Legal

Privacy Policy

What we collect, why we collect it, who touches it and how to get it back or get rid of it.

Last updated: October 11, 2026 · Effective: October 11, 2026

1. Who we are

Sales is operated by QBITS LLC, a New Mexico limited liability company, mailing address 142 47th St, Apt 1L, Union City, NJ 07087, United States. This policy covers our marketing website and the Sales application.

Questions, requests or complaints: hello@qbitsinc.com. A real person reads it.

2. Controller and processor

There are two different kinds of data here, and it matters who is responsible for each:

• Your account data (your name, your email, your billing) — we are the controller. This policy explains what we do with it.
• The data you put into the system about your own customers, staff and operations — you are the controller and we are your processor. We only act on your instructions. See section 16.

3. What we collect

Information you give us

• Account and contact details: name, business name, email address, phone number, business address, country.
• Billing information: processed by Stripe. We receive a confirmation, the plan purchased, the amount, and limited card metadata (brand, last four digits, expiry, country). We never receive or store your full card number or CVC.
• Business content: whatever you enter into the system — products, recipes, costs, suppliers, purchases, sales, cash counts, users and, if you choose to store them, customer and employee records.
• Support correspondence: emails and messages you send us.

Information collected automatically

• Technical and log data: IP address, browser and device type, operating system, pages or screens used, timestamps, and error traces. Used for security, debugging and abuse prevention.
• Session data: authentication tokens that keep you logged in.

What we do not collect

We do not ask for and do not want government identifiers, health data, biometric data, or payment card numbers. Please do not put that kind of information into free-text fields in the system.

4. Why we use it

Purpose	Data used
Create and run your account; let your users log in	Account, contact, session
Deliver the system's features and reports	Business content
Charge your subscription, issue receipts, process refunds	Contact, billing
Answer support requests	Contact, correspondence, limited technical data
Keep the service secure; detect fraud and abuse	Technical and log data
Send service notices (billing, outages, policy changes)	Contact
Send occasional product emails — you can unsubscribe	Contact
Measure our own advertising on the marketing site	Cookies and pixel data — see section 6
Comply with legal, tax and accounting obligations	Billing records

We do not use your business content for advertising, profiling or to train machine-learning models.

5. Legal bases (EEA and UK)

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on:

• Contract — to provide the service and bill you;
• Legitimate interests — security, fraud prevention, improving the product, and service-related email;
• Consent — for non-essential cookies and marketing email, which you can withdraw at any time;
• Legal obligation — tax and accounting record-keeping.

6. Cookies and tracking

We keep this minimal and we are specific about it:

What	Where	Purpose	Essential?
Session / authentication cookie	Application	Keeps you logged in	Yes
Browser sessionStorage flag	Marketing site	Makes sure the exit-intent message is shown at most once per visit	Yes
Stripe cookies	Checkout	Payment processing and fraud prevention, set by Stripe	Yes
Meta (Facebook) pixel	Marketing site only	Measures whether our ads actually bring customers	No
Google Fonts	Checkout and confirmation pages	Loads the typeface; your IP is visible to Google when it loads	No

The Meta pixel runs on the marketing site only — never inside the application, and never on your business data. You can block non-essential cookies in your browser, or use its "Do Not Track" setting, without losing any functionality of the system itself.

7. Who we share it with

We share data only with providers who need it to make the service work. Each one is bound by a contract to process it only on our instructions.

Provider	What it does	What it sees
Stripe, Inc. (USA)	Payments and subscriptions	Name, email, billing address, card data, transaction history
Hosting and infrastructure providers	Runs the servers and databases	All data stored in the system, at rest
Email delivery provider	Sends transactional and service email	Name, email address, message content
Meta Platforms, Inc. (USA)	Advertising measurement on the marketing site	Pixel and cookie data from the marketing site only
Google LLC (USA)	Serves web fonts	IP address and browser headers when a font loads

We may also disclose data if we are legally required to (a valid subpoena, court order or lawful request), or to protect our rights or someone's safety. Where we are allowed to tell you, we will.

If the business is ever sold or merged, data may transfer to the buyer. You would be notified, and this policy would continue to apply until replaced by one that is no less protective.

8. We do not sell your data

We do not sell personal information, and we do not share it for cross-context behavioural advertising as those terms are defined under California law. We have never done so and we have no plans to.

9. Where it is processed

Data is stored and processed on servers operated by our hosting providers. Our payment processor is in the United States.

To be transparent about something most policies hide: QBITS LLC is a US company run from Argentina. Our personnel access the systems from Argentina in order to provide support and maintenance. That means your data may be accessed from outside the United States and outside the EEA.

For transfers out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), together with the access controls described in section 11. Email us if you want a copy of the relevant terms.

10. How long we keep it

• While your subscription is active — we keep your data so the system works.
• For 30 days after cancellation — kept so you can still export it or change your mind. After that we may permanently delete it.
• Backups — purged on their own rotation, normally within 90 days.
• Billing and tax records — kept as long as US law requires us to, typically seven years. These cannot be deleted on request.
• Support emails — kept up to two years.

Ask us to delete your data sooner and we will, except for the billing records we are legally obliged to keep.

11. How we protect it

• Encryption in transit — the site and the application are served over HTTPS/TLS.
• Separation — each business's data is scoped to its own company and locations; users only see what their role allows.
• Least privilege — administrative access is limited to the people who need it, and is protected by two-factor authentication.
• Payment isolation — card data goes straight to Stripe and never touches our servers.
• Backups — taken regularly so your data survives a failure.

We are honest about the limits: no system is perfectly secure, and we do not claim a formal certification we have not earned. Please use a strong, unique password and turn on two-factor authentication where offered.

12. If something goes wrong

If a breach affects your personal data, we will notify you without undue delay and, where legally required, within 72 hours of becoming aware of it. We will tell you what happened, what data was involved and what we are doing about it — even when it is embarrassing for us.

13. Your rights

Wherever you are, you can ask us to:

• Access — get a copy of the personal data we hold about you;
• Correct — fix anything inaccurate;
• Delete — erase your data, subject to our legal retention duties;
• Export — receive your data in a portable, machine-readable format;
• Restrict or object — limit how we process it, including objecting to processing based on legitimate interests;
• Withdraw consent — for anything based on consent;
• Unsubscribe — from product email, with one click. Service and billing notices continue while you have an account.

Email hello@qbitsinc.com. We answer within 30 days and we do not charge for it. We may need to verify who you are first. We will never penalise you or degrade the service for exercising a right.

If you are in the EEA or UK and you are not satisfied with our response, you can complain to your local data protection authority. We would rather you came to us first.

14. US state privacy rights

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas or another state with a comprehensive privacy law, you have the rights listed in section 13, including the right to know what we collect, to delete it, to correct it, to obtain a portable copy, and to opt out of sale or targeted advertising.

As stated in section 8, we do not sell personal information and we do not engage in cross-context behavioural advertising, so there is no "Do Not Sell" mechanism to operate. We do not use personal data for automated decisions that produce legal effects. You may use an authorised agent to make a request on your behalf.

15. Children

Sales is a tool for businesses and is not directed to anyone under 18. We do not knowingly collect data from children. If you believe a child's data reached us, email us and we will delete it.

16. Data about your customers

If you store information about your own customers or employees in the system, you decide what goes in and why. You are the controller of that data; we process it on your behalf, only to run the service for you.

That means you are responsible for having a lawful basis to collect it, for giving your own customers the notices they are entitled to, and for honouring their requests. We will help you locate, export or delete records when you ask.

We do not contact your customers, market to them, or use their data for anything of our own.

17. Changes to this policy

If we change this policy we will update the date at the top. If a change materially affects how we handle your data, we will notify you by email or inside the application at least 30 days before it takes effect, so you have time to object or to leave.

18. How to reach us

See also our Terms of Service.