Privacy Policy

1. Introduction

This Privacy Policy describes how Enqualia (KVK: 97480169), which operates the Enqualia IO platform at enqualia.io, collects, uses, and protects your personal data. We are committed to processing your data in compliance with the General Data Protection Regulation (GDPR) and applicable Dutch privacy laws.

2. Data We Collect

Information you provide:

• Account information (email address, name).
• Project configuration and API settings.
• Payment and billing information processed through secure third-party providers.

Information collected automatically:

• API usage data (request counts, endpoints called, response times).
• Log data (IP addresses, browser type, device information).
• Analytics data for billing and platform performance.

3. Why We Collect Your Data

We process only the data essential for the Platform to function. Specifically, we use your data to:

• Provide and maintain the Enqualia IO platform.
• Manage your account, API keys, and project access.
• Calculate usage, generate invoices, and process payments.
• Monitor platform security and prevent abuse.
• Communicate service updates and important notices.

4. Legal Basis for Processing

Under the GDPR, we process your data based on:

• Consent: You provide explicit consent during account registration to the collection and processing of essential data.
• Contract: Processing is necessary to provide the services you signed up for.
• Legitimate interest: Ensuring platform security and preventing fraud.
• Legal obligation: Compliance with Dutch tax and business regulations.

5. Consent at Sign-Up

When creating an account on the Platform, you are required to consent to the collection and processing of your data as described in this Privacy Policy. You cannot create an account without providing this consent. You may withdraw your consent at any time by deleting your account, though this will result in loss of access to the Platform.

6. Data Sharing

We do not sell your personal data. We share data only with the following categories of sub-processors, solely to operate the Platform:

• Google Cloud Platform / Firebase (hosting, authentication, database storage), EU (europe-west1) where configurable, subject to Google's Standard Contractual Clauses for any processing outside the EEA.
• Google Gemini / Vertex AI (AI model inference for API calls you or your integration make), your prompts and generated outputs are sent to Google's AI infrastructure for processing.
• Stripe (payment processing and billing), may process and store payment data outside the EEA under Stripe's Standard Contractual Clauses.

Where a sub-processor is located outside the European Economic Area, transfers are safeguarded by Standard Contractual Clauses (SCCs) or an equivalent adequacy mechanism recognized under GDPR Chapter V. These providers are contractually obligated to protect your data and process it only for the purposes described here.

We may disclose data if required by law or to protect the rights and safety of Enqualia or its users.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. This includes encryption, secure cloud infrastructure, and access controls.

8. Data Retention

We retain your data for as long as your account is active or as needed to provide the service. Upon account deletion, your personal data will be removed within a reasonable timeframe, unless retention is required by law (e.g., financial records).

9. Your Rights

Under the GDPR, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your personal data.
• Restriction: Request restricted processing of your data.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interest.
• Withdraw consent: Withdraw your consent at any time.

You can exercise the erasure and portability rights yourself, at any time, from your account, go to Settings → Danger Zone to export a machine-readable copy of your data or permanently delete your account. For every other request, contact us at support@enqualia.io.

Automated processing: API calls you or your integration make against the Platform are processed by AI models (Google Gemini / Vertex AI) to generate outputs (e.g. generated images, text, or analysis). This processing is automated and occurs on a per-call basis at your direction; it does not produce legal or similarly significant effects about you as an individual.

If you believe we have not adequately addressed your concern, you have the right to lodge a complaint with your national data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

9a. Children's Privacy

The Platform is not directed at children under 16. In accordance with Dutch implementation of GDPR Article 8, we do not knowingly collect personal data from anyone under the age of 16 without parental or guardian consent. If you are a business client whose end-users may include minors (e.g. via a mobile app integration), you are responsible for obtaining any required parental consent and for configuring your own use of the Platform's APIs accordingly. If you believe a minor has provided us with personal data without appropriate consent, contact support@enqualia.io and we will take steps to remove it.

9b. Google User Data (Gmail integration)

Connecting a Gmail mailbox to an Enqualia project is entirely optional and is started only by a project owner. If you never connect a mailbox, none of this section applies to you and we never request access to your Google account.

What we request, and why

• gmail.readonly: to list messages in the connected mailbox and show you and your workspace assistant their sender, subject, date and body, so it can answer questions about your mail.
• gmail.compose: to save reply drafts into your Drafts folder for you to review.
• gmail.send: to send a draft you have opened, reviewed and explicitly confirmed on the Email page. Sending is always started by a click from a signed-in project owner in a browser; the AI assistant has no ability to send email, and no automated process sends mail on your behalf.

What we store

We store the OAuth refresh token that keeps the connection alive in Google Secret Manager, never in our database exports or logs. Alongside it we store only the connected email address, the granted scopes, the connection date and who connected it. We do NOT store copies of your messages: message content is fetched from Google on demand to answer a request or render a page, and is not retained in our database after the request completes. Message content may appear transiently in the conversation history of the workspace assistant if you asked it to read your mail, which you can delete at any time.

Use with AI models

If you ask the workspace assistant a question about your mail, the content of the messages it reads is sent to the language model provider that powers your project (Google Gemini, or Mistral for EU-hosted projects) in order to produce the answer. These providers process it to serve the request and, under our agreements with them, do not use it to train their models. We do not use Google user data for advertising, we do not sell it, and we do not transfer it to third parties other than the model provider serving your request and the infrastructure providers named elsewhere in this policy.

Limited Use commitment

Enqualia's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google API Services User Data Policy

How to disconnect

You can disconnect a mailbox at any time in Project settings under Email. Disconnecting revokes the token at Google, deletes it from Secret Manager and removes the connection record. You can also revoke access yourself at any time from your Google Account permissions page. myaccount.google.com/permissions

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of the Platform after changes constitutes acceptance of the revised policy.

11. Contact

For privacy-related inquiries, contact us at support@enqualia.io.