Privacy policy

This policy explains how Qualifical (“we”, “us”), available at https://qualifical.com, collects, uses, and shares personal data when you use our website, app, API, MCP server, and browser extension (the “Service”). We are the controller of that data under the EU and UK GDPR, and the “business” under the California Consumer Privacy Act (CCPA). Contact us about privacy at support@qualifical.com.

In short: on a free account, we keep what you write and send for up to two years, with obvious personal details removed, to train and improve our models; on a plan or with bought credits, your writing is never used for training. Your text goes only to the providers that check and rewrite it for you and the infrastructure we train on. We don’t sell personal data or use it for personalised advertising. Optional Analytics is explained below, and you can delete your documents or your whole account yourself at any time.

Analytics and Cookie preferences

Analytics is optional. It uses Google Analytics 4 and Google Ads to help us understand traffic sources, page visits, engagement, completed checks and rewrites, registrations, checkout starts and confirmed purchases. Purchase events include value, currency and a one-way hashed transaction identifier. Essential sign-in and security storage works independently of this choice.

Both Google services stay blocked until you allow Analytics. Rejecting or withdrawing consent does not affect your access, pricing or features. Use the button below to reopen the Cookie preferences and change your decision. Agreeing to our Terms is not consent to Analytics.

We configure user-level and event-level Analytics retention for 14 months, without resetting the user retention period on new activity. Standard aggregated reports can remain available longer. Cookie lifetimes and your consent choice are described in section 7 below.

1. What we collect

• Account data: your email address and, if you sign in with Google, the name and profile picture Google shares with us.
• Your content: the documents you write or import, the .docx files you upload (kept for 12 months so exports keep their formatting), the scores of their passages, and the rewrites you keep. Text sent through the API, the MCP server, or the browser extension is processed to return a result and isn’t stored as a document.
• Training samples, from free accounts only (with no plan and no bought credits that haven’t expired): a copy of each document you create or import, and of the text you check or rewrite in the app, through the API or MCP server, or with the browser extension, together with its scores and rewrites, and which rewrites you kept, undid, or swapped for another version. Section 5 explains how they’re redacted and how long they’re kept.
• Usage data: the credits you’re given and spend, including free credits spent each day, a record of each check (when it ran, how many credits, the resulting score, but not the text itself), a history of each check and rewrite you pay for (when, how many credits, which document, and whether it was in the app, through the API, or with the extension), and when your API keys were last used. We store API keys only as a one-way hash. For each app you connect to your account, such as an AI assistant using our MCP server, we keep its name, when you connected it, and the access tokens it uses, until you disconnect it in Settings.
• Invites: if you signed up with a friend’s invite code, we record who invited you and whether you’ve made your first check and first payment, to give you both invite credits. Your friend sees only how many of their invites joined, checked, and paid, never who.
• Billing data: your plan, your subscription’s status and billing period, the credit packs you buy, and the customer, subscription, and order identifiers Creem gives us. Creem collects your payment details directly; we never see your card number.
• Technical data: the IP address and browser of each signed-in session, IP addresses and email addresses used to limit repeated sign-in attempts, signals about your browser that Cloudflare Turnstile uses to tell people from bots when you request a sign-in link, and error logs and request traces that help us find and fix problems.
• Browser extension: the Qualifical extension for Chrome reads text on a page only when you ask it to, by choosing Check with Qualifical or pressing its shortcut, and only in that tab. If you turn on using it on every page, which asks for access to every site, it also fills the text you select into its panel while the panel is open, and shows a Check button on the text box you’re writing in; that text stays in your browser until you check it. It sends us the text you check, and the passages you choose to rewrite, using the session from signing in on our website. To mark the passages it checked where they are on the page, and to show the Check button, it looks at the page’s text in your browser. It doesn’t send us anything else from a page, or record your browsing.
• Messages: what you send us when you email support.
• Optional Analytics: if you allow it, Google receives cookie and ad-click identifiers, traffic sources, page categories, session and engagement information, and the feature, registration and checkout events described above. Google also receives technical data such as your IP address, browser and device characteristics; Google Analytics 4 does not log or store individual IP addresses. We replace private document and report URLs with generic page categories and remove arbitrary query strings and fragments. We do not send names, email addresses, writing, document names, sign-in tokens, detection scores or private page titles. Google Signals, enhanced conversions and ad personalisation are disabled. We do not use session recordings or automatically collect form contents.

We get this data from you, from Google if you sign in with it, and from Creem about your payments. You need to give us an email address to create an account; without one we can’t provide the Service. Everything else is created as you use it.

2. How we use it, and why we’re allowed to

• To provide the Service: storing, checking, and rewriting your documents, keeping track of your credits, and running your account. Legal basis: performance of our contract with you.
• To bill you for plans and credit packs through Creem and keep the records the law requires. Legal basis: contract, and our legal obligations.
• To keep the Service secure and working, for example by preventing abuse and automated sign-ups, keeping a deleted account’s email address from opening new free accounts, limiting request rates, and fixing errors. Legal basis: our legitimate interest in a safe, reliable service.
• To write to you about your account, sign-in links, changes to these policies or prices, and your support requests. Legal basis: contract and legitimate interests. We don’t send marketing emails.
• To train, evaluate, and improve our detection and rewriting models and the Service, using free accounts’ training samples. Legal basis: our legitimate interest in improving the Service, which is what lets us offer a free plan. You can object (section 8).
• To comply with the law and respond to lawful requests. Legal basis: legal obligation.
• With your consent, to understand how the website is used, improve its features and measure which ads lead to registrations and purchases. Analytics remains blocked until you allow it. You can reject or withdraw consent in Cookie preferences on this page.

We never use what you write on a plan or with bought credits for training, and we don’t sell, rent, or share personal data for cross-context behavioral advertising. We also make no decisions about you based solely on automated processing that have legal or similarly significant effects.

3. Who we share it with

We share personal data only with these service providers, each of which processes it on our behalf and receives only what its task needs:

• Cloudflare, Inc. hosts the Service and stores its database and uploaded files; sends sign-in emails and receives mail to support@qualifical.com (Cloudflare Email Service); checks email sign-in requests for bots (Cloudflare Turnstile); and provides rate limiting, logs, and traces.
• Creem, our Merchant of Record, runs checkout, payments, invoices, and refunds. It receives your account email address when you start a checkout and collects your payment details itself, under its own privacy policy.
• Google LLC confirms your identity if you choose to sign in with Google, under Google’s privacy policy. Separately, if you allow Analytics, Google Analytics 4 and Google Ads receive the limited usage and conversion data described above. Google may process this data outside your country under its applicable data protection terms. See how Google uses data from partner sites. We do not enable personalised advertising or Google Signals.
• AI processing providers receive the passages you check, to score them, and the paragraphs you choose to rewrite, to rewrite them. They receive only that text, with no account details attached. These are third-party AI services or models we run ourselves on rented cloud computing infrastructure.
• Cloud computing providers we rent to train and evaluate our models process the redacted training samples described in section 5, on our instructions only.

Analytics runs only after your consent. We do not use session recording. We may also disclose data when required by law, to protect the rights or safety of our users or others, or to a successor if the Service is merged, acquired, or sold, in which case this policy continues to protect it.

4. Where your data is stored

Our database and uploaded files are stored by Cloudflare in data centers in Western Europe. The Service runs on Cloudflare’s global network, so each request is handled in a data center near you, and our providers may process data in other countries, including the United States. Where the law requires safeguards for transfers out of the EU, UK, or Switzerland, we rely on them, such as the European Commission’s Standard Contractual Clauses or the EU-US Data Privacy Framework where a provider is certified under it.

5. How long we keep it

• Documents stay until you delete them or your account.
• Your credit history, what each check and rewrite cost and the credits you were given, is deleted automatically 12 months after each entry; credits you were given are kept until 12 months after they expire, since you can spend them until then.
• Uploaded .docx files are deleted 12 months after upload, or sooner if you delete the document or your account. After that, exporting the document still works, but it is rebuilt from its text without the original formatting.
• Deleting your account deletes your documents, uploaded files, scores, usage records, API keys, and training samples right away. We keep only your email address and when the account was deleted, so the address can’t be used to open a new free account; it can’t sign in again unless you write to us to restore the account. Copies may remain in encrypted backups for up to 30 days before they’re overwritten.
• Training samples are deleted automatically two years after they’re made, including when you’ve deleted the document they came from before then. Before a sample is stored, we automatically replace email addresses, phone numbers, and your account’s name and email address with placeholders. This is automatic pattern matching, so it can miss other personal details in your writing, such as other people’s names. Samples are filed under a random pseudonym rather than your account; we can find and delete them on request, and deleting your account deletes them. Models already trained or evaluated with a sample aren’t retrained when it’s deleted.
• Error logs and traces are kept for a limited time and then deleted automatically.
• We keep support emails for as long as we need them to help you and to keep a record of the request.
• Creem keeps billing and tax records for as long as tax law requires, under its own policy.

6. Security

Data is encrypted in transit and stored with providers that encrypt it at rest. Sign-in links expire after 15 minutes and work once, API keys are stored only as hashes, and access to production data is limited to what operating the Service requires. No system is perfectly secure; if a breach affects your data, we’ll notify you and the authorities as the law requires.

7. Cookies and local storage

Essential cookies and storage keep the Service working. Analytics is optional: we ask first and block Google’s tags and optional cookies unless you allow it. The Cookie preferences button on this page lets you change your decision at any time.

• __Secure-better-auth.session_token (cookie): keeps you signed in. It expires 7 days after you last use the Service, or when you sign out.
• __Secure-better-auth.oauth_state (cookie): set only while you sign in with Google, to protect that sign-in from forgery. It expires after 10 minutes.
• theme (your browser’s local storage): remembers your light or dark theme. It stays until you clear your browser’s site data.
• capture (the browser extension’s session storage): the text you last sent to the extension’s panel and the tab it came from, so the panel can show it and put a rewrite back. Chrome deletes it when you close the browser.
• qualifical:analytics (local storage): remembers your allowance or rejection for 180 days. If you allow Analytics, Google may set _ga and_ga_* cookies to distinguish browsers and sessions, and _gcl_*cookies to connect ad clicks with conversions. We configure Google Analytics cookies for 180 days; Google Ads click cookies normally last up to 90 days.qualifical:analytics-signup:* and qualifical:analytics-purchase:*local-storage entries avoid resending the same registration or purchase from this browser; they contain only hashed transaction identifiers. Withdrawing consent clears the site’s Analytics cookies and reloads the page with the Google tag blocked. You can also clear these entries in your browser’s site data.

Cloudflare Turnstile, on the sign-in page, reads signals about your browser to tell people from bots but doesn’t set cookies for us. Creem’s checkout page, which is on Creem’s site, may set its own cookies when you upgrade.

8. Your rights

You can download, edit, or delete your documents and delete your account yourself in the Service. If you’re in the European Economic Area, the UK, or Switzerland, you also have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• receive your data in a portable format, or have it sent to another service;
• restrict processing, or object to processing based on our legitimate interests; and
• withdraw consent at any time where we rely on it.

On a free account, you can object to your writing being used for training wherever you live: email us, and we’ll stop keeping samples from your account and delete the ones already linked to it. To keep your writing out of training without objecting, get a plan or buy credits.

You can also complain to the data protection authority where you live or work. People elsewhere may have similar rights under their local laws, and we’ll honor those requests too.

9. California residents

In the past 12 months we have collected these categories of personal information, from the sources and for the purposes described in sections 1 and 2: identifiers (email address, IP address), customer records (name, if you sign in with Google), commercial information (your plan, subscription, and credit purchases), internet activity (usage records, sessions, and logs), and the content you add, including training samples from free accounts. Section 5 says how long we keep each. We disclosed them for business purposes only to the service providers in section 3. We don’t sell or share personal information, haven’t done so in the past 12 months, and don’t knowingly sell or share that of anyone under 16. We don’t use sensitive personal information to infer anything about you.

Under the CCPA, as amended by the CPRA, you have the right to:

• know what personal information we have collected about you, where it came from, why, and who we disclosed it to, and get a copy of it;
• have it deleted;
• have inaccurate personal information corrected; and
• not be discriminated against for using these rights.

Because we don’t sell or share personal information or use sensitive personal information beyond what the law allows, there is nothing to opt out of or limit. You can use your rights yourself or through an authorized agent, who must show us your signed permission.

10. How to use your rights

Email support@qualifical.com from the address on your account, or say how we can reach you. We’ll confirm your identity before acting, typically by replying to that address. We’ll respond within one month (45 days for California requests), and may extend this where the law allows, telling you why. Using your rights is free, and we won’t treat you differently for it.

11. Children

The Service isn’t directed to children under 16, and we don’t knowingly collect their personal data. If you believe a child under 16 has given us personal data, contact us and we’ll delete it.

12. Changes

We may update this policy. We’ll post the new version here with a new date and, if a change is material, tell you by email or in the Service before it takes effect. See also our terms of service.

13. Contact

Qualifical, https://qualifical.com. Email: support@qualifical.com.