Privacy Policy

This policy explains how QuerySafe handles personal data on querysafe.ai and in QuerySafe services. It also explains when prompts are stored and which AI providers may receive them. A customer agreement, data processing agreement or product-specific notice may provide more specific terms; where it does, those terms govern that deployment.

1. Who is responsible

QuerySafe, based in Noida, India, is the controller for this website, sales enquiries and its own account administration. Contact us at hello@querysafe.ai. When an organization uses QuerySafe to process information for its staff or customers, that organization is usually the controller and QuerySafe acts as its processor under the customer agreement.

2. What we collect

Website and sales information

• Contact and business details you submit, including name, email, company, role, company size, area of interest and guide or newsletter sign-ups.
• The messages, business questions and context you enter in demo or contact forms.
• Technical and security data such as IP address, browser, device, request time, referring page and server logs.
• Consent state and cookieless website measurement signals; with consent, analytics data such as pages viewed, clicks, scroll depth, form events and session-replay interaction data.

Product and service information

• Account details, organization membership, roles, authentication events and subscription information.
• Prompts, questions, messages, conversation history, feedback, uploaded or connected content, and generated responses.
• For data and agent products, approved schema or catalogue metadata, generated queries, tool calls, approvals, outputs and audit records.
• Usage, reliability, safety and billing data, such as feature events, token counts, model selected, errors and diagnostic logs.

Please do not submit special-category, highly sensitive or confidential personal data unless your organization has authorized it and the applicable QuerySafe deployment is configured and contracted to process it.

3. Are prompts stored?

The answer depends on where the text is entered and which product or customer configuration is used:

• Website forms: details entered in demo, contact, newsletter or guide-download forms are stored as submissions and emailed to the QuerySafe team. They are not sent to an AI model by the website form.
• QuerySafe Agent, Buddy and WhatsApp: prompts or messages and responses may be stored to provide conversation history, trace sources, support human hand-off, maintain security and audit records, and improve the customer's configured service.
• QuerySafe Compass: local analysis is designed to minimize sending prompt text to QuerySafe. If a user requests cloud enhancement, the relevant prompt or a masked version may be sent to Google Cloud Vertex AI. Optional submitted-prompt history, when enabled, is stored separately and can be deleted under the applicable product controls.
• Illustrative demos on this website: interactions are local demonstrations and are not submitted as real product prompts.

QuerySafe does not use customer prompts or connected business data to train a general-purpose public model. A customer's settings and agreement determine available history, retention and deletion controls.

4. Which AI providers receive prompts?

Only the provider needed for the selected feature or deployment receives prompt content. Providers may include:

• Google Cloud Vertex AI (Gemini): used for hosted AI processing in QuerySafe services where enabled, including cloud prompt enhancement in Compass.
• OpenAI: used only for a deployment or feature expressly configured to use OpenAI models. It is not the default provider for every QuerySafe service.
• The AI service selected by the user: when Compass is used inside ChatGPT, Claude or Gemini, a prompt submitted on that service is received by OpenAI, Anthropic or Google respectively under the user's or organization's separate agreement with that provider. Installing Compass alone does not submit a draft prompt to those providers.

Product routing and available models can change. For an enterprise deployment, the customer's order form, product settings or data processing agreement identifies the approved provider, region and any subprocessors. We do not sell prompts or connected business data.

5. Why we process data and our lawful bases

• Contract: to provide a requested service, administer an account, support users and bill customers.
• Legitimate interests: to respond to business enquiries, secure and operate services, prevent abuse and improve reliability, balanced against individual rights.
• Consent: for optional website analytics and where another optional use specifically asks for consent. Consent can be withdrawn at any time.
• Newsletter consent: to send requested guides and occasional QuerySafe AI updates. Every marketing message provides an unsubscribe option.
• Legal obligation: to meet tax, accounting, regulatory, security and lawful-request obligations.

6. Who we share data with

We disclose only what is needed to:

• Cloud hosting, database, security and delivery providers, including Google Cloud and Firebase.
• The AI providers described above, when a feature needs model processing.
• Google Analytics for consent-state and cookieless measurement; analytics cookies are used only after consent.
• Mixpanel only after website analytics consent.
• Email and communication providers used to deliver enquiries and confirmations.
• Meta and WhatsApp when a person communicates through QuerySafe for WhatsApp.
• Professional advisers, authorities or another business party where required by law or a corporate transaction.

7. International transfers

QuerySafe is based in India and uses international service providers. Personal data may therefore be processed outside the UK or European Economic Area. Where GDPR or UK GDPR applies, we use an available lawful transfer mechanism, such as an adequacy decision, approved contractual clauses or another legally permitted safeguard. Enterprise customers may request applicable transfer documentation.

8. How long we keep data

• Website enquiries are kept while we respond, manage the relationship and maintain necessary business records, then deleted or anonymized.
• Guide and newsletter sign-up details are kept until you unsubscribe or ask us to delete them, subject to limited suppression records needed to respect that choice.
• Product content and prompts follow the retention period in the customer agreement or product setting and are removed when no longer needed to provide the service.
• Security and audit records are retained for the period needed to investigate incidents, demonstrate authorized use and meet legal obligations.
• Analytics data follows the retention setting in Google Analytics or Mixpanel; the site's consent choice expires after 12 months.
• Backups may retain deleted data for a limited recovery cycle before automatic overwrite, unless preservation is legally required.

9. Security

We use technical and organizational measures appropriate to the data and service, including access controls, encryption in transit, scoped service access, logging and tenant separation. No internet service can guarantee absolute security.

10. Your GDPR and UK GDPR rights

Depending on the law and circumstances, you may request access, correction, deletion, restriction, portability or object to processing. You may withdraw consent without affecting earlier lawful processing. You may also complain to your local data protection authority. We may need to verify identity before acting on a request and normally respond to GDPR requests within one month.

Email hello@querysafe.ai or use the contact page. If QuerySafe processes your data for one of our customers, contact that organization first; we will assist it with the request.

11. Cookies and changes

See our Cookie Policy and use the Cookie settings link in the footer to change analytics consent. We may update this policy when products, providers or legal requirements change. Material changes will be highlighted on this page with a new update date.