Privacy Policy

Scope & Legal Roles (Data Controller vs. Data Processor)

This Privacy Policy governs data processing activities performed by Qubelex Private Limited ("Qubelex", "we", "us", or "our").

• Qubelex as a Data Controller / Data Fiduciary: We control personal data directly provided by account registrants, billing contacts, site visitors, and direct communications.
• Qubelex as a Data Processor: For data uploaded or hosted by business clients within our SaaS applications ("Customer Data"), Qubelex processes such data strictly on behalf of customers according to contractual instructions and applicable Data Processing Agreements (DPAs).

Information We Collect

We collect and process the following categories of data:

• Account & Identification Data: Names, business emails, contact details, organization details, and hashed authentication credentials.
• Billing & Financial Data: Business identification/tax numbers (e.g., GST/PAN), invoicing addresses, and transaction histories. Payment card details are processed directly by PCI-DSS compliant payment gateways and are never stored on our infrastructure.
• Technical & Telemetry Data: IP addresses, browser specs, device identifiers, application logs, feature usage analytics, and error tracking metrics.

Legal Bases for Processing

We process personal information under valid legal frameworks:

• Contract Performance: Necessary to register accounts, deliver SaaS operations, and manage subscriptions.
• Legitimate Interests: To detect security threats, prevent unauthorized system access, fix technical bugs, and improve application security.
• Consent: For marketing updates or non-essential analytical cookies (which can be withdrawn at any time).
• Statutory Obligation: To fulfill accounting, tax, and regulatory compliance duties.

Data Sharing & Sub-Processors

We do not sell, license, or trade personal data. Data is shared only with trusted infrastructure providers and sub-processors necessary to run our platforms, including:

• Cloud hosting, compute, and serverless database infrastructure providers.
• Transactional email deliverability partners.
• Billing and payment processing gateways.

Artificial Intelligence (AI) Policy

Our SaaS tools may feature automated data parsing or AI enhancements. We do not use customer proprietary data or content hosted in our SaaS apps to train public foundational AI models without explicit opt-in authorization.

Data Retention & Erasure

We retain personal information only for as long as required to fulfill operational purposes or legal mandates. Upon account cancellation:

• Active application data is retained for 30 days to support recovery requests, after which permanent deletion is executed.
• Encrypted database backups are overwritten on a rolling 60-day cycle.
• Tax records and transaction invoices are archived for up to 7 years in accordance with applicable tax regulations.

Security Safeguards

We utilize administrative, physical, and technical safeguards, including TLS 1.3 encryption for data in transit, AES-256 encryption at rest, strict access role separation, and vulnerability assessments to protect system integrity.

Children’s Information Safeguards

Our SaaS solutions are intended exclusively for commercial, corporate, and professional operations. We do not knowingly gather data from minors under 18 years of age.

Your Statutory Rights

Depending on your jurisdiction (e.g., under GDPR, CCPA/CPRA, or India DPDP Act), you maintain specific rights including:

• Right to access and export a copy of your personal data.
• Right to rectify inaccurate or incomplete records.
• Right to request deletion ("Right to be Forgotten").
• Right to revoke processing consent.

Grievance Contact Information

For privacy queries, data access requests, or regulatory escalations, contact our designated privacy team:

Privacy & Data Protection Officer
Qubelex Private Limited
Hyderabad, Telangana, India
Email: hi@qubelex.com

Contact form abuse prevention

When you use our contact form, Cloudflare Turnstile helps distinguish genuine submissions from automated traffic. The challenge may process browser and device signals needed for that security function, and our server sends the verification token to Cloudflare for validation. We use the result to decide whether to accept the enquiry. The form details you type are sent to Qubelex for us to respond; they are not included in the Turnstile verification request. If the secure form is unavailable, you may email hi@qubelex.com directly.