Privacy Policy

Welcome to the Qme Privacy Policy!

Qme is operated by AIchatbots SRL, a limited liability company organized under the laws of Romania (“Qme,” “we,” “us,” or “our”). Qme provides a research workspace and a Model Context Protocol (“MCP”) connector that lets AI assistants read, search, and analyze the material in your Qme projects, and that, at your request, retrieves publicly available content from third-party platforms and saves it to your canvases (the “Service”). Capitalized terms not defined in this Privacy Policy have the meanings given in the Qme Terms of Service (“Terms”).

We are committed to transparency in how we handle information relating to identified or identifiable individuals (“Personal Data”). This Privacy Policy describes how we collect, use, disclose, and otherwise process Personal Data and the rights and choices available to you.

PLEASE READ THIS PRIVACY POLICY CAREFULLY. IF YOU DO NOT AGREE WITH IT, PLEASE DO NOT USE THE SERVICE.

Who is responsible for your data

Qme acts in two different roles, and this Privacy Policy treats them differently:

Qme as data controller. Covers your Account and contact details, billing information, support communications, technical and security logs, and similar data we use to run our own business and keep the Service safe. Who decides why and how the data is used: Qme.

Qme as data processor. Covers the content in your workspace (Customer Content), including the publicly available content you ask the Service to retrieve (Source Content), your prompts, and the Output. Who decides why and how the data is used: you (the user), as controller. Qme only processes it on your instructions.

When this Privacy Policy applies

This Privacy Policy applies where Qme acts as a data controller of your Personal Data. This includes when you:

• Visit our website or interact with our branded pages;
• Create or manage an Account or connect an AI Client to the Service;
• Use the Service, with respect to the account, usage, and technical data we collect about you;
• Communicate with us, including through support or other inquiry channels;
• Receive communications from us; or
• Participate in surveys or research that we facilitate.

When this Privacy Policy does not apply

Qme as data processor. When you save, upload, or retrieve content through the Service, including Source Content that contains Personal Data about other people, Qme acts as your “data processor,” not as the “data controller” (as defined by applicable privacy laws), of that Personal Data. We process it under your instructions and on your behalf. This Privacy Policy does not apply to those activities; they are governed by the Data Processing Terms in Annex A to the Terms. If you are an individual whose Personal Data appears in content saved by a Qme user, please see the section “Individuals who appear in retrieved content” below. We are not responsible for our users’ own privacy or data security practices, which may differ from those described here.
‍

Third-party services. The Service interacts with services that we do not control, including AI Clients (such as AI assistants you connect), the Third-Party Platforms from which content is retrieved, and Third-Party AI Providers. This Privacy Policy does not apply to the information practices of those third parties, and we encourage you to review their privacy policies.

Employees and contractors. This Privacy Policy does not apply to Personal Data of our employees, contractors, or job applicants, which is governed by separate notices.

Personal Data we collect

Personal Data you provide to us

• Account and profile information. When you create an Account, we collect your name, email address, and other information you provide, and authentication data such as identifiers and tokens issued when you connect an AI Client to your workspace.
• Billing and payment information. If you purchase paid features, we collect billing details such as your name, billing address, and transaction information. Payments are processed by third-party payment service providers; we do not store full payment card numbers.
• Communications and support information. When you contact us, we collect the content of your communications, your contact details, and anything else you choose to provide.
• Survey and feedback information. When you participate in surveys or provide feedback or testimonials, we collect the information you provide.

Customer Content (processed on your behalf)

When you use the Service, you and your AI Clients create and store content in your workspace. This may include:

• Projects, canvases, nodes, names, descriptions, and text notes you create;
• Prompts you or your AI Client submit to the Service and to Third-Party AI Providers;
• Files and videos you upload;
• Source Content you instruct the Service to retrieve from Third-Party Platforms, such as post text, captions, transcripts, metadata (for example, titles, URLs, publication dates, engagement figures, and usernames), and media files; and
• Output generated by the Service, such as analyses, transcripts, search results, and model responses.

Customer Content may contain Personal Data, including Personal Data of people who created, appear in, or are mentioned in Source Content, depending entirely on what you choose to submit or retrieve. We process Customer Content as your processor, and you decide what it contains.

How the Service retrieves public content

The Service retrieves content only when you or your AI Client request it, only from the URLs, profiles, channels, or communities named in that request, and only if it is publicly available. We do not log in to accounts, bypass paywalls or access controls, or retrieve private content.

Personal Data we collect through automated means

When you use the Service, we automatically collect certain technical and usage information, which may include:

• Device and connection information. IP address, browser or client type and version, operating system, language settings, and approximate location inferred from IP address.
• Tool and usage information. Which tools and functions are called, task identifiers and statuses, timestamps, request metadata (such as the type and number of items requested, and the platform detected from a URL), error messages, feature usage, and quotas used. This information describes how the Service is used. It does not include the content of your prompts, nodes, or Source Content.
• Logs. Connection, request, and security logs used for operation, troubleshooting, and abuse prevention.

Cookies and similar technologies

Our website and web application may use cookies and similar technologies that are strictly necessary for authentication, security, and basic operation. If we use analytics or other non-essential cookies or similar technologies, we will do so only as permitted by law, including by obtaining your consent where required, and you will be able to manage your preferences. You can also control cookies through your browser settings. Blocking strictly necessary cookies may prevent the Service from functioning properly.

Information we do not collect

When you use Qme through an AI Client such as Claude or ChatGPT, we receive only the inputs that the AI Client sends to Qme to carry out your request (for example, a URL, a search query, or a prompt). We do not access, request, or collect your conversation history, the AI Client’s memory or conversation summaries, or files you have uploaded to the AI Client.

We do not intend to collect passwords, API keys or other credentials, one-time codes, payment card data, government identifiers, or health information through the Service, and you must not submit them (see Section 5 of the Terms). We do not engage in behavioral profiling and do not track you across other websites or services.

Personal Data we collect from other sources

• AI Clients and sign-in providers. When you connect an AI Client or sign in through a third-party identity provider, we receive limited information such as your name, email address, and identifiers, as permitted by your settings with that provider and the permissions you grant.
• Payment providers. If you purchase paid features, we receive confirmation of payment and limited billing details.

We may combine Personal Data collected from these sources with information collected through other means described in this Privacy Policy.

How we use your Personal Data

We process your Personal Data (as controller) for the following purposes:

Providing and administering the Service

• Authenticating you, creating and maintaining your Account, and connecting your AI Clients;
• Processing payments and managing your plan, if applicable;
• Providing customer support and responding to your requests and feedback;
• Delivering the functions you or your AI Client invoke, including starting and managing background tasks.

Improving and developing the Service

• Analyzing usage patterns, performance, and errors in order to fix issues and develop new features;
• Testing new features and functionality;
• Conducting research and analysis regarding the use of the Service, based on Usage Data and aggregated or de-identified data.

Security, fraud prevention, and abuse detection

• Monitoring and protecting against unauthorized access, security incidents, fraud, abuse of third-party platforms through the Service, and other malicious, deceptive, or illegal activity;
• Detecting and preventing violations of our Terms and Acceptable Use rules;
• Protecting the rights, property, or safety of Qme, its users, and the public.

Communications

• Sending you service-related messages, such as confirmations, security alerts, and updates to our terms and policies;
• Sending you news, updates, or promotions about the Service where permitted by law, with the opportunity to opt out at any time.

Legal compliance and enforcement

• Complying with applicable laws, regulations, legal processes, and enforceable governmental requests;
• Responding to notices of illegal content and to requests from rights holders, platforms, and individuals;
• Establishing, exercising, or defending our legal rights and enforcing our agreements.

We process Customer Content (as processor) only to provide the Service to you in accordance with your instructions, to keep it secure, and to comply with law, as described in Annex A to the Terms.

Legal bases for processing (EEA, UK, and Switzerland)

If you are located in the European Economic Area (“EEA”), the United Kingdom (“UK”), or Switzerland, we process your Personal Data as controller only where we have a valid legal basis under Regulation (EU) 2016/679 (“GDPR”), as applicable:

• Providing and administering the Service. Legal basis: performance of a contract. Legitimate interest: n/a.
• Improving and developing the Service. Legal basis: legitimate interest. Legitimate interest: understanding how the Service is used and identifying improvements.
• Marketing communications to existing users about similar features. Legal basis: legitimate interest (and, where required, consent). Legitimate interest: keeping existing users informed about the Service.
• Marketing communications to prospective users; non-essential cookies or similar technologies. Legal basis: consent. Legitimate interest: n/a.
• Security, fraud prevention, and abuse detection. Legal basis: legitimate interest; legal obligation. Legitimate interest: maintaining the safety and security of the Service, its users, and third-party platforms.
• Responding to notices, legal compliance, and enforcement. Legal basis: legal obligation; legitimate interest. Legitimate interest: establishing, exercising, or defending legal claims.

Where we rely on legitimate interest, we have assessed that our interests are not overridden by your data protection rights and fundamental freedoms. You have the right to object to processing based on legitimate interest at any time. Where we rely on consent, you may withdraw it at any time by contacting us at hello@qme.ai or by using the relevant functionality (for example, unsubscribe links). Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Artificial intelligence and automated processing

AI is central to how the Service works. In particular:

• AI Clients you connect. When you connect an AI Client (for example, an AI assistant) to your workspace, the AI Client can read the content of your projects, canvases, and nodes and write to them through the tools you permit. Information returned by the Service to an AI Client leaves our control and is handled under the terms and privacy practices of that AI Client’s provider. You decide which AI Clients to connect and can revoke their access at any time.
• Video analysis. When you or your AI Client request video analysis, the video (or its link) and your prompt are sent to Google (Gemini) through Google Vertex AI, which processes the video natively.
• Multi-model comparison (“LLM council”). When you invoke this feature, your prompt and the content of any nodes you select are sent to the third-party AI models you choose, through the providers listed in Annex A (Section A.6) of the Terms.
• Large-content processing (“save tokens”). When you invoke this feature, the content of selected nodes and your prompt are read server-side and processed by an open-source model that you select (or a default), so that large content does not need to be sent to your AI Client. These models run on DeepInfra infrastructure in the United States, and your content is not sent to the model developers’ own services.
• Search. To provide search in your workspace, we generate vector embeddings of your content. Embeddings are used only for search in your Account.
• No training by Qme. We do not use your Customer Content to train generative AI models of our own. We select Third-Party AI Providers and, where available, settings and contractual terms intended to prevent your content from being used to train their models, but we cannot guarantee the practices of every provider.
• No solely automated decisions. We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
• Prompt injection and inaccurate output. Source Content and Output may contain inaccurate information or text designed to manipulate AI systems. Please review Output before relying on it.

These features operate only when invoked by you or by an AI Client acting under your Account.

Permissions the connector requests

When you connect an AI Client, you authorize it through OAuth 2.0 to act in your workspace. With that authorization, an AI Client can: read, list, and search your projects, canvases, and nodes; create projects, canvases, and text nodes; retrieve public content you ask for; run the AI analysis you ask for; and start, check, list, and cancel background tasks. An AI Client cannot delete or overwrite your existing content through the connector. You can revoke an AI Client’s access at any time in your Account settings or by contacting us. Access tokens are deleted when you revoke access or delete your Account.

How we disclose your Personal Data

Service providers (our processors and subprocessors). We share Personal Data with selected third-party providers that help us operate the Service. These include providers of cloud hosting and storage, databases, content retrieval and transcription infrastructure, background task processing, email delivery, payment processing, customer support, security and monitoring, analytics, and legal and professional services. They process Personal Data on our behalf and under our instructions, and are contractually required to protect it.
‍

Third-Party AI Providers. When you invoke AI features, we transmit the necessary Customer Content and prompts to the relevant Third-Party AI Providers, as described above. These providers act as our subprocessors. The subprocessors that process Customer Content are Google (Vertex AI), Microsoft (Azure), DeepInfra, and OpenRouter, as listed in Annex A (Section A.6) of the Terms.
‍

Your AI Clients and Third-Party Services at your direction. We transmit data to AI Clients and other Third-Party Services that you connect to your Account, in accordance with your instructions and permissions.

Protection of Qme and others. We may use or disclose Personal Data if required by law or if we reasonably believe it is necessary to: (a) comply with applicable law, regulation, court order, or other legal process; (b) enforce our agreements; (c) protect the rights, property, or personal safety of Qme, its users, or the public; (d) detect, prevent, or address fraud, security, abuse, or technical issues; or (e) respond to a valid request from a public authority.

Business transfers. If Qme is involved in a merger, acquisition, reorganization, dissolution, sale of assets, or similar transaction, Personal Data may be disclosed or transferred as part of that transaction. We will use reasonable efforts to notify you of any such change and of any choices you may have.
‍

Affiliates. We may disclose Personal Data to current and future affiliated companies and entities under common control, to the extent necessary for the purposes described in this Privacy Policy.
‍

With your consent or at your direction. We may disclose Personal Data to other third parties with your consent or at your direction.

No sale and no advertising. We do not sell your Personal Data, and we do not share it with third parties for cross-context behavioral advertising. The Service does not display advertisements or sponsored content.

Individuals who appear in retrieved content

If content retrieved by a Qme user mentions, shows, or was published by you, that user is the controller of your Personal Data, and Qme processes it only on the user’s behalf. To exercise your data protection rights or to report content you believe was processed unlawfully, contact us at hello@qme.ai with a description of the content and, where possible, the original URL. Where legally permitted, we will forward your request to the relevant user, and we may remove the content or restrict the relevant Account.

How we retain and dispose of your Personal Data

We retain Personal Data for no longer than necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law (for example, tax and accounting obligations or the defense of legal claims).

• Account and billing data: kept while your Account is active. After closure, billing records are kept for 1 year for tax and accounting obligations, and other data needed to defend legal claims is kept for up to 3 years. All other Account data is deleted within 30 days of Account deletion.
• Customer Content: kept while your Account is active or until you delete it. You can delete nodes, canvases, projects, or your whole Account. After you delete an item, it is removed from our systems within 30 days. After Account deletion or termination, all Customer Content is deleted within 30 days and purged from backups within a further 35 days.
• Logs and security data: kept for 90 days, unless needed longer to investigate a specific security incident or case of abuse.
• Support communications: kept for 24 months after the request is closed.
• Access tokens: deleted when you revoke access or delete your Account.

When we no longer have a legitimate business need or legal basis to process Personal Data, we delete or anonymize it. If deletion is not immediately possible (for example, because data is stored in backup archives), we will securely isolate it from further processing until deletion is possible.

Your rights and your choices

Correcting, updating, and accessing

Upon your request and authentication of your identity, we will provide you with information about the Personal Data we hold about you as controller. You may update, correct, or delete information through your Account settings or by contacting us at hello@qme.ai. Requests to access, change, or delete Personal Data will be addressed within 30 days, or earlier if required by applicable law. Where a request is refused, we will notify you in writing, document the reasons, and outline further steps available to you.

Removal and objection

• Marketing emails. You can opt out of marketing emails by using the unsubscribe link in any marketing email. You cannot opt out of certain transactional or service-related communications (such as security notices, billing information, or updates to our legal terms).
• Cookies. You can manage non-essential cookies through the available cookie settings (if offered) or your browser settings.
• AI Client access. You can revoke an AI Client’s access to your workspace at any time.
• Export and deletion. You can export your Customer Content and delete nodes, canvases, projects, or your whole Account at any time in the Service or by contacting us.
• Analytics. Where we use non-essential analytics, you can opt out through the available cookie settings or by contacting us.

International transfers of your Personal Data

Qme is established in Romania, within the European Union. Your Personal Data is maintained and processed by us and our service providers primarily in the European Union and the United States, and may also be processed and stored in other jurisdictions where our service providers or Third-Party AI Providers operate.

Where we transfer Personal Data outside the EEA, the UK, or Switzerland to a country that has not been recognized as providing an adequate level of protection, we implement appropriate safeguards, including:

• EU Standard Contractual Clauses (and the UK Addendum where applicable), approved by the European Commission under Commission Implementing Decision (EU) 2021/914;
• Adequacy decisions, including the EU-U.S. Data Privacy Framework where the recipient is certified, where the European Commission, the UK Secretary of State, or the Swiss Federal Data Protection and Information Commissioner has recognized the recipient country or organization as providing adequate protection; or
• Other valid transfer mechanisms issued or approved by the relevant authorities.

For further information about the safeguards applied to transfers of your Personal Data, or to obtain a copy of the relevant mechanism, please contact us at hello@qme.ai.

Territory-specific terms

EEA and the UK

Your data protection rights. Under applicable data protection laws in the EEA and the UK, you may exercise the following rights:

• Right to access. You have the right to obtain confirmation of whether we process your Personal Data and to obtain a copy of it.
• Right to data portability. You may receive Personal Data that you have provided to us in a structured, commonly used, and machine-readable format and transmit it to another controller, where the processing is based on your consent or a contract and carried out by automated means.
• Right to rectification. You have the right to request the correction of inaccurate Personal Data and the completion of incomplete data.
• Right to object. You have the right to object to the processing of your Personal Data where we rely on legitimate interest as a legal basis. Where you object to processing for direct marketing, we will stop such processing without requiring a reason.
• Right to restrict processing. In certain cases, you may request that we restrict the processing of your Personal Data (for example, where you contest its accuracy).
• Right to erasure. You may request that we erase your Personal Data in certain circumstances (for example, where it is no longer necessary for the purposes for which it was collected).
• Right to lodge a complaint. You have the right to lodge a complaint with a supervisory authority. For Romania, the competent supervisory authority is the National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, ANSPDCP), www.dataprotection.ro. If you are located in another EEA member state or the UK, you may also lodge a complaint with the supervisory authority in your country of habitual residence or place of work. You also have the right to seek a judicial remedy.
• Right to refuse or withdraw consent. If we ask for your consent, you are free to refuse, and if you have given it, you may withdraw it at any time without adverse consequences.
• Right not to be subject to automated decision-making. Solely automated decision-making within the meaning of Article 22 GDPR does not currently take place in connection with your Personal Data. Should this change, we will inform you about the logic involved and your rights, including the right to human intervention.

Whether the provision of data is required. Certain Personal Data is necessary to enter into and perform our contract with you (for example, your email address is needed to create your Account and provide the Service). If you do not provide it, we may not be able to create your Account or deliver the Service. Other data is optional.

Rights regarding Customer Content. To exercise data protection rights regarding Personal Data in Customer Content processed by Qme as a processor, please contact the user responsible for that content. If you contact us, we will redirect your request as described above.

US state residents

Depending on where you live, you may have rights under US state privacy laws (such as the California Consumer Privacy Act), including the right to know, access, correct, and delete your Personal Data, and the right to opt out of “sales” or “sharing” of Personal Data for targeted advertising. We do not sell Personal Data and do not share it for cross-context behavioral advertising. We do not collect or use sensitive personal information to infer characteristics about you. We will not discriminate against you for exercising your rights. To exercise your rights, contact us at hello@qme.ai; we will verify your identity using the information associated with your Account, and you may use an authorized agent subject to proof of authorization.

How we protect your Personal Data

We implement appropriate technical and organizational security measures to protect Personal Data against unauthorized access, alteration, disclosure, loss, or destruction. These measures may include encryption of data in transit and, where appropriate, at rest; access controls limiting access to personnel and providers who need it and who are bound by confidentiality obligations; monitoring and security assessments; and incident response procedures.
‍

While we work hard to protect your Personal Data, no security system is impenetrable, and we cannot guarantee the absolute security of your information. If you become aware of or suspect any unauthorized use of your Account, please contact us immediately at hello@qme.ai.

Children and privacy

The Service is intended for professional use by adults and is not directed to children. You must be at least 18 years old to use it, and we do not knowingly collect Personal Data from children under 18. If we become aware that a child has provided us with Personal Data, we will take steps to delete it promptly. If you believe that we have collected Personal Data from a child, please contact us at hello@qme.ai.

Third-party links and features

The Service and our website may contain links to third-party websites and features, including links to the original posts on Third-Party Platforms. These third parties may collect information about you under their own privacy policies. We are not responsible for those websites or services, and we provide links solely for your convenience.

Aggregate and de-identified data

We may collect, generate, and use aggregate and de-identified data that cannot reasonably be used to identify you. Such data is not Personal Data and is not subject to this Privacy Policy. We may use and disclose it for any lawful purpose, including analytics, internal reporting, capacity planning, and product development. We will maintain and use such data in de-identified form and will not attempt to re-identify it, except as permitted by law.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, and other factors. We will post any changes on this page and update the “Last Updated” date at the top. If we make changes that materially affect your rights or how we process your Personal Data, we will provide additional notice as appropriate, such as by posting a prominent notice or sending an email. Your continued use of the Service after changes have been published constitutes your acknowledgment of those changes.

Contact us

If you have any questions about this Privacy Policy or our privacy practices, or wish to exercise your data protection rights, please contact us at:

Email: hello@qme.ai

Contact and support: https://qme.ai/contact

Security issues can be reported through the same channels.

Qme, operated by AIchatbots SRL (Romania)