Privacy Policy

1. Introduction

Qualfy (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have. It applies to all users of the Qualfy website, dashboard, APIs, widget, and related services (collectively, the “Service”). By using the Service, you agree to the practices described in this policy. Please also review our Terms of Service.

2. Information We Collect from Customers

When you create a Qualfy account and use the dashboard, we collect:

• Account information: your name, email address, and password. If you sign in with Google, we receive your name and email from Google.
• Organization information: your company name, team member details, and project configurations.
• Calendar data: when you connect a calendar, we access your free/busy availability to display scheduling options. We do not read the details of your calendar events beyond their free/busy status.
• Payment information: if you subscribe to a paid plan, payment is processed by Stripe. We do not store your credit card numbers. We receive confirmation of payment status and billing details from Stripe.

3. Information We Collect from End Users

When you interact with the Qualfy widget embedded in a customer's application, we may collect the following information:

• Identification data: information passed by the customer's application via the qualfy('identify') call, which may include a user ID, email address, and custom properties chosen by the customer (such as plan type, role, or company name).
• Scheduling information: if you book an interview through the widget, we collect your name, email address, and the time slot you selected.
• Widget interaction events: we record widget impressions (when the popup is shown), dismissals, and bookings to provide analytics to the customer.
• Event tracking data: actions tracked by the customer's application via qualfy('track') calls, which include event names defined by the customer.

4. Information We Collect Automatically

When you use the Service, we automatically collect certain technical information including IP addresses, browser type and version, operating system, referring URLs, pages visited on our website, and error logs. This information is used to operate, maintain, and improve the Service and to diagnose technical issues.

5. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Send transactional emails such as interview confirmations, reminders, and cancellation notices.
• Integrate with calendar services to display availability and create events.
• Provide analytics and reporting to customers about their widget performance and research pipeline.
• Improve the Service, fix bugs, and develop new features.
• Respond to support requests and communicate with you about your account.

We do not use your information for advertising. We do not sell your information to third parties.

6. Data Sharing

We share data only with service providers who help us operate the Service:

• Cloud infrastructure providers for database hosting and storage.
• Email delivery providers for sending transactional emails.
• Hosting providers for serving the dashboard and APIs.
• Google and Microsoft for calendar integration (only when you connect your calendar).
• Stripe for payment processing.
• Slack for notification delivery (only when you enable the Slack integration).

We may also disclose information if required by law, subpoena, or legal process, or if we believe disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

7. Data Retention

Customer account data is retained for as long as your account is active. If you terminate your account, we will delete your data within 90 days, except where we are required to retain it by law. End user widget data is retained according to the customer's project settings and our standard retention schedules. You may request early deletion by contacting us.

8. Customer Responsibilities

If you embed the Qualfy widget in your application, you act as the data controller for the personal data collected from your end users. You are responsible for:

• Informing your end users about the widget's data collection in your own privacy policy.
• Obtaining appropriate consent from your end users as required by applicable law (including GDPR, CCPA, and other data protection regulations).
• Ensuring that the data you pass to Qualfy via qualfy('identify') and qualfy('track') complies with your obligations under applicable law.

Qualfy processes this data on your behalf as a data processor. We will process it only in accordance with your instructions and these Terms.

9. Cookies and Local Storage

The Qualfy dashboard uses cookies for authentication and session management. The Qualfy widget uses browser localStorage to track popup frequency (for example, to avoid showing the same popup to a user who has already dismissed it or recently booked an interview). The widget does not use cookies for tracking or advertising purposes. No data stored in localStorage is sent to third parties.

10. Security

We take the security of your data seriously. All data is encrypted in transit using TLS and at rest using industry-standard encryption. We enforce strict access controls, conduct regular security reviews, and follow security best practices. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If you discover a security vulnerability, please contact us immediately at legal@qualfy.io.

11. Your Rights

For Qualfy customers: you may access, correct, or delete your account data at any time by contacting us or through your account settings.

For end users: if you interacted with the Qualfy widget on a customer's site and wish to access, correct, or delete your data, please contact the company whose site you were using. You may also contact us directly and we will help facilitate your request.

GDPR rights (EEA residents): you have the right to access, rectification, erasure, data portability, restriction of processing, and the right to object to processing of your personal data. To exercise these rights, contact us at the address below.

CCPA rights (California residents): you have the right to know what personal information we collect, the right to request deletion, and the right to opt-out of the sale of personal information. We do not sell personal information.

12. Children's Privacy

The Service is not directed at children. We do not knowingly collect personal information from children under the age of 13 (as defined by COPPA) or under the age of 16 (as defined by GDPR). If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

13. International Data Transfers

Qualfy is based in the United States. If you use the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer. We take appropriate safeguards to protect your data in accordance with this Privacy Policy regardless of where it is processed.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify customers at least 30 days in advance via email. The updated policy will be posted on this page with a revised “Last updated” date. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

15. Contact

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Email: legal@qualfy.io