Privacy Policy

Effective Date: August 30, 2026

How Quaspar collects, uses, and protects personal information

Replaces the Privacy Policy dated July 2, 2026. Additions: Workforce platform, learning features, model providers, voice features, connectors, marketplace, and account deletion.

1. Scope

This policy explains how Quaspar Inc., a Delaware corporation with its principal place of business in Chicago, Illinois ("Quaspar") handles personal information when you visit quaspar.com, use the Quaspar Workforce platform or browser extension, or communicate with us. It does not cover protected health information (PHI) that our customers process through the Service; that is governed by our Business Associate Agreement with the customer, and the customer's own notice of privacy practices applies to patients. If you are a patient whose information was processed by a Quaspar customer, please contact that provider.

2. Information we collect

Information you give us

Account details: name, business email, organization name, role, password (hashed), and payment details (processed by Stripe; we store only the last four digits and card brand).
Content you submit to the Service: worker configurations, prompts, files, connector credentials (encrypted), and messages to support.
Marketplace listings and profile information if you publish templates.

Information collected automatically

Usage data: features used, runs, model and intensity choices, metered usage, errors, and performance metrics.
Device and log data: IP address, browser type, operating system, timestamps, and referring pages.
Cookies and similar technologies as described in our Cookie Policy.

Information from connectors and third parties

When you connect an EHR, email, calendar, database, or other system, workers retrieve data from it only within the scope you authorize. Connector tokens are stored encrypted and can be revoked in Settings.

3. How we use information

To provide, operate, secure, and support the Service, including running workers you configure.
To bill you and manage your subscription and prepaid run packs.
To send service messages (security alerts, billing, changes to terms) and, with your consent where required, product updates you can opt out of.
To detect abuse, enforce our terms, and comply with law.
To improve the Service using de-identified, aggregated usage data.

Learning features

Workers may record their runs as experience and train small per-worker models on outcomes. This data is scoped to your organization, PHI-redacted before storage, never shared with other customers, and never used to train Quaspar's general models or any third-party model. You can disable learning per worker, reset it, or delete it.

AI model providers

Inputs to a worker are sent to the model provider selected for that build (Anthropic, OpenAI, Google, xAI, or DeepSeek) or to our default provider. We use enterprise or API terms that prohibit providers from training on your data where the provider offers them. Providers without a HIPAA BAA are blocked for PHI workloads. Details are in the Sub-processor List.

Voice features

If you use voice workers, audio is transcribed to carry out the task and is not retained beyond what is needed for that execution and audit logging, unless you enable recordings. Quaspar does not create voiceprints or use voice to identify individuals. See the Biometric Data Policy.

We share personal information only with: service providers listed in our Sub-processor List (cloud hosting, model providers, payments, email delivery) under contracts that restrict their use of the data; third parties you connect through connectors, at your direction; marketplace users, for the profile information you choose to publish; authorities when required by law or to protect rights and safety; and a successor in a merger or acquisition, with notice to you. We do not sell personal information and do not share it for cross-context behavioral advertising.

5. Retention

We keep account and usage data for as long as your organization is active and for up to 90 days after deletion, then delete or de-identify it. Billing records are kept for seven years. Audit logs required by HIPAA are kept for six years. Learning data and executions are deleted with the worker or organization. Backups are overwritten within 35 days.

6. Security

We use encryption in transit (TLS 1.2+) and at rest, role-based access controls, audit logging, secret management, and regular testing. Our infrastructure runs on Google Cloud under a Business Associate Agreement. No system is perfectly secure; if we learn of a breach affecting you, we will notify you as required by law and by our agreements.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, to restrict or object to processing, or to withdraw consent. Organization admins can export and delete organization data from Settings. For other requests, email support@quaspar.com. We will verify your identity and respond within the time the law requires (generally 30 to 45 days). We will not discriminate against you for exercising your rights. You may appeal a decision by replying to our response.

Illinois residents. We do not collect biometric identifiers. If that changes we will obtain written consent and publish a retention schedule as required by the Illinois Biometric Information Privacy Act.

California residents. In the last 12 months we collected the categories listed in Section 2 for the purposes in Section 3. We do not sell or share personal information as defined by the CCPA. You may authorize an agent to make requests on your behalf.

EU/UK residents. Quaspar acts as a processor for customer content and as a controller for account and usage data. Our legal bases are contract performance, legitimate interests in operating and securing the Service, consent for optional communications, and legal obligation. Transfers to the U.S. rely on Standard Contractual Clauses in our Data Processing Addendum. You may complain to your local supervisory authority.

8. Children

The Service is for adults and businesses. We do not knowingly collect information from anyone under 18. If you believe we have, contact us and we will delete it.

9. Changes

We will post changes here and, for material changes, notify admins by email or in the product at least 30 days before they take effect.

10. Contact

Quaspar Inc., Chicago, Illinois. Email: support@quaspar.com.