmission of eligible information to another controller where technically feasible and legally required.

18.6. Right to Object

Where QQmber relies on legitimate interests as the legal basis for processing, you may have the right to object.

QQmber will assess such objections in accordance with applicable law.

Where personal data is processed for direct marketing, individuals have the right to object to that processing.

18.7. Right to Withdraw Consent

Where QQmber relies on consent, you may withdraw that consent at any time.

This includes voluntary consent to use eligible User Content for training QQmber’s proprietary AI models.

Withdrawal must be as easy as providing consent.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Following withdrawal, QQmber will stop further processing based on that consent and handle retained personal data in accordance with applicable legal requirements.

You will not lose access to ordinary QQmber functionality solely because you decline or withdraw optional AI Training Consent.

18.8. Rights Related to Automated Decision-Making

Where applicable, you may have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.

QQmber’s ordinary AI-generated assistance does not necessarily constitute such decision-making.

If QQmber introduces processing covered by Article 22 GDPR, it will provide the information and safeguards required by law.

18.9. Exercising Your Rights

To exercise your rights, contact:

[email protected]

Please describe your request sufficiently for QQmber to identify the relevant processing.

QQmber may request reasonable information necessary to verify your identity.

We will not request unnecessary personal information solely to process a privacy request.

Where GDPR applies, QQmber will generally respond within one month of receiving a valid request, subject to permitted extensions.

18.10. Complaints to Supervisory Authorities

You have the right to lodge a complaint with a competent data protection supervisory authority.

QQmber’s principal supervisory authority in Romania may be:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).

Where applicable, individuals may also complain to a supervisory authority in another EU or EEA member state.

Individuals covered by UK GDPR may contact the United Kingdom’s Information Commissioner’s Office (ICO).

You are not required to contact QQmber before exercising your right to lodge a complaint.

19. Children’s Privacy

QQmber is intended for individuals aged 16 years or older.

Users must also satisfy any higher age requirement or additional authorization requirement imposed by applicable law.

19.1. Minimum Age

Individuals under 16 are not permitted to create registered QQmber accounts or use Guest Mode.

Where required by applicable law, users under 18 must obtain authorization from a parent or legal guardian.

19.2. Information About Minors

QQmber does not knowingly seek to collect personal data directly from individuals who are not eligible to use the Services.

If we become aware that an ineligible individual has provided personal data, we will take appropriate steps consistent with applicable law.

These steps may include:

• Restricting access.
• Requesting appropriate verification.
• Deleting an account.
• Removing personal data where required.

19.3. Minors Mentioned in User Content

Notes and uploaded documents may contain information about children, even where the account holder is an adult.

Such information may require additional safeguards.

A user’s agreement to the Terms of Service or voluntary AI Training Consent does not automatically establish a lawful basis for every processing activity involving another person’s personal data.

19.4. AI Training and Children’s Data

QQmber will assess additional safeguards before using personal data relating to children for AI training.

Where applicable law requires additional authorization or prohibits a particular processing activity, QQmber will comply with those requirements.

20. Automated Processing, AI Systems, and Profiling

QQmber uses artificial intelligence technologies to provide features such as content generation, document analysis, mathematical assistance, image processing, and other productivity tools.

20.1. AI-Assisted Processing

When you request an AI function, QQmber may process information necessary to fulfill that request.

Depending on the feature, this may include:

• Your prompt.
• Selected notes.
• Relevant document context.
• Images or attachments.
• Conversation history.
• Tool outputs.
• Technical information necessary to execute the request.

The scope of processing depends on the functionality used.

20.2. Third-Party AI Providers

Certain AI functions may rely on external AI providers.

Where necessary to provide a requested function, QQmber may transmit relevant information to such providers.

This processing is separate from the optional use of User Content to train QQmber’s proprietary models.

QQmber will disclose relevant provider categories and processing arrangements in accordance with applicable law.

20.3. Proprietary AI Model Training

QQmber does not currently process User Content to train proprietary AI models. Separate AI Training Consent is recorded for potential future processing; any future developing, training, fine-tuning, evaluating, or improving of proprietary models must remain within the valid consent scope and all additional applicable legal requirements.

The recorded consent may cover eligible content stored in private notes that has never been submitted directly to the AI Agent, but recording consent does not mean that this content is currently used for training.

Such processing must remain within the scope of the consent provided and any additional applicable legal requirements.

20.4. Profiling

QQmber may process limited technical or usage information to maintain security, enforce usage limits, and provide account functionality.

Such processing does not automatically constitute profiling within the meaning of GDPR.

If QQmber introduces additional profiling activities, the relevant purposes, legal bases, and rights will be disclosed.

20.5. Significant Automated Decisions

QQmber does not intend ordinary AI-generated content to serve as a legally binding determination concerning a user.

Where processing involves solely automated decisions with legal or similarly significant effects, QQmber will comply with applicable legal requirements.

21. Third-Party Websites and Integrations

QQmber may contain links to external websites, applications, or services.

Examples may include:

• Authentication providers.
• Payment portals.
• External documentation.
• Integrated productivity tools.
• AI services.
• Third-party websites referenced in generated content.

21.1. External Privacy Practices

Third-party services may maintain their own privacy policies and terms.

QQmber does not control the independent privacy practices of external websites merely because a link appears within the Services.

Users should review relevant third-party policies when interacting directly with external services.

21.2. Connected Services

Where QQmber permits integration with external services, personal data may be exchanged as necessary to provide the requested integration.

The relevant data categories, purposes, and legal bases will depend on the integration.

Additional notices or permissions may be presented when required.

21.3. Changes to Integrations

QQmber may add, modify, or discontinue integrations.

Where such changes materially affect personal-data processing, we will update the relevant privacy disclosures and obtain additional consent where legally required.

22. Changes to This Privacy Policy

QQmber may update this Privacy Policy to reflect changes in:

• Applicable laws and regulations.
• Our Services and functionality.
• Data-processing activities.
• AI technologies.
• Third-party service providers.
• Security practices.
• Data retention procedures.
• International transfer arrangements.
• User privacy controls.

22.1. Publication of Updates

When this Privacy Policy is updated, QQmber will revise the “Last Updated” date.

The current version will be made available through the Services.

22.2. Material Changes

Where changes materially affect users’ privacy rights or the processing of their personal data, QQmber will provide appropriate notice as required by applicable law.

Such notice may be provided through:

• The QQmber application.
• Account notifications.
• Email.
• Other appropriate communication methods.

22.3. Changes to AI Training

If QQmber materially expands the categories of personal data used for optional AI training or introduces new purposes beyond the scope of existing consent, additional consent may be required.

Continued use of QQmber will not automatically constitute valid consent to materially expanded optional AI training.

22.4. Previous Versions

Where legally required or operationally appropriate, QQmber may retain records of previous Privacy Policy versions.

Such records may be used to establish which disclosures applied at a particular time.

23. Contact Information

If you have questions about this Privacy Policy, personal-data processing, AI Training Consent, account deletion, or your privacy rights, you may contact QQmber.

Data Controller

YURA IT TECHNOLOGIES S.R.L.

Trading Name: QQMBER

Company Registration Number: J40/14152/2022

Romanian Tax Identification Number (CUI): 46523075

Registered Office:

Strada Ion Câmpineanu No. 11 Floor 4, Room 432 Module B, Space 4.03B Sector 1 Bucharest, 010031 Romania

Email: [email protected]

Website: qqmber.app

Privacy requests may be submitted to the email address above.

If QQmber becomes legally required to appoint a Data Protection Officer, the relevant contact details will be made available in accordance with applicable law.

24. Final Provisions

24.1. Relationship with the Terms of Service

This Privacy Policy should be read together with the QQmber Terms of Service.

The Terms of Service govern contractual use of the Services. This Privacy Policy governs transparency concerning personal-data processing. Defined terms should be interpreted consistently with the Terms where the context permits, but the Terms do not override this Policy or mandatory data-protection rights.

This Privacy Policy explains how QQmber processes personal data.

Where applicable data protection law grants individuals mandatory rights, those rights are not restricted by the Terms of Service.

24.2. Interpretation

References to GDPR include Regulation (EU) 2016/679 where applicable.

References to UK GDPR concern the corresponding United Kingdom data protection framework where applicable.

Terms such as “personal data,” “processing,” “controller,” and “processor” have the meanings assigned by applicable data protection legislation.

24.3. Mandatory Legal Protections

Nothing in this Privacy Policy is intended to exclude, restrict, or waive rights that cannot lawfully be excluded.

Where a provision conflicts with mandatory applicable data protection law, the mandatory legal requirement will prevail.

24.4. Language

This Privacy Policy is drafted in English.

QQmber may provide translations for users in different jurisdictions.

Where applicable law requires information to be provided in another language, QQmber will comply with that requirement.

24.5. Effective Date

This Privacy Policy becomes effective on the date specified at the beginning of the document.

The effective date must be confirmed before publication.