Privacy Policy

1. Introduction

Qualfy (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have. It applies to all users of the Qualfy website, dashboard, APIs, widget, and related services (collectively, the “Service”). By using the Service, you agree to the practices described in this policy. Please also review our Terms of Service.

2. Information We Collect from Customers

When you create a Qualfy account and use the dashboard, we collect:

• Account information: your name, email address, and password. If you sign in with Google, we receive your name and email from Google.
• Organization information: your company name, team member details, and project configurations.
• Calendar data: when you connect a calendar, we access your free/busy availability to display scheduling options. We do not read the details of your calendar events beyond their free/busy status.
• Payment information: if you subscribe to a paid plan, payment is processed by Stripe. We do not store your credit card numbers. We receive confirmation of payment status and billing details from Stripe.

3. Information We Collect from End Users

When you interact with the Qualfy widget embedded in a customer's application, we may collect the following information:

• Identification data: information passed by the customer's application via the qualfy('identify') call, which may include a user ID, email address, and custom properties chosen by the customer (such as plan type, role, or company name).
• Scheduling information: if you book an interview through the widget, we collect your name, email address, and the time slot you selected.
• Widget interaction events: we record widget impressions (when the popup is shown), dismissals, and bookings to provide analytics to the customer.
• Event tracking data: actions tracked by the customer's application via qualfy('track') calls, which include event names defined by the customer.

4. Information We Collect Automatically

When you use the Service, we automatically collect certain technical information including IP addresses, browser type and version, operating system, referring URLs, pages visited on our website, and error logs. This information is used to operate, maintain, and improve the Service and to diagnose technical issues.

We use analytics services to understand how visitors use our website. These services may collect information such as pages visited, time on page, clicks, scroll behavior, and session recordings (with sensitive fields masked). We use PostHog for product analytics and session replay, and Vercel Analytics for web performance measurement.

5. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Send transactional emails such as interview confirmations, reminders, and cancellation notices.
• Integrate with calendar services to display availability and create events.
• Provide analytics and reporting to customers about their widget performance and research pipeline.
• Improve the Service, fix bugs, and develop new features.
• Respond to support requests and communicate with you about your account.
• Measure the effectiveness of our advertising campaigns using conversion tracking pixels.

We do not sell your information to third parties. We use limited advertising tools (such as the Reddit Pixel) solely to measure whether our own ads lead to sign-ups. We do not serve ads within the Qualfy product or use your data to target ads to you on other platforms.

6. Data Sharing

We share data only with service providers who help us operate the Service:

• Cloud infrastructure providers for database hosting and storage.
• Email delivery providers for sending transactional emails.
• Hosting providers for serving the dashboard and APIs.
• Google and Microsoft for calendar integration (only when you connect your calendar).
• Stripe for payment processing.
• Slack for notification delivery (only when you enable the Slack integration).
• Analytics providers (PostHog) for understanding website usage, product analytics, and session replay.
• Advertising platforms (Reddit) for measuring ad campaign effectiveness through conversion pixels. Only page visit and sign-up conversion events are shared, not your personal data or product usage.

We may also disclose information if required by law, subpoena, or legal process, or if we believe disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

7. Data Retention

Customer account data is retained for as long as your account is active. If you terminate your account, we will delete your data within 90 days, except where we are required to retain it by law. End user widget data is retained according to the customer's project settings and our standard retention schedules. You may request early deletion by contacting us.

8. Customer Responsibilities

If you embed the Qualfy widget in your application, you act as the data controller for the personal data collected from your end users. You are responsible for:

• Informing your end users about the widget's data collection in your own privacy policy.
• Obtaining appropriate consent from your end users as required by applicable law (including GDPR, CCPA, and other data protection regulations).
• Ensuring that the data you pass to Qualfy via qualfy('identify') and qualfy('track') complies with your obligations under applicable law.

Qualfy processes this data on your behalf as a data processor. We will process it only in accordance with your instructions and these Terms.

9. Cookies and Similar Technologies

We use cookies and similar technologies on both the Qualfy website and dashboard:

• Strictly Necessary Cookies: Authentication cookies and session management. These are required for the Service to function and cannot be disabled.
• Analytics Cookies: We use PostHog and Vercel Analytics to understand how visitors use our website and how customers use the dashboard. These cookies help us measure page views, session duration, and feature usage. Analytics data is collected only with your consent on our marketing site.
• Advertising Cookies: We use the Reddit Pixel on our marketing site to measure the effectiveness of our advertising campaigns. This pixel tracks page visits and sign-up conversions. Advertising cookies are loaded only with your consent.
• Widget Local Storage: The Qualfy widget embedded in customer applications uses browser localStorage to manage popup frequency (for example, to avoid showing the same popup to a user who recently dismissed it or booked an interview). The widget does not set cookies and does not use tracking technologies for advertising purposes.

You can manage your cookie preferences at any time using the cookie preferences link in our website footer. You can also control cookies through your browser settings. Disabling analytics or advertising cookies does not affect the functionality of the Qualfy dashboard or widget.

10. Security

We take the security of your data seriously. All data is encrypted in transit using TLS and at rest using industry-standard encryption. We enforce strict access controls, conduct regular security reviews, and follow security best practices. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If you discover a security vulnerability, please contact us immediately at legal@qualfy.io.

11. Your Rights

For Qualfy customers: you may access, correct, or delete your account data at any time by contacting us or through your account settings.

For end users: if you interacted with the Qualfy widget on a customer's site and wish to access, correct, or delete your data, please contact the company whose site you were using. You may also contact us directly and we will help facilitate your request.

GDPR rights (EEA residents): you have the right to access, rectification, erasure, data portability, restriction of processing, and the right to object to processing of your personal data. To exercise these rights, contact us at the address below.

CCPA rights (California residents): you have the right to know what personal information we collect, the right to request deletion, and the right to opt-out of the sale of personal information. We do not sell personal information. You can manage your cookie preferences and opt out of analytics and advertising cookies using the cookie preferences link in our website footer. We honor Global Privacy Control (GPC) browser signals.

12. Children's Privacy

The Service is not directed at children. We do not knowingly collect personal information from children under the age of 13 (as defined by COPPA) or under the age of 16 (as defined by GDPR). If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

13. International Data Transfers

Qualfy is based in the United States. If you use the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer. We take appropriate safeguards to protect your data in accordance with this Privacy Policy regardless of where it is processed.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify customers at least 30 days in advance via email. The updated policy will be posted on this page with a revised “Last updated” date. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

15. Contact

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Email: legal@qualfy.io