cQnce privacy & data

The data controller responsible for your personal data is TECH S.r.l.

First name, last name, avatar image (optional)

Email address and password (tenant dashboard users)

Phone number (agents — used for OTP authentication and push notifications)

Device public key (ECDSA P-256, registered on first mobile login)

IP address, HTTP method, path, response status, and duration (API access log)

Analytics identifiers and usage events from website, web app, and mobile app (when analytics is enabled by user consent where required)

Email addresses used for transactional emails (account activation, password reset)

Authorization request payloads and metadata (JSON, provided by your application)

Providing the Service (routing, notifications, webhooks)

Authenticating users and agents (JWT, OTP, device keys)

Audit trail and compliance logging

Improving the Service and debugging

Usage analytics for product improvement and reliability (website, web app, mobile app)

Account data is kept until you close your account.

Authorization request records and audit logs are retained for the duration of the contract and up to 12 months after termination unless a shorter period is agreed.

API access logs are retained for 90 days by default.

Analytics event data is retained according to configured provider settings (for Google Analytics, up to 14 months unless changed).

we rely on appropriate safeguards such as standard contractual clauses and vendor agreements, where applicable.

Railway — hosting and deployment infrastructure for backend and web services, acting as a processor under appropriate contractual safeguards.

Other infrastructure providers — database, object storage, and email delivery services that process data on our behalf under data processing agreements.

To exercise any of these rights, contact us at privacy@cqnce.app .

Access — request a copy of the data we hold about you.

Rectification — ask us to correct inaccurate data.

Erasure — ask us to delete your data (subject to legal retention obligations).

Restriction — ask us to restrict processing in certain circumstances.

Portability — receive your data in a structured, machine-readable format.

Objection — object to processing based on legitimate interest.

Withdraw consent — withdraw consent at any time where processing is consent-based.

We do not sell your personal data.