Privacy Policy

For your account, billing, usage and technical data, inquisflow is the controller (the party that decides why and how the data is processed). Address: Rruga C, 10000 Prishtinë, Kosovo. Privacy contact: contact@inquisflow.com.

For personal data contained in the documents and questions you submit (Customer Content), you decide what is uploaded and why. In that case we act as your processor, and process it only to provide the Service to you, on your instructions.

Paddle, our merchant of record, is an independent controller of the payment and tax data it collects when you purchase (see Section 4).

We do not knowingly collect special categories of personal data and ask you not to upload them (see Terms, Section 5.5). We do not use advertising trackers, analytics scripts or social-media pixels on our website or application.

No model training, no selling. We do not use Customer Content to train AI models, we do not sell personal data, and we do not share it for cross-context behavioural advertising.

No automated decisions with legal effect. Output is generated by AI to help you search your own documents. We do not make decisions about you with legal or similarly significant effects based solely on automated processing.

Our AI provider processes data through its business API. By default that service does not use API inputs and outputs to train its models, and it may retain them for a limited period for abuse monitoring under its own policies. We send only the passages and questions needed to answer each request.

We may also disclose personal data (a) where required by law, court order or a valid request from a public authority; (b) to protect the rights, safety and security of users, the public or us; (c) to a buyer or successor in a merger, acquisition or sale of assets, in which case we will tell you before your data becomes subject to a different privacy policy; and (d) with your consent or at your direction.

Production data is hosted in the United States (US East, Virginia). Some providers, including our AI provider and payment processor, process data in other countries, including the United States.

Where personal data from the European Economic Area, United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum or IDTA), or the EU-US Data Privacy Framework where the recipient is certified. You can request a copy of the relevant safeguards at contact@inquisflow.com.

We use technical and organizational measures designed to protect personal data, including:

We do not currently claim any third-party security certification (such as SOC 2 or ISO 27001). No system is completely secure. If a breach affects your data we will notify you and the relevant authorities where the law requires.

We use only strictly necessary cookies to sign you in and keep your session secure. We do not use advertising, analytics or tracking cookies, so no cookie consent banner is required for our own site.

When you go through checkout, Paddle's pages may set their own cookies under Paddle's cookie notice. Google may set cookies when you use Google sign-in. Blocking strictly necessary cookies will prevent you from signing in.

Our site also keeps a few settings in your browser's own storage. They stay on your device and are never sent to us: whether you have visited our homepage before (so that typing our address again opens the app directly), how you arranged the app's sidebars, and, while you sign in, the page to return to afterwards. You can clear them at any time in your browser settings.

Depending on where you live, you may have the right to: access your personal data; correct it; delete it; restrict or object to its processing; receive it in a portable format; withdraw consent you gave; and lodge a complaint with your local data protection authority.

To exercise a right, email contact@inquisflow.com from your account address. We may need to verify your identity. We respond within one month (or the period your law sets) and do not charge a fee unless requests are manifestly excessive. You can also delete documents, conversations and projects yourself in the application.

If we process Customer Content for a business customer, we will forward rights requests about that content to the customer and help them respond.

In the past 12 months we have collected the categories of information listed in Section 2 for the purposes in Section 3. We do not sell personal information and do not share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes beyond providing the Service.

Residents of California and other US states with privacy laws may request to know, access, correct or delete their personal information, and may appoint an authorized agent, by emailing contact@inquisflow.com. We will not discriminate against you for exercising these rights.

The Service is intended for business and professional use by adults. It is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact contact@inquisflow.com and we will delete it.

If you use the Service for your organization and need a data processing addendum, email contact@inquisflow.com. As processor we will process Customer Content only on your documented instructions, keep it confidential, apply the security measures in Section 7, use the sub-processors listed in Section 4, help you respond to rights requests, notify you of personal data breaches without undue delay, and delete or return Customer Content when the agreement ends.

We may update this Policy. For material changes we will notify you by email or in the application at least 30 days before they take effect. The version number and effective date at the top of this page show when it was last revised.