Privacy Policy

1. What we collect and why

• Account and order data: email address, name (optional), company, billing address and VAT ID, order details, messages with the desk. Purpose: to perform the contract with you (GDPR Art. 6(1)(b)).
• Payment data: processed by Stripe. We receive a payment status, the last four digits and brand of your card, and invoice data, never the full card number. Purpose: contract and legal obligations (Art. 6(1)(b) and (c)).
• Access and test data you give us: TestFlight links and invites, demo credentials (encrypted, deleted 7 days after delivery), and screenshots or recordings our inspectors make of your app. Purpose: performing the inspection.
• Technical data: IP address, browser and device type, country derived from your IP to choose a currency, and security logs. Purpose: running a secure service and preventing abuse (Art. 6(1)(f), legitimate interest).
• Inspector applicants: the details you put in the application form and our assessment. Purpose: deciding whether to engage you (Art. 6(1)(b), pre-contractual steps).
• Email: when you write to any @appqc.center address, we store the message to handle it.

2. Cookies

We only use strictly necessary cookies (sign-in session, currency and theme preference). We do not use advertising or cross-site tracking cookies. See the Cookie Policy.

3. Who we share it with

Only with the processors we need to run the service, under data processing agreements:

• Supabase (database, authentication, file storage), hosted in the EU (Frankfurt, Germany).
• Cloudflare (hosting, network delivery, security, inbound email routing), global network with EU data handling commitments.
• Stripe (payments, invoicing, tax calculation), Ireland and the US.
• Resend (transactional email delivery), the US.
• Our inspectors and lead reviewers, independent contractors bound by confidentiality, who see only the orders assigned to them.

We may disclose data where the law requires it, and to professional advisers under confidentiality.

4. International transfers

Where a processor handles data outside the European Economic Area, we rely on an adequacy decision (including the EU-US Data Privacy Framework where the processor is certified) or the European Commission's Standard Contractual Clauses, with supplementary measures where needed.

5. How long we keep it

• Demo credentials: deleted 7 days after delivery.
• Evidence screenshots and recordings: 180 days after delivery, so you can use the report and order re-inspections; then deleted.
• Reports and order records: for as long as your account exists, so you can access them.
• Invoices and payment records: 7 years, as required by Dutch tax law.
• Security and audit logs: 12 months.
• Rejected inspector applications: 12 months.

6. Your rights

You can ask for access to, correction, deletion or portability of your personal data, object to processing based on legitimate interests, and restrict processing. Email privacy@appqc.center from the address on your account. We answer within one month.

You can also complain to a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

7. Security

Data is encrypted in transit and at rest. Demo credentials get an additional application-level AES-256-GCM encryption layer and every reveal is logged. Access to client data is limited to the people working on your order, enforced in the database by row-level security. Report vulnerabilities to security@appqc.center.

8. Children

The service is for businesses and adult developers. We do not knowingly collect data from children.

9. Contact

Quick One B.V., the Netherlands. Privacy questions: privacy@appqc.center.