Privacy notice

Scope

This notice applies to the public Qfix website and contact or pilot requests submitted through it. A separate agreement may govern data processed in a customer pilot or production service.

Controller and contact

Qfix is responsible for information submitted through this website. Privacy requests can be sent to hello@qfix.ai. The legal contracting entity and service address for a customer engagement are identified in the applicable proposal or agreement.

Information we collect

We collect the information you choose to submit and limited technical data needed to operate and secure the website.

• Name, work email, phone number and company
• The call workflow or message you send
• Basic request, security and diagnostic logs

How we use information

We use this information to respond to requests, plan a potential pilot, maintain website security, prevent abuse and meet applicable legal obligations. We do not sell contact-form information.

Legal grounds

Depending on the request and applicable law, processing may be based on your consent, steps requested before entering a contract, our legitimate interest in operating and securing the service, or a legal obligation.

Service providers and transfers

Hosting, email and technical service providers may process limited information on our behalf. Where processing crosses borders, we use the safeguards required by applicable law and limit access to what is necessary.

Retention and security

We retain information only for as long as needed for the purposes above, contractual follow-up and legal requirements. We apply reasonable technical and organisational controls, but no internet transmission can be guaranteed to be completely secure.

Your choices and rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or object to processing. You may withdraw consent without affecting earlier lawful processing and may complain to the relevant data protection authority.

Contact requests and attribution

A pilot request includes the details you enter, your consent record, language and form location. When present, we also attach the first landing and referrer origin plus path, allowlisted UTM values and Google click identifiers so we can understand which campaign produced the request. Other query parameters and URL fragments are discarded. These attribution values are not used to make automated decisions about you.

Lead storage and measurement providers

Vercel may process hosting and security data, Neon may store encrypted lead records, and our email provider delivers operational notifications. Direct contact and attribution fields are encrypted at rest. Normalized email and phone values are protected with a separate keyed HMAC for controlled reconciliation and rights handling and are excluded from the operator metadata view. First-party lead records receive an automatic deletion date no later than 365 days after submission. Operational email copies must follow the same schedule unless a legal obligation applies. Cookiebot manages consent, and Google Tag Manager may deliver configured Google Analytics or Google Ads measurement only after the relevant consent.