Privacy Policy

Version: 2026-05-10

How QBeat Technologies Ltd handles personal data of website visitors, prospects, and people who sign up for the Service. For data your employer processes through the platform, see the DPA.

1. Who we are

QBeat Technologies Ltd, organised under the laws of Cyprus, is the controller for the personal data described here. Contact: privacy@qbeat.io.

2. What we collect

Account data: name, work email, organisation, role, locale.
Authentication data: magic-link tokens, TOTP secrets, recovery codes.
Usage data: pages visited, actions performed, IP address, user agent.
Communications: emails to support@qbeat.io.

3. Why we process it

To provide the Service and authenticate you.
To bill the subscription.
To monitor for fraud, abuse, and security incidents.
To send transactional emails.
To send product updates only with your consent.

4. Legal basis (GDPR Art. 6)

Contract performance — operating the Service.
Legitimate interest — security, abuse prevention, basic analytics.
Consent — marketing emails, optional analytics cookies.
Legal obligation — tax records, regulator demands.

5. Sub-processors

Hetzner Online GmbH (Germany) — compute, storage, network.
Stripe Payments Europe Ltd (Ireland) — billing.
Resend (United States) — transactional email delivery.
Sentry GmbH (Germany / EU tier) — error monitoring.

Transfers to non-EEA sub-processors are covered by Standard Contractual Clauses adopted by the European Commission.

6. Retention

Account data is retained while your account is active and for thirty days after closure for recovery. Audit-event records are retained for the period required by applicable law (typically six years in Cyprus for commercial records).

7. Your rights

Access the personal data we hold about you.
Correct inaccurate data.
Request erasure (self-serve under your account settings, GDPR Art. 17).
Object to processing based on legitimate interests.
Lodge a complaint with the Cyprus Data Protection Commissioner (DPC).

Requests: privacy@qbeat.io. Responses within thirty days (extendable by sixty under Art. 12(3)).

8. Cookies

See the Cookie Policy. We use a strictly-necessary session cookie; analytics cookies are not set without consent.

9. Changes

Material changes are notified by email to active accounts.