Privacy policy

KI-Quadrat Systemhaus GmbH
Kirchengasse 23
3003 Gablitz
Austria
Email: office@ki2.at

Data protection officer: ⟦TO COMPLETE⟧

If you connect a mailbox for private purposes, we process its contents as controller, only to provide the service to you.

If you or your organization use Quri for business purposes, you (or your organization) are the controller for the mail you connect, and we process it on your behalf as a processor under Art. 28 GDPR. See our DPA summary.

Your mailbox contains personal data of other people, such as senders, recipients and people mentioned in emails (Art. 14 GDPR). We obtain this data from your mailbox. It consists of header data (names, email addresses, dates, subjects) and message content. We use it solely to provide search, answers and drafts to you; we never contact these people or use their data for any other purpose.

To make your mail searchable by meaning, text from your emails is sent to OpenAI to compute embeddings (numeric representations used for search). To answer a question or draft a reply, your question and the most relevant email excerpts are sent to OpenAI or, if you or your organization selected it, Anthropic.

These providers act as our subprocessors. OpenAI does not use data submitted through its API to train its models. Where configured, OpenAI processes requests with EU data residency. Enterprise customers can use their own provider accounts (BYOK).

Answers and drafts are AI-generated and labelled as such. See our AI transparency page.

We share personal data only with service providers that process it on our behalf under a data processing agreement (Art. 28 GDPR), with authorities where the law requires it, and with your own email provider when you send a message through your mailbox.

• Clerk: sign-in and user accounts (USA)
• Convex: database, file storage and backend (EU region)
• Qdrant Cloud: search index (EU region)
• OpenAI: embeddings, answers and drafts (USA, or EU where EU data residency is configured)
• Anthropic: answers and drafts, only if selected (USA)
• Resend: transactional email (EU sending region)
• Vercel: hosting and content delivery
• Stripe: payments, where enabled
• Neon: pseudonymous usage analytics, where enabled (EU region)

Purpose, data, location and transfer safeguard of each provider are listed on our subprocessors page.

Some providers are based in the United States or may access data from there. We transfer personal data to third countries only on the basis of an adequacy decision or appropriate safeguards:

• Clerk (USA): EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR).
• OpenAI (USA): EU-US Data Privacy Framework and Standard Contractual Clauses (Art. 46(2)(c) GDPR). Where EU data residency is configured, requests are processed in the EU.
• Anthropic (USA, only if selected): Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• Convex, Resend, Vercel, Stripe and Neon: where these providers access data from outside the EU, the transfer is based on the EU-US Data Privacy Framework or Standard Contractual Clauses under the provider's data processing agreement.

You can request a copy of the safeguards from us at office@ki2.at.

• Account and mailbox data: until you delete it or your account. Deleting your account removes your data across our systems, including the search index and your sign-in account.
• Emails removed from your mailbox: purged from Quri 30 days after removal.
• Data exports: the download link expires after 7 days.
• Logs: sync logs 14 days, notification logs 90 days, other security and access logs 30 to 90 days.
• Billing records: 7 years, as required by Austrian tax and company law (§ 132 BAO, § 212 UGB).
• Contact requests: 24 months after we receive them, unless they lead to a contract.

• Access and portability (Art. 15 and 20 GDPR): start a data export in the app's settings, on every plan.
• Erasure (Art. 17 GDPR): delete your account in the app's settings. Deletion is complete and cannot be undone.
• Rectification (Art. 16 GDPR): update your details in your account settings, or contact us.
• Restriction (Art. 18 GDPR) and objection (Art. 21 GDPR): where we rely on legitimate interests, you can object at any time on grounds relating to your particular situation.

You can also exercise any of these rights by email to office@ki2.at. We may ask you to confirm your identity.

Right to lodge a complaint (Art. 77 GDPR): you can complain to any data protection supervisory authority, in particular in the EU member state where you live or work. The authority responsible for us is: Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at, www.dsb.gv.at

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). AI-generated answers and drafts are suggestions for you to check; they are not decisions about you or anyone else.

You need an email address to create an account and your mailbox's IMAP/SMTP credentials to connect it. Without them we cannot provide the service. Everything else is optional.

We use only strictly necessary cookies and no analytics or marketing tracking. Details are in our cookie notice.

Mailbox credentials and API keys are encrypted with AES-256-GCM using versioned keys. Email content is encrypted at rest by our infrastructure providers. This website and the app are served over HTTPS only.

We update this policy when our processing changes. The date at the top shows the current version. If a change significantly affects you, we will inform you by email or in the app.