Privacy, terms and data processing

1. Privacy notice

Who we are

Quillexa is operated by Adel Janbeih, trading as Quillexa, Casablanca, Morocco. Contact: hello@quillexa.com.

Our role

Our clients are businesses that use Quillexa to process the purchase orders their customers send them. For the orders, documents, catalogues, customer details and review history in a client's workspace, the client is the controller and we are the processor: we handle that data only to provide the service, as set out in the data processing terms below. For the account details of our clients' users, and for free-trial sign-ups, we are the controller.

What we collect

• Account details: name, work email, company name and role. Passwords are stored only as salted scrypt hashes.
• Workspace content: the documents a client uploads, forwards or receives in a connected mailbox folder, the data read from them, catalogues, prices, customer details and the record of who reviewed what.
• Service records: monthly order and AI usage counts for billing, sign-in attempts for security, and technical logs needed to run the service.

Why we use it

To provide and secure the service, to bill for it, and to support our clients. We do not sell data, show advertising or use analytics or tracking cookies.

Cookies

Two cookies, both necessary: a sign-in cookie that keeps you signed in, and a cookie that remembers your language.

AI reading

Documents that need reading by AI are sent to Anthropic's Claude API. Anthropic processes them under its commercial terms and data processing addendum (anthropic.com/legal), which do not allow it to train its models on this content. Every AI reading is checked by rules and approved by the client's team, or by automatic-approval rules the client chooses.

Where data is stored

On servers provided by Oracle Cloud Infrastructure (data centre in Frankfurt, Germany). Each client has a separate database file. Some sub-processors listed below may process data outside the UK and EEA, including in the United States; such transfers rely on their standard contractual clauses or equivalent safeguards.

How long we keep it

• Workspace content is kept while the client's subscription or trial runs. Clients can delete their orders received before any date at any time in Settings.
• When a client leaves, we delete their workspace within 30 days. Backup copies are removed 30 days after they are made.
• Billing records (company name, plan and monthly usage counts) are kept as long as tax law requires.

Your rights

You can ask to access, correct or delete your personal data, or object to its use, by emailing hello@quillexa.com. If the data is in one of our clients' workspaces, we pass your request to that client and help them answer it. You can also complain to your data protection authority, for example the Information Commissioner's Office in the UK.

Security

Encrypted connections (HTTPS), a separate database per client, salted password hashes, sign-in limits, owner and member roles, signed webhooks, and a full record of every change to an order.

2. Terms of service

1. The service. Quillexa reads purchase orders, checks them against the client's catalogue and prices, and produces import files after approval. Plans and prices are on our pricing section. Prices exclude VAT and other sales taxes.
2. Trials and payment. A free trial, where offered, lasts 14 days and needs no card. Paid plans are billed monthly in advance by payment request. You can cancel at any time; the service then runs to the end of the paid month.
3. Your responsibilities. You must have the right to upload the documents and data you send us, keep your passwords private, and review orders before approving and exporting them.
4. AI and accuracy. Reading by AI and by our parser can make mistakes. Quillexa flags what it cannot verify, but it does not guarantee error-free results. Automatic approval is off unless you switch it on, and you are responsible for the rules you set. The optional certified error rate is a statistical estimate from your own checked orders, valid only if future orders resemble past ones. It is not a warranty.
5. Your data. You own your data. You can export approved orders at any time. We handle it as described in the privacy notice and the data processing terms.
6. Availability. We aim to keep the service available and to announce planned maintenance, but we do not promise uninterrupted service unless agreed in writing.
7. Liability. As far as the law allows, our total liability is limited to the fees you paid in the 12 months before the claim, and we are not liable for indirect loss such as lost profit. Nothing limits liability that cannot be limited by law.
8. Changes. We will email you at least 30 days before a material change to these terms. If you do not accept it, you can cancel before it applies.
9. Law. These terms are governed by the law of Morocco.

3. Data processing terms

These terms form the data processing agreement between us and each client for personal data we process on the client's behalf (Article 28 of the UK and EU GDPR). If you need a signed copy, email hello@quillexa.com.

1. We process the data only on the client's documented instructions: using the service and its settings is the instruction.
2. Everyone who can access the data is bound by confidentiality.
3. We apply the security measures listed in the privacy notice.
4. We use only the sub-processors listed below, under written terms that protect the data at least as well. We will email clients at least 30 days before adding or replacing one, and a client may object and cancel.
5. We help the client answer data subject requests and, where needed, with impact assessments.
6. We tell the client without undue delay, and within 48 hours of becoming aware, about a personal data breach affecting their data.
7. When the contract ends, we delete the client's data as described in the privacy notice, unless the law requires us to keep it.
8. We provide the information needed to show we meet these terms and allow reasonable audits on 30 days' notice.

4. Sub-processors