QLM Privacy Policy

This Privacy Policy explains how your personal data is collected, obtained, used, shared, stored, retained, or deleted when you use QLM. It also explains your rights and the choices available to you in relation to that data.

In this Policy, we, VARIANCE INTERNATIONAL FOR TRAINING AND DEVELOPMENT and its subsidiaries or sister companies, are referred to as "Qriib," "Variance," "we," or "us," as the context requires. The words "you," "User," "Customer," "your," or "to you" refer to the individual or organization that accesses or uses QLM or allows End Users to use it.

This Policy is a QLM-specific Privacy Policy. It supplements the general Qriib Privacy Policy and does not replace it.

The general Qriib Privacy Policy covers processing shared across the ecosystem, such as certain account, device, billing, security, cookie, and shared service data.

This Policy explains more specifically how data associated with the use of QLM is processed, including:

Inputs and Outputs;

conversations and files;

Memory and knowledge;

agents and automation;

Connected Services;

artificial intelligence models and their providers;

projects and Workspaces;

and enterprise use.

When this Policy addresses a matter specific to data processing within QLM, its more specific provisions apply to that processing, subject to applicable law and other applicable agreements and policies.

This Policy does not, in itself, constitute general consent to all types of data processing. If a particular processing activity requires specific consent, separate permission, an express choice, or another action under the law, that requirement must be satisfied separately.

• Scope of the QLM Privacy Policy and Its Relationship with the Qriib Ecosystem

QLM is one of the artificial intelligence services provided within the Qriib ecosystem and is provided by VARIANCE INTERNATIONAL FOR TRAINING AND DEVELOPMENT. This Policy applies to the processing of personal data associated with the use of QLM through the Service's official websites, applications, interfaces, application programming interfaces, tools, or functions.

Depending on what is available to you from time to time, QLM's functions may include conversation, writing, editing, and rephrasing; translation, research, and analysis; processing of files and documents; generation of text, images, audio, video, and code; Memory, knowledge, and knowledge bases; projects and Workspaces; Agents and automation; connected accounts and services; and any other functions provided through QLM.

The types of data we process and how we process them depend on the functions you choose to use, your account or Workspace settings, the permissions you grant, and the services or accounts you choose to connect to QLM. Mentioning a particular function in this Policy does not mean that it is available to all users, plans, countries, or accounts.

Who Is Responsible for Processing Your Data?

When we determine the purposes and means of processing personal data associated with QLM, we act as the data controller. Depending on the nature of the processing, this usually applies to the data we process to:

manage your account and our relationship with you;

operate the Service;

manage subscriptions and billing;

provide support;

protect accounts and systems;

prevent fraud and abuse;

and comply with legal obligations.

If, however, you use QLM through a company, school, or other entity, or an enterprise Customer uses QLM to process the data of its employees, users, or customers and determines the principal purposes and means of that processing, the processing is carried out in accordance with the Customer's documented instructions and the agreement concluded with it.

The enterprise Customer, as the data controller where this is the correct legal characterization, is responsible for:

determining the legal basis for processing;

providing the necessary privacy notices;

obtaining the required consents or permissions;

and responding to data subjects' rights.

We process the data on its behalf and in accordance with its instructions and the applicable legal and contractual obligations.

In some cases, we may be a controller of certain data and a processor of other data within the same relationship. For example, we may process account, security, or billing data as a controller, while processing content or data submitted by an enterprise Customer through a Workspace as a processor on its behalf. Each party's role is determined by the nature of the data, the purpose of its processing, and the applicable agreement.

Data We May Collect or Process

The data we process depends on how you use QLM, the functions you choose, your account or Workspace settings, and the services you connect to the Service. It may include the following categories:

Account and Identity Data

This may include, for example, your name, email address, account identifier, username, account picture or avatar, language and preferences, login and authentication information, and account status and entitlements.

Organization, Workspace, and Subscription Data

This may include, for example, the organization or Workspace name, membership, roles and permissions, the account owner or administrators, users associated with the Workspace, resource usage data, Qredits when used, subscription data, and related billing records.

Inputs and User Content

We may process the content you submit or direct QLM to use, such as instructions, requests, and conversations; text; documents; images; audio and recordings; video; files; code; data and tables; content stored in knowledge bases; and information you direct QLM to retrieve from a Connected Service. This content may contain personal data concerning you or other persons.

Outputs

We may process the Outputs generated by QLM based on your instructions, content, or the available context, such as text, images, audio and video, documents, analyses, summaries, code, search results, and the results of actions performed by an Agent or Automation.

Memory and Knowledge Data

If you use Memory or personalization functions, we may process or retain information such as preferences, instructions, context, information you ask to be saved, knowledge associated with a project or Workspace, or information saved for use in subsequent interactions.

Memory may be personal or associated with a project, Workspace, or organization.

Connected Service and Account Data

If you choose to connect QLM to an external account, application, or service, we may process authorization data, the scope of permissions, the connected account identifier, data that the service allows to be made available, retrieved files, messages, or information, and the results of actions performed through the Connected Service.

Connecting a service does not mean that we automatically obtain all the data held in it. The scope of access depends on the permissions you grant and the nature of the integration.

Usage and Technical Data

This may include, for example, your IP address; device type and operating system; browser or application type and version; access times; functions used; error logs; task execution status; technical logs; crash and diagnostic information; security and abuse signals; and data necessary to operate the Service and measure usage.

3.8 Financial Data

This includes, for example, invoices, balances, transaction history, and analyses or classifications generated from this information. Please note that we do not collect financial data from you separately or independently outside the scope of the content.

3.9 Health Data

This includes, for example, personal information that identifies or can reasonably be linked to an individual and reveals information about their past, present, or future physical or mental health, including health activity, heart and respiratory health, body measurements, walking and movement, sleep, mindfulness, exercise, or other health information. We process health data only to the extent that you choose to provide it through requests, conversations, uploads, or other Inputs, or, where supported, direct us to access it through a connected account. Information generated by the Service that reproduces, summarizes, or analyzes the health data you provide may also constitute health data.

Derived Data

If you use certain features of the services, such as converting images into videos, videos into new or different videos, persons into avatars, or uploading audio or sound clips, we may derive certain information from images of persons or from audio or sound clips to provide those features. We do not use this data to uniquely identify any individual. We will use and share this derived data only for limited purposes, as explained in the sections "How We Use Your Personal Information" and "How We Share Your Personal Information" below.

Third-Party Credentials

If you choose to use a supported feature that allows you to save credentials for a third-party account, we collect the account identifier or username, password, or any other authentication credentials you provide for that account ("Third-Party Credentials"). We use Third-Party Credentials only to authenticate with the relevant third-party account and perform the specific functions or actions you request through the Service.

Third-Party Login and Linking Services

These include services such as Google or Apple that you use to log in to or link to your Service

account, including when you use or direct the Service to use your third-party accounts. This data may include your username and other information associated with your account on that external service that is available to us based on your account settings on that service.

3.13 Support and Communication Data

If you contact us, we may process, where necessary, your name and contact details, the content of your message, files or information you send to support, and any information necessary to handle your request.

Other Data

This includes data not specifically listed here, including, without limitation, data you provide to us or allow us to collect through or in connection with the services, which we will use as described in this Privacy Policy or as disclosed at the time of collection.

Where Do We Obtain Your Data?

By agreeing to this Policy, you acknowledge that you understand that we may obtain data:

directly from you when you use QLM, upload content, or provide instructions;

from your Qriib account when you log in or manage entitlements;

from the organization or Workspace administrator if you use QLM through an organization;

from an external service or account you have chosen to connect to QLM;

from a model or tool provider involved in executing your request;

from the operation of QLM itself, such as logs, Outputs, and task status;

or from service providers acting on our behalf.

If you direct QLM to access data from a third party or Connected Service, you are responsible for ensuring that you have the right, authority, or legal basis necessary to grant that access.

How Do We Use Your Data or Information?

We may use your data or information for the following purposes:

Providing and Operating the Service, Including, for Example

Processing your requests, generating Outputs, analyzing files, operating Memory, searching and retrieving information, operating agents and automation, performing actions you request, connecting QLM to the services you choose to use, communicating with you about the Service, including sending service-related announcements, updates, security alerts, and support and administrative messages, providing support, and responding to you.

Account and Subscription Management

This includes login, entitlement management, Workspace management, billing, Qredits, and support.

5.3 Personalizing Your Experience (Service Personalization)

Depending on the available functions and your settings, we may use data to:

remember your preferences and understand your interests, use Memory, personalize Outputs, or draw on previous context when these functions are enabled.

5.4 Security and Abuse Prevention

We may process certain data to:

protect accounts, detect fraud, prevent unauthorized use, investigate reports, enforce the QLM Acceptable Use of Artificial Intelligence Policy, respond to security incidents, and protect users, the Service, and third parties.

5.5 Service Improvement and Analytics

We may use usage data, technical information, and aggregated or de-identified data to:

understand QLM's performance, detect faults, analyze your use of the Service, improve the Service, improve the rest of our business, help us understand users' activity on the Service, including which pages receive the most visits and how visitors navigate the Service, as well as users' interactions with our emails, and develop new products, services, and functions;

This differs from using Customer Content to train general-purpose artificial intelligence models, as we explain later in this Policy.

5.6 Compliance and Protection

We may process or use data:

to comply with the law; respond to a valid request from a competent authority; establish, exercise, or defend a legal right; maintain records required by law; protect our rights, our users, or third parties; audit our internal operations to ensure compliance with legal and contractual requirements or our internal policies; and prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical, or unlawful activities, including cyberattacks and identity theft.

5.7 Marketing and Advertising

We may send you direct marketing communications and may personalize these messages based on your needs and interests.

Creating a QLM account, using the Service, or providing us with an email address does not constitute automatic consent to all types of marketing.

You may unsubscribe from marketing messages using the available means. We will continue to send necessary messages concerning your account, security, billing, or operation of the Service.

5.8 Creating Aggregated, De-identified, and/or Anonymous Data

We may create aggregated, de-identified, and/or anonymous data from your personal information and the information of other individuals whose personal information we collect. We may convert personal information into de-identified and/or anonymous data by removing the information that makes the data capable of identifying you. We may use this data to analyze, improve, develop, and protect the Service, including developing and improving our models and related technologies. We may share this data with service providers that process it on our behalf and with other third parties, where the data has been aggregated, de-identified, and/or anonymized in accordance with applicable law.

Legal Bases for Processing Your Data

Not all processing of your data relies on your consent. The legal basis varies according to the purpose, the nature of the data, and applicable law. Depending on the circumstances, the legal bases may include:

performing a contract or taking steps connected with it, such as processing data necessary to provide QLM;

fulfilling a legal or regulatory obligation;

exercising or protecting legitimate rights to the extent permitted by law;

protecting security and safety and preventing fraud and abuse;

consent when the law requires it;

or any other legal basis permitted by applicable law.

When consent is the legal basis for processing, we seek to ensure that it is clear, specific, and demonstrable. You may withdraw your consent for the future in accordance with the law, without affecting the lawfulness of processing carried out before its withdrawal.

Your Content and Connected Services

• You retain the rights you hold in your content under the QLM Terms of Use and applicable law. By using QLM, you acknowledge that you are responsible for the content and data you submit to the Service or direct QLM to access, use, or process, and for ensuring that you have the rights, licenses, permissions, or legal bases necessary to do so.

• If you submit, or direct QLM to process, personal data concerning another person, you are responsible, as required by law, for providing the necessary notice to that person and obtaining their consent when required, or ensuring that another legal basis permits you to submit that data or make it available to QLM.

• We process your content and Inputs to the extent necessary and permitted to provide the function you requested, carry out your instructions and the permissions you granted, generate Outputs, operate the functions you selected, protect the Service and prevent its abuse, comply with legal obligations, or for any other disclosed purpose supported by an appropriate legal basis.

• Allowing QLM to process your content does not grant us a general right to sell or publish it, use it as a standalone product, or use it for purposes that are undisclosed or not permitted under this Policy.

Memory and Saved Context

• If you enable Memory functions, QLM may retain certain information, context, preferences, instructions, or knowledge for use in subsequent conversations or tasks, in accordance with the Service's settings and the functions available to you.

• Memory may be technically independent of conversation history, files, projects, or knowledge bases. Accordingly, deleting a conversation, file, or project does not necessarily automatically delete information stored independently in Memory. Similarly, deleting information from Memory does not necessarily delete other copies that may lawfully exist in another part of the Service or in backups.

• Conversations, Memory, files, projects, knowledge bases, and backups may differ in how they are stored, retained, and deleted. When we make tools available for managing Memory, you may use them to review, modify, or delete saved information, subject to the available functions.

Agents, Automation, and Connected Services

• QLM may allow you to use an Agent or Automation to perform a task or series of steps on your behalf. Depending on the functions and permissions you grant, this may include reading files, retrieving information, processing content, creating or modifying files, sending data or communications, or performing actions within a connected service or account.

• QLM's use of this data and performance of these actions are limited to the scope of the function you requested, your instructions, and the permissions you granted, subject to technical and security limitations and applicable policies.

• Granting QLM or one of its agents technical permission to access a service or account does not mean that you have granted unlimited authorization to perform all actions permitted by that access. The scope of execution remains tied to the task, instructions, and permissions granted.

• When you choose to connect QLM to an external account, application, or service, we may send the necessary data to it or receive data from it to the extent necessary to perform the task you requested. That external service may process the data under its own terms and Privacy Policy. We therefore recommend reviewing them before activating the connection.

• Depending on the available functions, you may disconnect the service or withdraw certain permissions you granted. However, disconnecting or withdrawing a permission does not necessarily retrieve data already sent to the external party, delete a copy it has retained under its legal bases and policies, or reverse an action already performed pursuant to your instructions.

Shared Context within the Qriib Ecosystem

Functions may be available that allow QLM to interact with another product within the Qriib ecosystem or draw on shared context, including, depending on what we make available, other services, assistants, or Agents.

The presence of QLM and other products within a single ecosystem does not mean that all QLM data is automatically shared with all Qriib products.

When a particular function relies on transferring or sharing data between QLM and another product, the scope of processing is tied to the function and the applicable permissions and settings.

Additional details may be provided within the product, in the Qriib Trust Center, or in a function-specific notice.

Sensitive Data and Third-Party Data

The content you choose to submit to QLM may contain sensitive or regulated data.

Depending on the law and context, this may include health data, biometric data, financial data, children's data, government identifiers, credentials, trade secrets, highly confidential business information, or information subject to special professional or legal obligations.

The fact that QLM technically allows you to upload a particular type of data does not mean that every function, model, or external provider is suitable or approved to process that category. You must not submit sensitive data to a function or processing path that the law, agreement, or applicable notices do not permit to be used for that type of data.

Some categories of data may require special consent, a permit, an additional legal basis, or particular contractual or technical conditions.

Children's Data

Children's eligibility to use QLM is subject to the QLM Terms of Use. QLM is not intended for independent use by persons under thirteen (13 years of age), except where use involves or takes place through a parent or guardian or a responsible entity, such as a school or educational institution, in accordance with applicable law and requirements.

Permitting use of the Service in a particular context does not mean that all QLM functions or all third-party models or services are suitable or approved for processing children's data.

When a school, institution, or parent or guardian uses QLM to process a minor's data, the responsible party must obtain the consents and permissions and provide the notices and legal bases required by law.

If you believe that a child's data has been processed without authorization, you may contact us by email.

How Do We Share Your Data or Information?

We may share your data, to the extent necessary, with the following categories:

Service Providers and Processors

Artificial intelligence models, hosting and storage, infrastructure, support, security, notifications, analytics, payment, and technical tools necessary to operate the Service.

When these parties act as processors on our behalf, we impose appropriate obligations concerning confidentiality, data protection, and security in accordance with applicable law.

11.2 Subsidiaries and Sister Companies

Data may be shared within the relevant group of companies when necessary to operate the Service, provide integrated functions, or manage our relationship with you, in accordance with this Policy and applicable law.

11.3 Third Parties You Designate (Services You Choose to Connect)

If you ask us to send data to an external service or perform an action through it, we share the data necessary to carry out your request. In that case, the external party may be independently responsible for how it uses the data under its own policy.

11.4 Merchants and Other Payment Participants

For purchases you request, we share the order, delivery, and payment information necessary to complete them with the relevant merchant, payment provider, and, where applicable, the card issuer. To the extent that these parties determine their own purposes for processing, such as payment authorization, fraud prevention, or fulfilling the purchase in full, their own Privacy Policies apply.

11.5 The Organization through Which You Use the Service

If you use QLM through an organization, administrative or shared data may be shared with it in accordance with account settings, roles, and the applicable contract.

11.6 Government Bodies or Authorities

We may disclose data when legally required, in response to a valid request from a competent authority, or when disclosure is necessary to establish, exercise, or defend a legal right or protect persons or the Service, to the extent permitted by law.

11.7 Corporate Transactions

In the event of a merger, acquisition, reorganization, sale, or transfer of all or part of Qriib's or QLM's business, relevant data may be transferred as part of the transaction, subject to applicable legal rights and safeguards.

International Data Transfers

Some QLM functions may require the use of providers, services, infrastructure, or artificial intelligence models located outside your country of residence or outside the Arab Republic of Egypt. As a result, certain data may be processed, stored, or transferred across borders.

We carry out such operations subject to the requirements of applicable law, including any contractual safeguards, technical and organizational measures, consents, permits, or other regulatory procedures that may be necessary.

We do not promise that all QLM data will remain within Egypt or any particular country unless this is expressly announced for a specific service, plan, or processing path.

13. Data Retention, Deletion, and Account Closure

• We retain your personal data only for as long as necessary to provide our services to you or fulfill other legitimate purposes, such as account and subscription management, resolving disputes, protecting the Service and users, maintaining security, and complying with legal, regulatory, and accounting obligations.

• The retention period varies according to the nature of the data, the purpose of its processing, how the Service is used, and your account or Workspace settings. Depending on the circumstances, we may consider the type of data, the purpose of processing, how long the account or subscription remains active, the deletion and retention settings available to you, security requirements and the need to investigate incidents or abuse, legal disputes or claims, legal, accounting, and regulatory obligations, and backup and service continuity requirements.

• Retention periods may therefore differ among data categories, such as account data, conversations, files, projects, Memory, Workspace data, security and technical logs, billing data, and data associated with External Services.

• When the purpose for which the data was collected or processed ends and no legitimate legal basis remains for retaining it, we, as applicable, delete or destroy it, remove its association with the data subject, or convert it into a form that does not identify them, in accordance with the applicable procedures.

13.2 Deletion and Account Closure

Data deletion operations within QLM may be technically and operationally independent of one another. Performing a particular action does not, therefore, necessarily mean that all other deletion actions are performed automatically.

For example, the following operations may be separate: deleting a conversation, deleting a file, deleting a project or knowledge base, deleting information saved in Memory, leaving a Workspace, stopping use of QLM, or deleting the Qriib account in its entirety.

The effects of each action may differ depending on the function, account or Workspace settings, and the technical infrastructure used.

After a deletion or account closure request, some data may remain for a limited period when necessary or legally permitted, including in backups, security or technical logs, billing and transaction records, records necessary to demonstrate fulfillment of the deletion request, or access-restricted systems used for legal, security, or regulatory purposes.

We do not use data retained for these reasons for purposes incompatible with the purpose that justifies its continued retention.

Data previously sent to an external service or connected provider may be subject to separate retention and deletion policies and procedures, depending on that party's role, terms, and Privacy Policy. Deleting data from QLM or disconnecting an external service does not, therefore, necessarily delete copies previously received by the external party when it retains them independently under the law or its applicable policies.

Your Rights and Choices

Depending on the law applicable to you, you may have a number of rights relating to your personal data, including:

knowing whether we process your data and how we use it;

requesting access to your data;

obtaining a copy where the law provides for this;

correcting or updating inaccurate data;

requesting erasure of data in circumstances permitted by law;

requesting restriction of processing;

objecting to certain types of processing;

requesting data portability where applicable;

withdrawing consent when processing is based on it;

exercising rights relating to automated processing or decisions when the law grants you those rights;

and lodging a complaint with the competent data protection authority.

Some of these rights are not absolute and may be subject to legal conditions or exceptions.

To exercise your rights, you may use the available account tools or contact us by email at support@qriib.com.

We may request reasonable and proportionate information to verify your identity or authority before fulfilling the request. If the data concerned is processed on behalf of an enterprise Customer, we may ask you to contact it or cooperate with it to address your request in accordance with the applicable legal relationship.

Security

We implement appropriate technical, organizational, and physical measures designed to protect your personal data and content against unauthorized access, unauthorized use or disclosure, modification, loss, or destruction. No internet-connected service can guarantee absolute security.

15.1 Human Access to Content

Using QLM does not mean that our employees routinely review all of your conversations or content. Limited human access may be permitted when necessary and allowed, such as:

providing support you requested;

investigating a technical problem;

protecting the Service;

investigating fraud or abuse;

handling a report or security incident;

complying with a legal obligation;

or carrying out an approved quality assessment that has been disclosed where necessary.

Access is limited to authorized persons and to the extent necessary for the purpose.

15.2 Automated Safety Systems

We may use automated systems to analyze certain data or content to:

detect fraud;

protect accounts;

detect abuse;

or enforce the QLM Acceptable Use of Artificial Intelligence Policy.

Merely analyzing content that addresses a sensitive subject does not mean that we automatically attribute to the account holder a characteristic or belief mentioned in that content.

Changes to This Policy

We may update this Policy when:

QLM's functions change;

we add new models, providers, or integrations;

processing practices change;

laws or regulatory requirements change;

or we need to improve the clarity of the Policy.

The updated version will be published with the date of the last update and the effective date.

When a change is material or the law requires additional notification, we provide the appropriate notice.

Continued use of QLM does not replace separate consent if the new processing legally requires specific consent.

Contact and Complaints

If you have questions about this Policy, wish to exercise any of your rights, or wish to lodge a complaint concerning QLM's privacy, you may contact us at support@qriib.com.