Privacy Policy

Account and Organization Information

When you register, we collect your full name, email address, organization name, company legal name, address, country, industry type, and role. We may also collect company size, facility location, and timezone to configure the Service for your operations.

Employee Personal Data

Subscribers enter information about their workforce into the Service. This may include:

• Employee names, employee codes, roles, and department assignments
• 4-digit PINs used for kiosk/floor station authentication
• Attendance records, shift schedules, and check-in/check-out timestamps
• Profile photographs (if uploaded by the Subscriber)
• Performance data generated through the Service (QC entries, work order assignments)

Important: The Subscriber, as the data controller, is responsible for obtaining all necessary consents and legal bases for processing its employees' personal data through the Service.

Production and Quality Control Data

The core of the Service involves managing manufacturing data, including:

• Work orders, batch records, and production schedules
• QC inspection entries, test results, pass/fail determinations, and deviations
• Product specifications, recipes, BOM/formulations, and manufacturing parameters
• Supplier information, certifications, raw material lot records, and performance data
• Machine records, maintenance logs, and environmental monitoring data
• Non-conformance reports, CAPA records, complaints, and corrective action documentation
• Documents uploaded to the document management system

Usage and Technical Data

We automatically collect technical information about your interactions with the Service:

• Login timestamps, session duration, and access patterns
• Features used, pages visited, and search queries
• Device information (operating system, browser type, device model)
• IP addresses and approximate geographic location
• Audit trail events (who changed what, when)

AI Interaction Data

When you use QuaBook's AI-powered features, we process:

• Queries and prompts submitted to AI features
• Context data (QC results, production metrics) used to generate insights
• AI-generated reports, anomaly alerts, and recommendations
• Feedback on AI outputs to improve model accuracy

Cookies and Tracking Technologies

We use essential cookies for authentication and session management, preference cookies to remember your settings, and analytics cookies to understand usage patterns. We do not use advertising or tracking cookies. See Section 8 for full details.

Service Delivery

We process your information to provide the Service: operating the platform, processing QC entries, managing work orders, generating reports, maintaining audit trails, and enabling kiosk/floor station functionality.

AI-Powered Features

We process production and QC data through our AI models to identify trends, detect anomalies, predict potential issues, and generate recommendations. AI outputs are informational only and do not constitute food safety or regulatory advice.

Service Improvement

We analyze aggregated and anonymized usage patterns to improve platform features, performance, and user experience. Individual Subscriber Data is not used for this purpose without anonymization.

Communications

We use your email address for account notifications, service announcements, security alerts, and billing information. Marketing communications are only sent with your opt-in consent.

Legal Compliance and Security

We may process information to comply with legal obligations, respond to lawful requests, enforce our Terms of Service, investigate fraud or security threats, and protect the rights and safety of our users.

We Do Not Sell Your Data

The Company does not sell, trade, or rent personal information or Subscriber Data to third parties. Your production records, QC data, employee information, and operational data are not monetized.

Sub-Processors

We use trusted third-party sub-processors to operate the Service. These include:

• Cloud hosting and infrastructure providers (data storage and compute)
• Authentication and identity services
• Email delivery services
• Payment processing (Stripe — we do not store credit card numbers)
• Analytics and error monitoring tools

All sub-processors are bound by Data Processing Agreements that require them to protect data confidentiality and security. A current list of sub-processors is available upon request.

Legal Requirements

We may disclose information when required by law, court order, subpoena, or government request. We will make reasonable efforts to notify the Subscriber of such requests unless legally prohibited.

Business Transfers

In the event of a merger, acquisition, or sale of assets, Subscriber Data may be transferred as part of the transaction. We will notify affected Subscribers before any such transfer and provide an opportunity to export data.

Infrastructure

Data is hosted on secure, redundant cloud infrastructure with automatic backups. The primary data centers are located in Singapore. If your organization requires data residency in a specific region, please contact us to discuss available options.

Security Measures

We implement industry-standard security measures including:

• AES-256 encryption for data at rest
• TLS 1.2+ encryption for data in transit
• Bcrypt hashing for PINs and passwords (no plaintext storage)
• Role-based access controls and tenant isolation
• Audit logging of all data access and modifications
• Regular security assessments and vulnerability scanning
• Rate limiting and brute-force protection on authentication endpoints

Tenant Isolation

Each Subscriber's data is logically isolated within our multi-tenant architecture. Data from one organization is never accessible to another organization. All database queries are scoped to the authenticated organization.

Access Controls

Access to Subscriber Data by Company employees is strictly limited to authorized personnel who require it for support and service operations. All employees are bound by confidentiality obligations. Access is logged and monitored.

Active Subscriptions

We retain all Subscriber Data for the duration of the active subscription. This includes historical records, audit trails, and archived data to support regulatory compliance requirements.

Post-Termination

Upon subscription termination:

• Subscriber has thirty (30) days to request a data export in standard machine-readable formats
• After the 30-day export window, all Subscriber Data is permanently deleted within ninety (90) days
• Backup copies may persist for up to ninety (90) days as part of standard infrastructure retention, after which they are securely destroyed
• Anonymized, aggregated data that cannot identify the Subscriber may be retained indefinitely

Legal Holds

We may retain specific data beyond the standard retention periods if required by applicable law, regulation, or a valid legal process (e.g., litigation hold).

Essential Cookies

Required for the Service to function: authentication tokens, session management, and CSRF protection. Cannot be disabled.

Preference Cookies

Remember your settings, language, display preferences, and saved filters.

Analytics Cookies

Used to understand usage patterns and improve the Service. You can opt out of analytics tracking without affecting core functionality. We do not use advertising or cross-site tracking cookies.

Managing Cookies

You can control non-essential cookies through your browser settings. Blocking essential cookies may prevent the Service from functioning properly.

For Subscriber Employees

If you are an employee whose data has been entered into QuaBook by your employer, you should direct privacy requests to your employer (the Subscriber), who is the data controller. We will cooperate with the Subscriber to fulfill such requests in accordance with applicable law.

GDPR (EU/EEA Users)

Users in the European Union and European Economic Area have rights under the General Data Protection Regulation, including the right to lodge a complaint with a supervisory authority. To exercise your GDPR rights, contact us at privacy@quabook.com.

PDPO (Hong Kong Users)

Users in Hong Kong have rights under the Personal Data (Privacy) Ordinance (PDPO), including the right to access and correct personal data. Requests may be directed to privacy@quabook.com.