Protecting your privacy and personal data is very important to us. We therefore only use your personal data within the scope of legal regulations, in particular the General Data Protection Regulation (GDPR). With this privacy policy, we would like to inform you about the nature, scope and purposes of the collection, use and processing of your personal data by QInsights B.V. regarding the use of our AI-Powered software application.

At the heart of our operations, QINSIGHTS, our premier AI-powered software application, is designed with an unwavering commitment to data privacy and security. Utilizing advanced large language models, our infrastructure and operational practices are meticulously crafted to align with the highest standards for data protection, particularly within the European context. This entails choosing services that fulfil the following criteria:

Security: Ensuring data is protected against unauthorized access, disclosure, and destruction.

Availability: Ensuring systems are available for operation and use as agreed upon.

Processing Integrity: Ensuring that system processing is complete, valid, accurate, timely, and authorized.

Confidentiality: Ensuring that confidential information is protected.

Privacy: Addressing the collection, use, retention, disclosure, and disposal of personal information.

This Privacy Policy describes our practices with respect to Personal Information we collect from or about you when you use our website and service (collectively, "Services").

Our Responsibility

At QInsights, we understand that the integrity and confidentiality of your research data are paramount. Safeguarding the privacy of your research participants and ensuring their information remains secure is a responsibility we embrace with utmost seriousness. We are dedicated to continuously advancing our security measures and refining our privacy practices to uphold and surpass the most stringent standards for data protection, specifically catering to the unique needs of researchers and research organizations.

1.1 Infrastructure and Data Hosting

Our operational base in Europe signifies more than just a geographical location; it represents our dedication to upholding the stringent data privacy standards set by the European Union. QInsights is supported by a robust infrastructure, with our main application hosted at Hetzner Online GmbH, Germany and Google Cloud EMEA Limited, Ireland. For more information on third-party vendors, see our Compliance page.

1.1.1 Use of LLMs

We combine various Large Language Models (LLMs) with custom-built algorithms to achieve optimal results. Currently we use the various GPT models through Microsoft Azure Microsoft Ireland Operations Limited for the various analysis options. This might change in the future as we constantly testing what are the best solutions for the purpose of qualitative analysis. If we change the LLMs that we are using, we will inform all registered users. In addition, this information will be made available in the Compliance page.

Location of data centres where data is processed: Sweden, France, The Netherlands

1.1.2 Our Privacy Promise

The privacy and security of your data are paramount at every stage of your interaction with QInsights. We implement advanced encryption, strict access controls, and continuous surveillance to prevent unauthorized access and potential data breaches.

For data at rest, all data is encrypted through 256-bit AES encryption and is FIPS 140-2 compliant.
For data in transit - data moving between user devices and data centers or within and between the data centres themselves - our suppliers adhere to IEEE 802.1AE MAC Security Standards, and use industry-standard encrypted transport protocols, such as Transport Layer Security (TLS) and Internet Protocol Security (IPsec).
Data is siloed from other company data in a logical order and arrangement.
There are legally binding agreements in place for all third parties used by QInsights B.V. (Privacy Policy, Data Processing Addenda and NDAs).

You can download our Data Processing Agreement here.

1.1.3 Your Data is Yours Alone

As users of QINSIGHTS, you may submit data to the Services ("Input") and, in turn, receive results generated from your Input ("Output"). Collectively, Input and Output constitute "Customer Content." You maintain full ownership rights over the Input and are granted exclusive ownership of the Output. Any data you provide while using our service is processed securely and never used to train or improve the underlying language models. We are committed to ensuring that your data remains confidential and is solely used to provide the services you need, not for model training or any other unintended purpose.

Data Deletion: If you remove a document from your project or delete a project, the document and the project including all related documents and analyses will be permanently removed from our servers.

2. Personal information we collect

We collect information that alone or in combination with other information in our possession could be used to identify you ("Personal Information") as follows:

Personal Information You Provide:

We may collect Personal Information if you create an account to use our Services or communicate with us as follows:

Account Information: When you create an account with us, we will collect information associated with your account, including your name, contact information, account credentials, payment card information, and transaction history, (collectively, "Account Information").
User Content: When you use our Services, we may collect Personal Information that is included in the input, file uploads, or feedback that you provide to our Services ("Content").
Communication Information: If you communicate with us, we may collect your name, contact information, and the contents of any messages you send ("Communication Information").
Webinars: When you register for a webinar, we will collect Personal Information that you elect to provide to us, such as your contact details and questions related to your webinar attendance.

Personal Information We Receive Automatically From Your Use of the Services:

When you visit, use, and interact with the Services, we may receive the following information about your visit, use, or interactions ("Technical Information"):

Log Data: Information that your browser automatically sends whenever you use our website ("log data"). Log data includes your Internet Protocol address, browser type and settings, the date and time of your request, and how you interacted with our website.
Usage Data: We may automatically collect information about your use of the Services, such as the types of content that you view or engage with, the features you use and the actions you take, as well as your time zone, country, the dates and times of access, user agent and version, type of computer or mobile device, computer connection, IP address, and the like.
Device Information: Includes name of the device, operating system, and browser you are using. Information collected may depend on the type of device you use and its settings.
Cookies: We use cookies to operate and administer our Services and improve your experience on it. A "cookie" is a piece of information sent to your browser by a website you visit. You can set your browser to accept all cookies or to reject all cookies. However, refusing a cookie may in some cases preclude you from using, or negatively affect the display or function of, a website or certain areas or features of a website.
Analytics: We may use a variety of online analytics products that use cookies to help us analyse how users use our Services and enhance your experience when you use the Services.

3. How we use personal information

We may use Personal Information for the following purposes:

To provide, administer, maintain and/or analyse the Services;
To improve our Services and conduct research;
To communicate with you;
To develop new programs and services;
To prevent fraud, criminal activity, or misuses of our Services, and to ensure the security of our IT systems, architecture, and networks; and
To comply with legal obligations and legal process and to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or other third parties.

Aggregated or De-Identified Information. We may use personal information, such as your email address, in association with the use of our Services for internal analytics purposes. This allows us to improve the quality and functionality of our Services. These analytics are conducted in a manner that keeps your information secure. Any reporting or sharing of information will be done in an aggregated, non-identifiable form.

As noted above, we may use Content you provide us to improve our Services, however, we do not use your content to train AI models.

4. Disclosure of personal information

In certain circumstances we may provide your Personal Information to third parties without further notice to you, unless required by the law:

Vendors and Service Providers (see sub-processors): To assist us in meeting business operations needs and to perform certain services and functions, we may provide Personal Information to vendors and service providers, including providers of hosting, cloud, platform, email communication, operational, scheduling, CRM, community, administration, email newsletter, web analytics, and/or other information technology services. Pursuant to our instructions, these parties will access, process, or store Personal Information only in the course of performing their duties to us.
Business Transfers: If we are involved in strategic transactions, reorganization, bankruptcy, receivership, or transition of service to another provider (collectively a "Transaction"), your Personal Information and other information may be disclosed in the diligence process with counterparties and others assisting with the Transaction and transferred to a successor or affiliate as part of that Transaction along with other assets.
Legal Requirements: If required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, including to meet national security or law enforcement requirements, (ii) protect and defend our rights or property, (iii) prevent fraud, (iv) act in urgent circumstances to protect the personal safety of users of the Services, or the public, or (v) protect against legal liability.
Affiliates: We may disclose Personal Information to our affiliates, meaning an entity that controls, is controlled by, or is under common control with QInsights B.V. Our affiliates may use the Personal Information we share in a manner consistent with this Privacy Policy.

Who is responsible for your personal data?

For personal data relating to our website, user accounts, subscriptions, support services, webinars and communications, the data controller is:

QInsights B.V.

Registered address: Bierstraat 123c, 3011 XA Rotterdam, NL

Email for privacy enquiries: security@qinsights.ai

General support email: support@qinsights.ai

Our role when customers use QInsights

QInsights may act in different data-protection roles depending on the type of information being processed.

QInsights as data controller

QInsights acts as the data controller for personal data that we determine how and why to process, including:

account and registration information; contact details; licence and subscription information; billing and transaction information; website usage information; technical and security logs; customer-support communications; webinar registrations; requests for downloadable materials; and newsletter and marketing information.

QInsights as data processor

Customers may upload documents, interview transcripts, survey responses, audio recordings, video recordings and other material to QInsights. This material is referred to in this policy as Customer Content.

For Customer Content, the customer generally determines the purpose of the research or analysis and which information is uploaded. The customer therefore normally acts as the data controller, and QInsights acts as a data processor on the customer's behalf.

QInsights processes Customer Content only:

to provide the contracted QInsights services;
in accordance with the customer's instructions;
as described in our Data Processing Agreement;
as necessary to maintain the security and operation of the service; and
where required by applicable law.

The customer is responsible for ensuring that it has an appropriate legal basis for uploading and analysing personal data through QInsights.

Customer Content

Users may upload or create Customer Content, including:

text documents; interview and focus-group transcripts; open-ended survey responses; reports; spreadsheets; audio recordings; video recordings; project descriptions; metadata and profile variables; user questions and prompts; AI-generated analysis results; notes and saved analysis content; and transcription dictionaries or terminology lists.

Customer Content may include special categories of personal data within the meaning of Article 9 GDPR, such as health data, political opinions, racial or ethnic origin, religious beliefs, or information concerning a person's sex life or sexual orientation. QInsights processes such data solely on behalf of and according to the documented instructions of the customer. The customer, as data controller, is responsible for determining the applicable legal basis under Articles 6 and 9 GDPR, assessing whether the processing qualifies as scientific research, and implementing any safeguards required under Article 89 GDPR or applicable national law.

QInsights does not require customers to upload special-category personal data. The customer decides which data is uploaded and remains responsible for ensuring that the processing is lawful and appropriate. In support, QInsights offers a Data Anonymizer that customers can use to anonymize their data offline.

5. Your rights

Depending on location, individuals in the EEA, the UK, and across the globe may have certain statutory rights in relation to their Personal Information. For example, you may have the right to:

Access your Personal Information.
Delete your Personal Information.
Correct or update your Personal Information.
Transfer your Personal Information elsewhere.
Withdraw your consent to the processing of your Personal Information where we rely on consent as the legal basis for processing.
Object to or restrict the processing of your Personal Information where we rely on legitimate interests as the legal basis for processing.

You can exercise these rights by sending your request to security@qinsights.ai.

6. Children

Our Service is not directed to children who are under the age of 13. QInsights B.V. does not knowingly collect Personal Information from children under the age of 13. If you have reason to believe that a child under the age of 13 has provided Personal Information to QInsights B.V. through the Service please email us at security@qinsights.ai. We will investigate any notification and if appropriate, delete the Personal Information from our systems. If you are 13 or older, but under 18, you must have consent from your parent or guardian to use our Services.

7. Links to other websites

The Service may contain links to other websites not operated or controlled by QInsights B.V., including social media services ("Third Party Sites"). The information that you share with Third Party Sites will be governed by the specific privacy policies and terms of service of the Third Party Sites and not by this Privacy Policy. By providing these links we do not imply that we endorse or have reviewed these sites. Please contact the Third Party Sites directly for information on their privacy practices and policies.

8. Security and Retention

We implement commercially reasonable technical, administrative, and organisational measures to protect Personal Information both online and offline from loss, misuse, and unauthorised access, disclosure, alteration, or destruction. However, no Internet or email transmission is ever fully secure or error free. In particular, email sent to or from us may not be secure. Therefore, you should take special care in deciding what information you send to us via the Service or email. In addition, we are not responsible for circumvention of any privacy settings or security measures contained on the Service, or third party websites.

We'll retain your Personal Information for only as long as we need in order to provide our Service to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations. How long we retain Personal Information will depend on a number of factors, such as the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorised use or disclosure, our purpose for processing the information, and any legal requirements.

We may also anonymise or de-identify your Personal Information (so that it can no longer be associated with you) for research or statistical purposes, as described above, in which case we may use this information indefinitely without further notice to you.

9. International Users

QInsights B.V. is established in the Netherlands. Customer Content uploaded to the QInsights application is processed within the European Union.

Other categories of Personal Information may be processed outside the European Economic Area: contact, communication and customer relationship data may be stored in Canada through our customer relationship management provider; and purchase, billing and transaction information is processed in the United Kingdom by Paddle, which acts as our Merchant of Record.

If you believe that we have not adequately addressed a privacy concern, you have the right to lodge a complaint with the Dutch Data Protection Authority or with the competent supervisory authority in your country.

International Data Transfers

Where Personal Information is transferred outside the European Economic Area, QInsights relies on a legally recognised transfer mechanism.

Certain contact and communication data may be processed in Canada. Where the relevant Canadian provider is subject to Canada's Personal Information Protection and Electronic Documents Act, the transfer is covered by the European Commission's adequacy decision for qualifying Canadian commercial organisations.

Purchase, billing and transaction information is processed by Paddle in the United Kingdom. The United Kingdom is currently recognised by the European Commission as providing an adequate level of protection for personal data.

Where an adequacy decision does not apply, QInsights uses appropriate safeguards, such as the European Commission's Standard Contractual Clauses or another legally recognised transfer mechanism.

10. Cookies and Similar Technologies

This section applies to the public QInsights website at qinsights.ai. It explains how QInsights B.V. uses cookies and similar browser technologies, why we use them, and how visitors can manage their choices.

Cookies are small files stored on a visitor’s device. Similar technologies, such as local browser storage, can also be used to remember information between visits.

10.1 Necessary Technologies

We use necessary technologies to operate the website, maintain security and remember visitors’ privacy choices. These technologies do not require consent where they are strictly necessary for providing the website or a service requested by the visitor.

The website stores the visitor’s cookie and privacy preferences in local browser storage under the name qinsights-consent-v1. This preference is retained for six months. After that period, the website asks the visitor to make a new selection.

10.2 Google Analytics

With the visitor’s consent, we use Google Analytics 4 to understand how the QInsights website is used. Google Analytics helps us measure information such as:

pages visited;
time and date of visits;
interactions with pages and links;
referring websites;
browser, operating-system and device information;
approximate geographical location; and
aggregated patterns of website use.

Google Analytics uses first-party cookies, including:

_ga, which distinguishes visitors and is normally retained for up to two years; and
_ga_HHNP02DHDG, which maintains session information for our Google Analytics property and is normally retained for up to two years.

Google Analytics is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For visitors in the European Union, Google states that individual IP addresses are not logged or stored. IP information is used to derive approximate geographical information before being discarded.

The legal basis for using Google Analytics is the visitor’s consent under Article 6(1)(a) GDPR and the applicable rules governing cookies and similar technologies.

Further information is available in the Google Privacy Policy and Google’s information about data and privacy in Google Analytics.

10.3 Google Tag Manager

We use Google Tag Manager to manage the Google Analytics tag on the website. Google Tag Manager is not used to create advertising profiles. Under our current configuration, Google Tag Manager and Google Analytics are loaded only after the visitor has consented to Analytics.

Advertising storage, advertising user data and personalised advertising are disabled. We do not currently use Google advertising tags or a Meta Pixel.

If we add further analytics or advertising technologies in the future, we will update this policy and the consent settings before activating them.

10.4 External Media

Some pages contain videos hosted by YouTube. These videos are embedded using YouTube’s privacy-enhanced mode and remain blocked until the visitor consents to External Media.

If consent is given and a video is loaded, YouTube may store or access information on the visitor’s device and receive information about the visit. YouTube is a service provided by Google. More information is available in the Google Privacy Policy.

10.5 International Data Processing

Information collected through Google Analytics or YouTube may be processed outside the European Economic Area, including in the United States.

Google describes the safeguards it uses for international transfers, including the EU–US Data Privacy Framework and the European Commission’s Standard Contractual Clauses. Further information is available in Google’s data-transfer framework information.

10.6 Managing or Withdrawing Consent

Optional analytics and external-media services remain disabled until the visitor gives consent.

Visitors can:

accept all optional services;
reject all optional services; or
select Analytics and External Media separately.

Consent can be changed or withdrawn at any time by selecting Cookie settings in the website footer. Withdrawing consent does not affect the lawfulness of processing that took place before consent was withdrawn.

Visitors can also delete cookies and local-storage information through their browser settings. Deleting the stored privacy preference will cause the website to request a new selection on the next visit.

11. Sub-processors

See the Compliance document.

12. Changes to the privacy policy

We may change this Privacy Policy at any time. When we do, we will post an updated version on this page. When required by law, we will provide additional notice or request renewed consent before changes affecting consent-based processing take effect.

13. How to contact us

Please contact support or security@qinsights.ai if you have any questions or concerns not already addressed in this Privacy Policy.

Updated August 2026