Privacy Policy
Last updated: May 2026
This Privacy Policy describes how QuantumOS X3 (“we”, “us”, or “our”) collects, uses, and shares information about you when you use our services, website, and platform.
1. Information we collect
We collect information you provide directly to us, including when you create an account (name, work email, company name, password), use our platform features (order data, customer records, product catalogs, inventory transactions), contact our support team, or respond to surveys and communications.
We also collect information automatically when you use the service: IP addresses, browser type, device identifiers, page views, clickstream data, and performance telemetry. This data is used strictly for operating and improving the platform.
2. How we use your information
We use the information we collect to:
- Provide, operate, and improve the QuantumOS X3 platform
- Process transactions and send related information, including purchase confirmations
- Send administrative messages, technical notices, security alerts, and support responses
- Monitor and analyze usage trends to improve product experience
- Detect and prevent fraudulent, abusive, or illegal activity
- Comply with legal obligations and enforce our terms
3. Data processing & sub-processors
We process data on your behalf as a data processor under GDPR. Our sub-processors are listed in our Trust Center at trust.qosx3.com. We require all sub-processors to implement appropriate security measures and process data only on our documented instructions. We provide at least 30 days' notice of sub-processor changes.
Core sub-processors include cloud infrastructure (Cloudflare, AWS, Neon, Supabase), payment tokenization (Stripe), transactional email (Resend), and error monitoring (Sentry). None of these sub-processors are permitted to use your data for their own commercial purposes.
4. Data retention
We retain your account and business data for as long as your account is active or as needed to provide services. After account termination, data is retained for 90 days to allow recovery, then purged from all systems including backups within 30 days unless legal obligations require longer retention. You can request immediate erasure via the DSR portal or by emailing privacy@qosx3.com.
5. Your rights (GDPR & CCPA)
Depending on your location, you may have the right to access, correct, delete, port, or restrict processing of your personal data. California residents have additional rights under the CCPA including the right to know what personal information is collected, the right to delete it, and the right to opt out of sale (we do not sell personal data).
To exercise your rights, use our self-service DSR portal (available in your Command account settings) or email privacy@qosx3.com. We respond within 30 days (or 45 days for complex requests, with notice).
6. Cookies
We use strictly necessary cookies to authenticate sessions and prevent CSRF attacks. We use first-party analytics cookies (no cross-site tracking) to understand aggregate usage. We do not use third-party advertising cookies. You can disable non-essential cookies via your browser settings; this will not affect core platform functionality.
7. International transfers
Data is processed in the region you select at account creation. For transfers from the European Economic Area to countries without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. A copy of our SCCs is available in our Data Processing Addendum.
8. Security
We implement industry-standard security controls including AES-256 encryption at rest, TLS 1.3 in transit, row-level tenant isolation, least-privilege access controls, and annual SOC 2 Type II audits. For a complete description of our security posture, see our Security page.
9. Children's privacy
Our services are not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, contact us immediately and we will delete it.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice in Command and/or via email at least 30 days before the changes take effect. Your continued use of the service after the effective date constitutes acceptance of the updated policy.
11. Contact
For privacy-related questions, data subject requests, or to reach our Data Protection Officer, contact us at privacy@qosx3.com or by post to QuantumOS X3, Data Privacy Team, as listed on our contact page.