Effective Date: 2026-07-25

Version: 1.0.0.

1. About this policy

This policy explains what personal information Qualsis, LLC (a North Carolina single-member limited liability company - "Qualsis," "we," "us," or "our") collects, why, what we do with it, how we share it, how long we keep it, and what choices you have about it.

This policy applies to:

• Information collected from visitors to our websites at qualsis.com, qortexos.com, and qoherenceai.com (all legal documents are canonically published at qualsis.com/legal; the product sites link to that location)
• Information collected through our products: QortexOS (operational intelligence for managed service providers and similar businesses) and, when launched, QoherenceAI (an operating platform for AI agents in regulated industries)
• Information collected through our marketing, sales, support, and business communications

When you use our products as an end user inside a customer organization (for example, you log in to QortexOS because your employer is a Qualsis customer), the customer organization is responsible for its own privacy notices to you. We process your data on the customer's behalf under a separate data processing agreement with the customer. Sections 4.4 and 8 explain this in more detail..

If anything in this policy is unclear, contact us using the information in Section 19.

2. About Qualsis

Qualsis is a small company building software for businesses. We help operators of small and mid-sized businesses - particularly managed service providers (MSPs) - see what is changing in their business before it shows up in their numbers, decide what to do, and act with evidence. We do this through QortexOS (operational intelligence) and, in development, QoherenceAI (a platform for building AI agents in regulated industries).

We are based in North Carolina, in the United States. We process personal information about people in the United States, the European Union and the European Economic Area, the United Kingdom, and, depending on our customers, other countries.

3. Definitions

Personal information / personal data: information that identifies, relates to, or can reasonably be linked to an identified or identifiable individual. We use the terms interchangeably and the broader of any applicable legal definition applies.

Customer: an organization that purchases or uses our products under a written agreement with us (typically an organization, not an individual).

Customer data: information a customer (or a person acting on behalf of a customer) uploads to, generates within, or transmits through our products. This includes information about the customer's own employees, clients, vendors, and counterparties.

End user: an individual who interacts with one of our products. Most end users are people acting on behalf of a customer organization.

Direct-collection data: information we collect directly from you - through our websites, marketing forms, sales conversations, support requests, billing, or your own use of features that require an account with us.

Controller, processor: terms used in the General Data Protection Regulation ("GDPR") and similar laws to describe who decides how personal information is used. When we collect direct-collection data, we are the controller. When we handle customer data on a customer's behalf, we are the processor.

4. Information we collect

4.1. Information we collect directly from you

We collect this information when you give it to us. Categories:

Account information: name, business email address, role, organization, and password (stored as a salted hash, not in plain text) for any account you create with us, including admin accounts inside our products.

Contact information: name, business email address, telephone number, organization, role, and any other information you provide when you contact our sales team, request a demo, sign up for a newsletter, request product information, or submit a support request.

Billing information: name, business email address, billing address, payment method details (processed by our payment processor; we do not store full card numbers ourselves), invoice records, and tax identification information where applicable.

Communications: the content of messages, support tickets, sales calls, and other communications between you and us, including any attachments you send us.

Recruitment information: if you apply for a role with us, the information in your application (resume, work history, references) and any information you share during the interview process.

4.2. Information we collect automatically

When you interact with our websites and products, we automatically collect:

Device and connection information: IP address, browser type and version, operating system, device identifiers, language settings, time zone, and referring website.

Usage information: the pages you view, the features you use, the actions you take, the time you spend, and the order in which you do things.

Log information: server logs of your interactions with our services for security, debugging, and operational purposes.

Cookies and similar technologies: see Section 13 for our cookie practices.

4.3. Information from third parties

We may receive information about you from:

Data enrichment providers: business data about you or your organization (for example, your job title, the size of your company, your industry) for sales and marketing purposes, where permitted by law.

Public sources: publicly available business information (for example, professional networking profiles, public company filings, news mentions).

Referrals and integrations: people you work with who share your name or contact information with us, and services you connect to our products that share information with us at your direction.

4.4. Customer data (where we are a processor)

When a customer organization uses our products, they upload, connect, or generate information that may include personal information about their own employees, clients, vendors, prospects, or other individuals. We process this information on the customer's behalf, under the customer's instructions, and under a written data processing agreement with the customer. We do not control the purposes for which this data is collected or used by the customer; the customer does.

If you are an individual whose data is processed because a customer of ours has uploaded it, our processing is governed by the agreement we have with that customer. To exercise data subject rights against this data, contact the customer organization first; they are responsible for responding. If you do not know which customer is the controller, you can contact us using the information in Section 19 and we will do our reasonable best to route you correctly.

5. How we use information

We use information for the purposes described below. Each purpose may use any of the categories of information collected, subject to applicable law.

To provide our services: authenticating accounts, displaying functionality, processing transactions, responding to requests, and delivering features.

To support our customers: answering questions, resolving issues, providing documentation, and improving the experience.

To improve our products and operations: analyzing how our products are used so we can fix problems, plan improvements, and prioritize work. Where this analysis uses personal information, we use aggregated or de-identified data where reasonably practical.

To communicate with you: sending you transactional emails about your account, our services, and changes to our terms; sending you marketing communications where you have opted in or where applicable law otherwise permits.

For billing and financial recordkeeping: processing payments, issuing invoices, managing renewals, and keeping financial records required for tax and accounting compliance.

For security and abuse prevention: monitoring for fraud, unauthorized access, abuse, and threats; investigating and responding to incidents; protecting our infrastructure and our customers' data.

For legal compliance and to protect rights: complying with applicable law and lawful requests; enforcing our terms and policies; protecting our rights, safety, and property and the rights, safety, and property of others.

We do not use direct-collection data to train any artificial intelligence or machine learning model without your explicit opt-in. See Section 9 for details.

We do not sell personal information for money or other valuable consideration. See Section 16.2 for what this means under California law.

6. Legal bases for processing (EU / EEA / UK)

If you are in the European Economic Area or the United Kingdom, our processing of your direct-collection personal data relies on one or more of the following legal bases under Article 6 of the GDPR or UK GDPR:

Performance of a contract with you or to take steps at your request before entering into a contract: providing you the services you signed up for, processing payments, responding to support requests.

Compliance with a legal obligation: retaining records required by tax law, responding to lawful requests, and meeting other regulatory requirements.

Legitimate interests (which we have considered and balanced against your interests, rights, and freedoms): operating our business, securing our infrastructure, preventing fraud and abuse, improving our products and services, communicating with our customers about their accounts, and direct marketing to existing business contacts in line with applicable rules.

Consent, where required: marketing communications to individuals where consent is required by applicable law, and any processing of special categories of data where another legal basis does not apply. You can withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

For customer data where we act as processor, the legal basis is set by the customer (the controller), not by us.

7. How we share information

We share personal information only as described below.

7.1. Service providers (subprocessors)

We use third-party service providers to help us run our business and deliver our products. These include:

Infrastructure: cloud hosting, computing, storage, database services, and content delivery networks.

Payment processing: payment processors that handle card transactions and other payment instruments on our behalf.

Communications: email delivery services, customer support and ticketing platforms, marketing and sales communications platforms.

Analytics and monitoring: product analytics, error monitoring, log aggregation, and similar operational tools (configured to minimize personal data where practical, with anonymization or aggregation applied at collection where supported).

Engineering tools: version control, deployment, identity and access management, and similar internal-use tools that may process limited personal data incidentally to performing their function.

Artificial intelligence services: large language model providers and other AI services we use to support our internal operations (for example, drafting assistance) and, where disclosed to customers, certain product features. We contract with these providers under terms that prohibit them from training their models on data we send them. See Section 9 for details.

Each service provider is bound by a written contract that includes confidentiality, data protection, and (where personal data is processed) data processing terms. A current list of the service providers we use as subprocessors for customer data is available at https://qualsis.com/legal/trust/subprocessors, updated when changes occur.

As of the effective date, the subprocessors we use for production customer data are:

Amazon Web Services, Inc. (United States): infrastructure hosting, computing, storage, networking, and backup, including the Amazon Bedrock foundation-model service that runs QortexOS AI features (see the model-provider note below)

Databricks, Inc. (operating on AWS infrastructure; same regional placement as AWS): data analytics, machine learning pipelines, and operational intelligence processing

Model providers (not subprocessors). QortexOS AI features run on third-party foundation models built by Anthropic (Claude models) and Cohere (Embed models, used in document-processing and semantic-retrieval features). Qualsis runs these models exclusively through Amazon Bedrock, AWS's managed foundation-model service, under Qualsis's AWS agreements. Under the Amazon Bedrock service design, on Qualsis's current approved Amazon Bedrock deployment channel and approved models, the model providers have no access to the prompts, outputs, or logs from Qualsis's use of the models, and model inputs and outputs are not used to train the models. Because they receive no customer data on this channel (the data we process on a customer's behalf - see Section 4.4), Anthropic and Cohere are model providers, not subprocessors; the operative subprocessor for AI features is AWS. If a change to our model arrangements would cause a model provider to receive or otherwise process that data on Qualsis's behalf, the provider would become a subprocessor and would be added to the subprocessor list at https://qualsis.com/legal/trust/subprocessors through the 30-day notice procedure in the data processing agreement before the change takes effect.

Payment processing (not a subprocessor). Payment processing and billing for your Qualsis subscription are handled by Stripe, LLC (United States). Stripe processes the billing information described in Section 4.1 - information we collect as a controller - and does not process the customer data we hold as a processor, so it is not a subprocessor and does not appear on the subprocessor list.

We may add or change subprocessors. We will notify our customers of additions through the subprocessor list page and the change-notification mechanisms in the data processing agreement. For direct-collection data, we will update this section when material additions occur.

7.2. Affiliates

If we add affiliates in the future (for example, a parent company or subsidiaries), we may share information with them for the purposes described in this policy. We will update this section before any such sharing begins. As of the effective date, Qualsis has no affiliates.

7.3. Legal and safety

We may disclose information when we believe in good faith that disclosure is necessary to:

Comply with applicable law, lawful requests, court orders, or other legal process

Investigate, prevent, or respond to suspected fraud, abuse, security incidents, or activity that may violate our terms

Protect our rights, property, or safety, or the rights, property, or safety of our customers, our customers' end users, our employees, or the public

Enforce our agreements

Where we receive a request that we believe to be unlawful or overbroad, we will challenge it where appropriate.

7.4. Business transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of all or part of our assets, or similar transaction, personal information may be transferred or disclosed as part of the transaction. We will require the receiving party to honor the commitments in this policy and applicable law. We will give you reasonable notice of any such transfer that materially changes how your data is handled.

7.5. With your consent or at your direction

We share information in other ways with your consent or at your direction.

8. How we share customer data (where we are a processor)

Customer data is shared by us only on the customer's documented instructions (typically through the configuration of the customer's account and the integrations the customer enables). We do not disclose customer data to third parties for our own purposes, including marketing or training our models, without the customer's authorization. The data processing agreement between Qualsis and the customer governs subprocessor changes, audit rights, breach notification, and other handling specifics, and takes precedence over this policy for the data it covers.

One narrow exception to the pure processor picture above: Qualsis keeps a limited record of platform security, abuse-detection, incident-response, and cross-tenant threat telemetry logs in its own right, as a controller, because the security of the platform across all customers is our own responsibility. This record is kept to the minimum those purposes need, is used for no other purpose, and is retained under the log window in Section 11; the legal bases in Section 6 (our legitimate interest in securing our infrastructure and preventing fraud and abuse) cover it. Audit logs of activity inside a customer's tenant remain customer data we process on the customer's instructions.

9. Artificial intelligence and automated processing

Several of our products and operations involve artificial intelligence or machine learning. We treat these uses carefully because we believe truth and privacy can coexist. Here is how we approach them.

9.1. We do not train our models on your direct-collection data

We do not use information you provide to us directly - your account, your communications with us, your billing information, your usage of our products as an admin - to train our own AI or machine learning models, and we do not allow our AI service providers to train their models on this information.

9.2. We do not train our models on customer data without opt-in

Where we are a processor for customer data, we do not train our own AI or machine learning models on that customer data, and the contractual terms governing our approved AWS/Bedrock deployment do not allow the model providers to train their models on it, except where a customer has explicitly opted in to such use (which is not enabled by default).

9.3. AI used inside QortexOS

QortexOS uses artificial intelligence and machine learning to help our customers see signals in their operational data: identifying patterns, generating forecasts, surfacing recommendations, and producing private peer benchmarks. QortexOS does not make consequential decisions about any individual without a human in the loop. The customer-organization's decision-makers are the ones who decide; QortexOS surfaces information to support those decisions.

QortexOS is not used to make hiring, firing, performance, compensation, or other consequential employment decisions automatically. If a customer wishes to use QortexOS analytics in connection with such decisions, the customer is responsible for the human-review processes and for the substantive legality of the decisions under applicable employment, anti-discrimination, and AI-governance laws.

QortexOS is not used for biometric identification, emotion or sentiment inference, social scoring, or processing of children's data, and we will not knowingly enable customers to use it for those purposes.

9.4. AI to be used inside QoherenceAI (in development)

QoherenceAI is being designed as a platform for building AI agents. Customers will build agents that perform tasks within the customer's environment. This raises specific considerations:

QoherenceAI will not enable fully automated adverse decisions affecting persons (such as credit, benefits, legal-status, or employment decisions) without a built-in human-review checkpoint required by the platform's architecture.

QoherenceAI will not provide capabilities for biometric identification, emotion inference, social scoring, or processing of children's data.

QoherenceAI customers building agents will be required, by the customer-facing contract, to honor the same red lines on behalf of their own deployments.

We will update this section with concrete details before QoherenceAI is made generally available.

9.5. Internal AI tools

We use AI-assisted tools for internal productivity - drafting communications, generating code, exploring data. Where those tools have access to personal information, we use them under enterprise-, team-, business-, or API-tier agreements that prohibit the tool provider from training their models on our inputs. We do not put your personal information (or our customers' personal information) into consumer-tier AI tools.

9.6. Right to object to automated decision-making (EU / EEA / UK)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except in specific circumstances permitted by law (Article 22 GDPR / UK GDPR). We do not make any such decisions about you based on direct-collection personal data. If you believe we have, contact us using Section 19.

10. International data transfers

We are based in the United States. When we receive personal data from the European Economic Area, the United Kingdom, or other jurisdictions with cross-border transfer rules, we transfer that data to the United States and may use service providers in other countries to support our operations.

For transfers from the EEA, we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) and supplementary measures appropriate to the data and the recipient. For transfers from the United Kingdom, we rely on the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses, as applicable. Where the recipient country has been recognized as providing adequate protection by the European Commission or the United Kingdom government, we rely on that adequacy decision. Where you are a customer, additional commitments are in the data processing agreement.

You can request a copy of the transfer-mechanism documentation that applies to your data by contacting us using Section 19. We will provide it subject to reasonable redaction for confidentiality and security.

11. Retention

We keep personal information only as long as we have a lawful basis to do so. Specific periods:

Account information where Qualsis is the controller (accounts you create directly with us - for example, logins for our corporate websites, marketing preferences, support, and billing): for the lifetime of the account, plus 90 days after deletion to allow for restoration on request and to meet legal recordkeeping. After that, we delete or anonymize. User accounts inside QortexOS (including administrator accounts in a customer's tenant) are customer data we process on the customer's behalf; they are deleted per the deletion windows in the data processing agreement, and rights requests against them should go to the customer organization (see Section 4.4).

Customer-data retention (where we are a processor): governed by the data processing agreement with the customer, which provides for deletion from active production systems within 60 days after termination of the customer's subscription with deletion certification on request. Residual encrypted backup and versioned copies will expire through Qualsis's ordinary retention processes no later than ninety (90) days after production deletion and will not be restored except for disaster recovery or legal compliance (Section 12.2 of the data processing agreement).

Billing records: as long as required by US tax law (typically 7 years from the relevant filing date) and applicable law in any other jurisdiction where we maintain financial obligations.

Marketing-list information: until you unsubscribe or request deletion, whichever comes first. If you unsubscribe, we keep a minimal suppression record - your email address or a hash of it, an opt-out flag, and the opt-out date - so that our systems do not contact you again; it is kept for that purpose only.

Support and communications records: typically 24 months from the last contact, or longer if needed to handle a continuing matter.

Recruitment information: if you are not hired, 24 months from your last application; longer if you give us specific consent for a longer talent-pipeline period.

Security and audit logs: a minimum of 12 months for production platform logs, or longer where required by law or the security investigation in question. Server logs for our corporate websites are separate from platform logs and are kept for the shorter operational window described in our cookie notice (Section 13).

Cookies and similar technologies: see Section 13 and our cookie notice.

When the retention period for a category ends, we delete the data, anonymize it, or place it under restricted access for limited purposes (such as defending a legal claim) until those purposes are also met.

12. Security

We treat security as a load-bearing part of how we build software, not an afterthought. We maintain administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, alteration, disclosure, loss, or misuse.

Specific commitments:

Encryption in transit: all data exchanged between you and our services is encrypted using current versions of Transport Layer Security (TLS).

Encryption at rest: personal data stored in our infrastructure is encrypted at rest using AES-256 or equivalent.

Access control: access to personal data is restricted to the people who need it, granted on the principle of least privilege, and reviewed regularly.

Audit and certification: we are working toward SOC 2 Type II certification, with our target being to complete this within 12 months of general availability of QortexOS. Until then, we maintain documented internal security practices and will provide our internal security overview on request.

Breach notification: if we become aware of a personal data breach affecting your data, we will notify you (where you are an individual subject to the breach) and our customers (where their customer data is affected) without undue delay and consistent with our DPA commitments. For our direct-collection data, we will notify you in the manner and within the timing required by applicable law.

Subprocessor diligence: every service provider that handles personal data on our behalf is contractually required to maintain at least the same level of protection.

No system is perfectly secure. If we discover a vulnerability or experience an incident affecting your data, we will act to contain it, notify those who need to know, and learn what we can to prevent recurrence.

13. Cookies and tracking technologies

We use cookies and similar technologies (web beacons, pixels, local storage) on our websites and inside our products. We use them to:

Make our websites and products work (essential cookies you cannot opt out of without breaking the service)

Remember your preferences (settings, language)

Where we use these technologies, and only with the required consent, we also use them to:

Measure how our websites and products are used (analytics)

Personalize content

Support marketing

Our cookie notice describes the specific cookies we use, what they do, who set them, and how long they last. We ask for your consent before placing non-essential cookies, everywhere and not only where the law requires it, and provide a way to manage your preferences.

Our cookie notice and preference center are at https://qualsis.com/legal/cookies. You can change your cookie preferences there at any time.

You can also control cookies through your browser settings; doing so may break parts of our services.

14. Marketing communications

We send you marketing communications only where:

You opted in to receive them, or

You are an existing business contact and the marketing relates to similar products or services we offer (where this is permitted under applicable law), or

Applicable law otherwise permits the communication

Every marketing email includes an unsubscribe link. You can also contact us using Section 19 to opt out of marketing. When you opt out, we add you to a suppression list - the minimal record described in Section 11 - and screen future marketing sends against it so the opt-out sticks. We continue to send you transactional emails about your account and our services even after you opt out of marketing.

15. Children

Our products and services are not directed to children under the age of 16 (or such higher minimum age as applicable law may require in a given jurisdiction). We do not knowingly collect personal information from children. If you believe we have inadvertently collected personal information from a child, contact us using Section 19 and we will delete it.

16. Your rights and choices

Your rights depend on where you live. We honor the rights in this section consistent with applicable law. To exercise any right, see Section 19 for how to contact us. We may need to verify your identity before we can act on a request, and we will not charge a fee for a verified request unless permitted by law (for example, for unfounded or excessive requests).

16.1. Rights for EU, EEA, and UK residents

Under the GDPR and UK GDPR, you have the right to:

Be informed about how we process your personal data (this policy)

Access the personal data we hold about you and obtain a copy of it

Correct (rectify) inaccurate or incomplete personal data

Delete (erase) your personal data in certain circumstances

Restrict our processing of your personal data in certain circumstances

Object to our processing of your personal data based on legitimate interests or for direct marketing (we will stop processing for direct marketing on objection)

Data portability: receive personal data you provided to us in a structured, commonly used, machine-readable format and transmit it to another controller where technically feasible

Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal

Not be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you (see Section 9.6)

Lodge a complaint with a data protection authority. If you are in the EEA, the supervisory authority where you live, work, or where the alleged violation occurred. If you are in the UK, the Information Commissioner's Office.

We aim to respond within 25 days of first receiving your request, ahead of the statutory one-month deadline. The response clock runs from first receipt of your request at any of our channels, not from when identity verification completes: verification does not pause or restart the clock, and any verification exchange happens inside that window. We may extend by two additional months for complex or numerous requests; if we do, we will tell you within the first month and explain why.

16.2. Rights for California residents (CCPA / CPRA)

If you are a California resident, you have the rights granted by the California Consumer Privacy Act, as amended by the California Privacy Rights Act. These include the right to:

Know what categories of personal information we collect, the sources, the purposes, the categories of third parties with whom we share it, and specific pieces of personal information we hold about you

Delete personal information we collected from you, subject to exceptions

Correct inaccurate personal information

Opt out of the sale or sharing of personal information. We do not sell personal information for money or other valuable consideration as those terms are defined in the CCPA. We may share certain identifiers with third parties for cross-context behavioral advertising in some configurations (analytics and similar); you can opt out of this sharing through the cookie notice described in Section 13 or by contacting us

Limit the use and disclosure of sensitive personal information to the purposes permitted by law

Not be discriminated against for exercising your rights

We respond to California consumer requests within 45 days of first receiving the request; identity verification happens inside that window and does not pause or restart the clock. We may extend by 45 additional days for complex requests; if we do, we will notify you in writing.

To exercise these rights, contact us as described in Section 19. You may also authorize an agent to act on your behalf, subject to verification we are required to perform under the law.

If you are under 16, you have the right to affirmatively opt in to any sale or sharing of your personal information that we conduct. We do not knowingly sell or share personal information about minors. (We do not knowingly collect personal information from minors at all - see Section 15.)

16.3. Rights for other US state residents

If you are a resident of a US state with a comprehensive privacy law (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others as those laws come into effect), you have rights similar in substance to the rights described above: access, correction, deletion, portability, and the right to opt out of certain processing. We honor those rights consistent with the applicable state law.

To exercise these rights, contact us as described in Section 19. We will tell you which state's law applies to your request and respond within the timeline that law requires (typically 45 days with a possible 45-day extension).

16.4. Right to appeal (where applicable)

If we deny your request or you are unsatisfied with how we handled it, several US state laws (and EU / UK procedure) give you a right to appeal or to lodge a complaint with the relevant regulator. We will tell you how to do so when we respond to your request.

17. Third-party links and services

Our websites and products may link to or integrate with third-party services. We are not responsible for the privacy practices of those services. When you follow a link or use an integration, the third-party's own privacy notices govern the data they collect.

18. Changes to this policy

We update this policy from time to time. When we make material changes, we will let you know - through a notice on our website, an email to your registered address, or another reasonable method - before the changes take effect. The "Effective Date" at the top tells you when the current version started applying. Where applicable law requires it, we will obtain your consent before applying material changes to your data.

A change log of material updates to this policy is maintained at https://qualsis.com/legal/trust/privacy-changelog; minor formatting and clarification edits may not be separately logged.

19. Contact us, how to exercise your rights, and our data protection lead

For any questions about this policy, to exercise any of the rights described in Section 16, or to report any concern about our handling of personal information:

Postal mail:

Qualsis, LLC

3540 Toringdon Way, Suite 200

Charlotte, NC 28277

United States

Submit a data subject request: Send your request to Qualsis Privacy Request or by postal mail to the address above. We are building a dedicated submission form; until it is published, email and postal mail are the verified intake channels. (When the form is published it will be linked from our trust center at https://qualsis.com/legal/trust/dsar.)

Our data protection lead is the founder. As we grow, we will identify a dedicated privacy contact and update this section.

19.1. Data protection representatives

Where applicable law requires Qualsis to appoint an EU or UK representative, the representative's contact details will be published here.

19.2. Supervisory authority complaint right

You may lodge a complaint with a supervisory authority. For residents of the EEA, the supervisory authority in the country where you live, work, or where the alleged infringement occurred. For residents of the UK, the Information Commissioner's Office at https://ico.org.uk/.

We would prefer to address your concerns directly before you contact a supervisory authority, and we encourage you to contact us first, but the right to lodge a complaint is not contingent on doing so.

20. Specific products

20.1. QortexOS

QortexOS is a software-as-a-service product for managed service providers and similar businesses. When a customer organization (typically an MSP) subscribes, the customer's authorized administrators have accounts; the customer uploads or connects operational data; QortexOS analyzes that data to surface signals, forecasts, and recommendations.

For information about you that you provide directly to us (sign up, support requests, billing), this policy applies.

For information about you that your employer (a Qualsis customer) uploads or generates inside QortexOS as part of operating their business, your employer's privacy notices and our data processing agreement with your employer govern. Contact your employer to exercise rights against that data.

20.2. QoherenceAI

QoherenceAI is a platform we are building for our customers to develop, deploy, and operate AI agents in their own environments. When QoherenceAI is generally available, this policy will be updated to describe the data flows and choices specific to that product. Until then, this section is a placeholder and QoherenceAI is not subject to the operative provisions of this policy beyond our general practices for prospective products in development.

21. About this version

This is version 1.0.0 of this policy, the first published version. The Effective Date at the top is the date this version started applying. A change log of material updates is maintained at https://qualsis.com/legal/trust/privacy-changelog.