Privacy policy

Last updated: 28 October 2026

These notices explain data processing by QORLYNT, Smart TB Tech’s independent platform for appointment management, customer communication and business automation. Processing depends on the functions actually used and services connected.

On this page

1. Controller and privacy contact

Smart TB Tech UG (haftungsbeschränkt), Oberviehhausen 7, 84533 Haiming, Germany. Managing directors: Bernhard Waldherr and Thomas Elbl. E-mail: support@qorlynt.com; telephone: +49 8678 4499811. Technical support: support@qorlynt.com.

QORLYNT is a product brand, not a separate legal entity. These notices cover the QORLYNT website and services provided through QORLYNT. Other Smart TB Tech products have separate privacy notices.

2. Our role and the business customer’s role

We generally act as controller for our own website, contract administration, billing, our own support requests and the protection of our services.

When a business uses QORLYNT to process data about its customers, prospects, staff or business partners for its own purposes, that business generally determines the purposes and legal bases. We process this operational data as processor on documented instructions under an agreement pursuant to Article 28 GDPR. This privacy policy does not replace that agreement.

Appointments or customer conversations with such a business are also covered by its privacy notices. The business decides in particular on its services, staff scheduling, communication channels, AI use and retention. External providers may act as independent controllers for their own account, security or billing purposes. Roles must be distinguished for each processing activity.

3. Sources of data and required information

We receive data from you, authorized users in your business and expressly connected services. Sources include manual entries, CSV/Excel imports, booking forms, messages, calendar imports and configured automations. Technical access also generates connection data.

Required information is needed for the relevant function, for example an e-mail address for login or booking confirmation. Without it, that function may be unavailable or limited. Free text, additional contact fields, optional integrations and voluntary context are not generally required. Please provide only data needed for the relevant purpose.

Where a business obtains data indirectly, it must assess the relevant information duties, particularly Article 14 GDPR, and the lawfulness of the source.

Where we indirectly obtain personal data for our own contract, account or contact administration, the sources include the employer or contracting business, its administrators or representatives and the payment or authentication services involved. The categories comprise the contact, role, contract, payment and technical data described in this notice. Where Article 14 GDPR applies and no statutory exception applies, we provide the required information within one month at the latest, or earlier at the first communication or first disclosure, as applicable. Before further processing for another purpose, we provide information as required by Articles 13(3) or 14(4) GDPR.

4. Website, hosting and technical logs

Website access processes in particular IP address, request time, requested address, browser/device information, response status and technical errors. Purposes are delivery, connection establishment, troubleshooting and protection against abuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interests are a secure and functioning service.

QORLYNT uses Amazon Web Services (AWS) infrastructure for hosting, database operations, backups and authentication. Our QORLYNT environment includes in particular EC2 and EBS for servers and storage, S3 for backups, Cognito for identity, and DynamoDB and Secrets Manager for the data and secrets configured in each service. Our AWS infrastructure also includes management, network and security services such as CloudFormation, IAM, VPC and Systems Manager. Further AWS services actually used are assessed according to their specific data flows; naming a service does not imply that it holds every data category. The application code also uses PostgreSQL for operational data. Login uses a dedicated Amazon Cognito service for QORLYNT. AWS acts as a technical service provider; AWS EMEA SARL, Luxembourg, is generally responsible for European contractual relationships. Information: https://aws.amazon.com/privacy/.

Locating regional application resources in Stockholm does not mean that all AWS management data and provider operations remain there. AWS describes, for example, a shared IAM control plane for commercial Regions in the USA and regional authorization data planes. Actual access and transfers require review against the services and agreements used. Recipients and international transfers are explained below. IAM architecture: https://docs.aws.amazon.com/IAM/latest/UserGuide/disaster-recovery-resiliency.html. Technical logs serve operational and security purposes and are not automatically removed solely because a contact is deleted.

5. User accounts, organizations, teams and permissions

We process e-mail addresses, user identifiers, personal display names, language and appearance preferences, company information, memberships, invitations, roles, permissions, login and session data and account/plan status. Account security data includes in particular the setup and status of two-factor authentication, device labels, sign-in and last-use times of active sessions, and the type and time of recent security events. This enables login, personal profile preferences, tenant assignment, team administration, account protection and enforcement of purchased permissions. Security events shown here do not contain passwords or one-time codes.

For our own contract and account administration, Article 6(1)(b) GDPR applies where the individual is a contracting party. For employees and business contacts, necessary contact and permission administration is based on Article 6(1)(f) GDPR; the legitimate interest is performing and securing the business relationship. Processing on customer instructions is governed by the processing agreement.

Authorized administrators can access data within their organization according to their roles. Use individual accounts and do not share passwords or confirmation links.

Where users voluntarily enable web push, we process a browser push endpoint linked to the organization and user, a technical endpoint hash, selected notification categories and delivery status/attempts. This enables the requested notices of business events and reliable delivery. We transmit the endpoint to the push service of the relevant browser or operating system; depending on the device, services of Google, Mozilla, Apple or Microsoft may be involved. Notifications contain only a generic notice without customer or appointment details; further information is shown in QORLYNT after sign-in. Enabling push requires an active choice and browser permission and can be disabled in settings. Successful deactivation removes the related server-side registration; browser permission can also be managed in device settings. Existing delivery records may remain until routine cleanup. Business event processing is on the customer's instructions; the legal basis explained above applies to our own provision and security of user accounts.

6. Browser storage and embedded functions

Cookies, local browser storage or session storage may be used for login, secure login return, sessions, chat access and selected display preferences. A verified webchat stores its access identifier in the relevant browser tab’s session storage. Loading an embedded QORLYNT booking window establishes a connection to QORLYNT.

Without an express “remember me” choice, the q_session cookie expires after no more than twelve hours. With that choice, a non-operator account session can last up to 30 days, ending earlier after seven days without activity. Operator accounts do not receive this option. Application access is time-limited within the session and renewed on permitted continued use; signing out or security changes may end it earlier. q_login for secure sign-in is valid for up to ten minutes. q-theme stores the display choice and q-selected-plan the selected plan in local browser storage; these entries have no automatic expiry of their own. Temporary connection/chat entries use session storage and are removed at flow completion or by the browser. Token validity is distinct from any retained security evidence.

When using the installable web app, a service worker is registered. Its offline cache contains only static information pages; signed-in pages, API responses, contacts, messages and credentials are not stored for offline use. Local browser storage (IndexedDB) may also hold the selected language and generic notification text. The lifetime of these browser records also depends on browser and device settings; they can be removed using the browser's data controls.

Storage or access strictly necessary for an expressly requested service is based on section 25(2) no. 2 TDDDG. Subsequent processing of personal data follows the applicable GDPR basis described here. Non-essential access requiring consent may take place only with consent under section 25(1) TDDDG; Article 6(1)(a) GDPR then applies to the personal data processing.

The product functions described here do not constitute blanket consent to advertising or tracking. Browser storage can be cleared in the browser, which may remove login, preferences or chat access. On other websites, the website operator’s notices also apply.

6a. Optional website statistics with Google Analytics

Our public website offers Google Analytics 4 as an optional statistics feature. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We load the Google script and send usage data only after your active consent. No Analytics requests are made without consent. The legal bases are section 25(1) TDDDG for device access and Article 6(1)(a) GDPR for personal data processing.

This covers visited public pages, timestamps, pseudonymous cookie identifiers and technical browser, device and connection data. Google processes the IP address transmitted when connecting; according to Google, GA4 does not store individual IP addresses. Our page-view measurement does not transmit URL query parameters, fragments or referrer addresses. The customer workspace, booking pages, staff access and calendar connection pages are excluded from this website measurement. Google Signals, advertising personalisation and enhanced automatic event measurement are not used.

Your separate statistics and Google Ads choices, version and timestamp are stored under qorlynt-consent in local browser storage and honoured for 180 days; expired or invalid choices do not authorise measurement. Analytics uses dedicated cookies with the qorlynt_ga prefix, configured to last no more than 180 days without renewal on every page view. Browsers may shorten this period. Event- and user-level detail data in GA4 is retained for two months; aggregated standard reports may remain longer.

Use Cookie settings in the footer to reject as easily as accept, choose statistics and advertising separately, change your choices or withdraw consent for the future. On withdrawal, we stop the affected measurement, remove its technically accessible cookies set through this website and reload the page. This does not automatically delete data already lawfully sent to Google. You can use the website without statistics.

Google may also process data in the USA, particularly through Google LLC. Transfers to US recipients certified under the EU-US Data Privacy Framework rely on the relevant adequacy decision; appropriate safeguards such as EU standard contractual clauses are used where required. Information on Google Analytics, data processing terms and privacy: https://support.google.com/analytics/answer/12017362, https://business.safety.google/adsprocessorterms/ and https://policies.google.com/privacy. Your rights described below remain unaffected.

6b. Advertising through Google Ads

Google Ads may be used to advertise QORLYNT. When ads are running, Google processes information about the ad and click under its own terms before a visitor reaches our website. When an advertised QORLYNT page is requested, campaign or click parameters may be part of the requested URL and thus technical server logs. Where separate consent is not required, our assessment of advertising and attribution of enquiries relies on Article 6(1)(f) GDPR; our legitimate interest is evaluating and conducting our advertising. Any separate access to device data for advertising purposes requires your consent where mandated by law.

A Google Ads base tag from Google Ireland Limited can load on public QORLYNT pages once a valid AW tag ID is configured and you have given separate advertising consent. Without this consent we load no Ads tag and send no cookieless Google Ads measurement pings. Consent to Google Analytics does not enable the Ads tag. The tag may process technical connection data, visited public pages and ad click identifiers and may set advertising cookies such as _gcl_*. Click identifiers from the requested URL may be used for attribution; our separate Analytics page-view measurement continues to omit URL query parameters and referrers. The legal bases for optional Ads measurement are section 25(1) TDDDG and Article 6(1)(a) GDPR. This website tag currently enables neither personalized advertising, remarketing nor enhanced conversions. A specific conversion event is sent only after a suitable Google Ads action has been separately mapped in the code. Upon withdrawal, we stop the tag, deny Ads consent signals, delete technically accessible host cookies set for this integration and reload; data previously sent to Google is not automatically erased. Google LLC in the USA may also be involved; the requirements for international transfers described in section 15 apply. Information: https://policies.google.com/privacy and https://business.safety.google/adsprocessorterms/.

7. Bookings, contacts, staff and operational planning

For multiple locations, operational data and permissions are assigned to one or explicitly several locations, including staff assignments, booking links, calendars, communication channels and location settings. Switching locations does not itself disclose data to another business; cross-location access follows assigned permissions. The customer must assess lawful cross-location use of staff data in particular.

Depending on use, QORLYNT processes names, e-mail addresses, phone numbers, contact identifiers, tags, custom fields, consent and blocking status, services, appointments, resources, assigned staff, opening hours, absences, notes, tasks, waiting lists and changes. Optional fields may include birthdays or service addresses.

Purposes include contact administration, booking and rescheduling, reminders, preparation, filling available appointments and operational planning. Reservations through public booking pages are verified by e-mail; private management links allow management of the relevant appointment and must not be shared publicly. If manual approval is enabled, the request remains stored as pending after e-mail confirmation and blocks that QORLYNT slot. We process the configured business recipient address, request, status and approval decision; notices go to the business and, after the decision, to the booking person. Approval alone creates the confirmed booking and any connected-calendar event. Rejection or cancellation releases the slot.

Importing contacts does not itself grant marketing consent. Grouping on-site appointments by postal information is not GPS tracking. Staff, absence and task information may be employment data; the business customer must assess the legal requirements.

We generally process this operational data on customer instructions. The business determines an appropriate legal basis, such as contract performance, permissible legitimate interests or required consent. Particularly sensitive information, such as diagnoses or health information, should not be entered in general notes or message fields. Its processing additionally requires a valid basis under Article 9 GDPR and suitable, agreed processing arrangements.

For CSV/Excel contact import, the selected file is initially parsed in the browser; the original file is not uploaded as a file. Mapped, normalized contact rows and necessary error/matching information are stored on the QORLYNT server as preview and job data for resumable imports before contacts are committed. Only express confirmation writes contacts; batches already applied can remain after a later cancellation. Cancelling a job removes its uncommitted preview rows; otherwise import jobs and staging data are cleaned up after seven days. Contacts already committed are unaffected. Unmapped source data is not imported. Import does not grant marketing consent or override existing messaging blocks.

8. Google Calendar and Microsoft Outlook

For explicitly configured online appointments, Google Meet or Microsoft Teams can create meetings in the selected organizer calendar and update them after changes or cancellation. Necessary appointment and attendee data, organizer and calendar identifiers and meeting links are processed and transferred to the connected provider. The calendar provider may send invitations; the meeting itself takes place with that provider. Meeting links are intended only for the designated participants. The QORLYNT integration does not enable meeting recording or transcription; provider features separately enabled by the organizer require their own assessment and notice.

We access selected calendars only after an initiated connection and authorization. Data includes provider/calendar identifiers, encrypted access and refresh credentials, selected calendars, event times, time zones, titles, availability, resources, synchronization status and, depending on function and authorization, event details and attendees.

Synchronization helps prevent conflicts and enables combined calendar views. Authorized write functions can create, move or cancel events. Optional attendee imports are separate from consent to receive messages. Mirroring QORLYNT bookings stores mapping and synchronization records.

You can disconnect in the portal. This stops normal use of that QORLYNT connection; existing provider events and necessary mapping records are not automatically deleted. Disabling a connection within QORLYNT does not necessarily revoke the app permission in Google or Microsoft.

Google information: https://policies.google.com/privacy. Microsoft information: https://privacy.microsoft.com/privacystatement. Relevant entities for their own European services include Google Ireland Limited and the entities identified in Microsoft’s contractual and privacy notices.

Authorization in a Google or Microsoft account is a technical access permission and does not replace the legal basis required for other individuals’ data. Google API data is additionally subject to the restrictions in the Google API Services User Data Policy: https://developers.google.com/terms/api-services-user-data-policy. Customers must not use connected workflows to sell this data, serve personalized advertising or conduct unlawful surveillance. The user-facing functions described here do not authorize unrelated uses of that data.

QORLYNT’s use of information received from Google Workspace APIs adheres to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including the Limited Use requirements: https://developers.google.com/workspace/workspace-api-user-data-developer-policy.

QORLYNT does not sell Google user data and does not use raw, aggregated or derived Google Workspace API data for advertising or profiling or to create, train or improve generalized, foundational or otherwise general-purpose artificial-intelligence or machine-learning models. QORLYNT also does not transfer such data to third parties for those purposes.

Where a QORLYNT feature actively initiated by the user processes authorized Google Workspace data using an AI service, only data required for that specific function is transferred. The processing is limited to providing or improving that specific user-facing QORLYNT functionality; QORLYNT does not make Google Workspace data available for training or improving generalized or foundational AI/ML models.

9. WhatsApp, Telegram, webchat and messaging

Connected channels process in particular phone numbers or chat/user identifiers, business/channel assignments, message content, templates, language, media links, timestamps, delivery status, consent and objections. Images may be uploaded to QORLYNT or linked from external HTTPS addresses. QORLYNT stores uploaded image files and their assignment; the generated sharing link allows retrieval without additional login. Anyone with the link can retrieve the image. Do not use these images for confidential content. External image hosts also receive connection data.

WhatsApp uses the business’s connected WhatsApp Business account and phone number. Telegram uses the connected bot. Webchat processes e-mail addresses, verification/access status, conversation content and limited session context. Starting a bot, importing a contact or simply using a chat does not replace required marketing consent.

Businesses can configure service messages, reminders and lawfully authorized campaigns. STOP or a contact block prevents further messages covered by that block. Marketing e-mails require an appropriate legal basis and compliance with applicable direct-marketing rules; technical activation or a QORLYNT contact record does not provide one. Messages already transmitted cannot reliably be recalled this way. A messaging block does not automatically delete the entire customer relationship.

WhatsApp/Meta services and Telegram also process data as independent controllers. Provider information: https://www.whatsapp.com/legal/privacy-policy-eea and https://telegram.org/privacy. Telegram bot communication is not an end-to-end encrypted Secret Chat; business API processing for WhatsApp likewise requires participating business systems to access message content.

When an existing WhatsApp Business App is separately connected, existing contacts and shared message history may be imported, and messages sent in the Business App may be copied into QORLYNT, depending on the permissions granted there and the supported connection mode. This can include phone numbers, available contact names, message identifiers, text, timestamps and message direction. In the implemented workflow, historical import neither creates marketing consent nor automatically triggers an AI reply. Removing an address-book contact in the Business App does not automatically delete the corresponding QORLYNT record.

10. Automations and general integrations

Optional Teams notifications and the Teams bot process Microsoft tenant, user, conversation and destination identifiers, linkage to an authorized QORLYNT account, selected events, commands, responses and delivery records. The configured destination and permitted features and locations determine which operational data reaches a Teams channel or chat. The customer must check the destination's participants. Linking does not replace QORLYNT permissions; designated confirmations are required for write actions.

Through the optional MCP connector, external AI applications authorized by the customer can retrieve permitted operational data and request allowed actions. This creates client, permission, location, request and confirmation records. The external AI provider receives the data returned by the authorized tool and processes it under its own terms. Read-only access can also transfer personal data. Before authorization, the customer must assess the provider's role, agreement, retention and transfer basis and limit permissions to what is needed. Revocation ends that QORLYNT authorization but does not erase data already transferred to the external provider.

Incoming and outgoing webhooks can connect services such as Make or customer-operated automation systems. Depending on the permitted event or command, processing includes appointment, contact, callback, handoff and status data, field mappings, destination addresses, signature/authorization records and retry logs. The customer chooses recipients, actions and locations. Logs and stored responses can contain personal data and require a separate retention assessment. Sending a test to an external destination is already a transfer; use appropriate test data.

Optional Google review requests use the business's configured link, necessary contact and appointment details, channel and template settings, and sending, suppression and retry records. Setting the link alone does not enable automatic dispatch. Review invitations can constitute advertising; a booking or existing contact does not replace required consent. The customer must assess applicable conditions, particularly section 7 of the German UWG. Opening a review link sends connection data to Google and may associate an account if signed in; the individual publishes any review at Google under its terms.

Enabled automations process workflow definitions, versions, triggers, inputs, results, execution times, status/error information, permissions and usage. The configured connection and action determine what is transmitted. External actions can have real effects, such as sending an e-mail or changing a calendar event.

General Google/Microsoft integrations differ from calendar-only connections: authorized automations can additionally read or send e-mail; the Microsoft integration can also read and modify contacts. SMTP/IMAP connections process configured server/account credentials and message content or metadata needed for sending or retrieval. IMAP polling is a configured automation source, not a blanket import of all historic e-mail.

Separately configured OpenAI, Stripe or HTTP connections may process the content and provider identifiers selected for the workflow. Customer API keys are stored with protection. Customers must assess recipients and transfers for each workflow. Merely displaying an inactive integration in the catalog does not trigger data retrieval.

Separately activated external integrations can exchange contacts, availability and appointments via REST or WebSocket and schedule permitted messages. Optional outbound webhooks send selected appointment events to the HTTPS recipient configured by the business; authorized retrieval may additionally include contact details. Processing also includes field mappings, external object identifiers, versions, command and event identifiers, permissions, connection/delivery status, error and retry records and usage counters. Access tokens are stored as hashes and webhook signing keys are encrypted. The business determines the recipient and permitted purposes and must assess that recipient’s role, legal basis and any international transfers. External import does not grant new messaging consent.

11. AI functions and OpenAI

Product AI uses the OpenAI API. Depending on the function, instructions, business knowledge, service information, selected contact context, business and setup settings, authorized calendar information or limited customer/assistant conversation history are transmitted to OpenAI. Responses, proposals and usage may be stored in QORLYNT for that function. The general OpenAI integration instead uses the customer’s configured credentials and workflow-selected data.

Where an expressly initiated AI function requires authorized Google Workspace data, QORLYNT limits the transfer to content required for that specific function. QORLYNT neither uses Google Workspace data to build, train or improve generalized or foundational AI/ML models nor makes such data available for that purpose. This restriction also applies to information derived from Google Workspace data.

The staff assistant provides answers and proposals; write actions require the specified confirmation. In enabled customer conversations, AI replies may be sent automatically. Booking and callback proposals are implemented only after the required express confirmation. Staff can pause AI processing for a contact.

For direct AI customer conversations, the webchat is identified as an AI chat before a message is entered; automatically sent replies on connected messaging channels carry the label “AI assistant” in the intended flow. Customers must not remove or obscure this notice to their conversation partners. Text-based product AI requests disable storage of responses as retrievable API state (store: false). This is not a promise that OpenAI stores no data: provider security and abuse-prevention processes may still process content and metadata. Actual retention and regional conditions depend on the applicable OpenAI agreement and account configuration. Information: https://openai.com/policies/privacy-policy/ and https://developers.openai.com/api/docs/guides/your-data.

For processing on customer instructions, the business determines the legal basis and informs conversation partners about AI use. The platform is not intended for solely automated decisions with legal or similarly significant effects under Article 22 GDPR. AI can make mistakes; professional or legally significant decisions must not be adopted from its responses without review.

Where enabled, conversation analysis may suggest tasks or next steps from commitments expressly made by a customer. The related quotation and an explicitly stated deadline may be stored. These are suggestions for staff review, not binding assessments of the individual. Whether automated processing falls under Article 22 GDPR depends on its actual effects; describing it as assistance does not itself exclude that provision.

11a. Optional AI telephone answering (Voice)

When Voice is enabled, an AI assistant answers incoming calls or calls forwarded by the business. Twilio provides the telephone connection and SIP routing; OpenAI processes speech in real time for understanding and voice output. Call audio and necessary conversation context are transmitted, including business information, opening hours, services, prices and appointment availability. Call identifiers, connection status, duration, usage and confirmed booking or callback details are processed for those purposes. Caller ID or a spoken name is not verified identity and does not authorize disclosure of existing customer records.

Providing a telephone number requires the business name, address, contact and local area details and registration or identity evidence requested by Twilio. These are sent to Twilio. QORLYNT encrypts local registration details and uploaded evidence. Local document originals are removed after successful evidence approval; local registration details are deleted when number provisioning succeeds. Details needed for pending verification or provisioning remain available to continue that process. Twilio may retain evidence and connection details longer under its own legal and contractual requirements.

QORLYNT does not store call recordings or complete conversation transcripts in this function. Confirmed appointments, callback tasks and any notifications remain business records. Temporary tool results are deleted after seven days and local call metadata after 90 days, measured from the earlier of confirmed completion and the scheduled call deadline. Appointments, contacts, tasks, invoices and security records have separate retention rules. Local deletion does not automatically delete data at Twilio or OpenAI. Providers may process data for operations, security, abuse prevention and legal obligations; actual retention also depends on contracts and account configuration.

The business determines the legal basis for caller data and gives callers understandable information about AI answering, purposes, recipients and privacy notices before the relevant processing. The assistant is instructed to introduce itself explicitly as an AI assistant at the start; this identification must not be concealed. An incoming call does not imply marketing or messenger consent. Callback notifications go only to the business-configured recipient; a saved callback request guarantees neither delivery nor a callback at a particular time.

Our necessary contract and connection administration relies on Article 6(1)(b) or (f) GDPR depending on the person, and legally required evidence on Article 6(1)(c). Business data is processed on customer instructions under the DPA. Depending on the data and purpose, Twilio acts as a processor or an independent controller, including for certain connection, traffic, security and legal purposes. OpenAI provides product speech processing. The engaged legal entities, processing locations, authorizations and transfer safeguards must be specified in the applicable contractual documents and subprocessor register. EU hosting of the core platform or an EU endpoint does not promise exclusively European processing of all telephony data. Information: https://www.twilio.com/en-us/legal/privacy and https://www.twilio.com/en-us/legal/data-protection-addendum and the OpenAI information above.

Voice is intended for general business enquiries, appointment intake and callback requests. Emergency calls, medical advice and processing of particularly protected content are not offered as standard services. Such use requires a separate legal basis and prior assessment of suitable additional contractual and technical safeguards.

12. Contact, website assistant and support tickets

For enquiries, we process contact information, content, any company assignment and handling history. Contract-related enquiries are processed under Article 6(1)(b) GDPR; business contacts and general enquiries under Article 6(1)(f) GDPR, for appropriate communication and troubleshooting. Our business and support mailboxes are hosted by Microsoft 365/Exchange and accessed through Outlook. Microsoft processes sender and recipient addresses, email content and attachments even when email is only received and stored. We use Teams for online setup assistance and support meetings. AWS domain management and automated QORLYNT email delivery through AWS SES are separate services. Sender and recipient addresses, content, meeting and file details and technical usage data may be transmitted to Microsoft. Customer-connected Microsoft accounts for QORLYNT calendars and workflows are separate; Microsoft's role in processing on the customer's behalf must also be assessed where support involves commissioned data. Information: https://privacy.microsoft.com/privacystatement.

The public website assistant answers predefined product questions locally in the browser without calling OpenAI. Only expressly submitting a support ticket transmits the contact information and visible conversation to QORLYNT. Article 6(1)(a) GDPR applies to any separately requested voluntary consent in the form. Alternatively, you can contact us directly by e-mail.

The public cancellation form processes name and business, contact e-mail, supplied contract identifier, type and where relevant reason for cancellation, optional requested end date, declaration, receipt timestamp and delivery status as contract evidence. The immediate on-screen receipt can be saved; e-mail confirmation is sent or retried if delivery fails. Authorized staff subsequently check the affected contract and its termination. Article 6(1)(b) GDPR applies to an individual contracting party, point (f) to business contact persons (contract handling and evidence), and point (c) also applies where there is a legal obligation. Marketing consent is not required. Support tickets are stored in QORLYNT and handled by authorized staff. If internal forwarding is enabled, a copy may be transferred to another Smart TB Tech support system; deletion must then consider both systems. Please do not include passwords, API keys or unnecessary customer data in support messages.

For reports submitted through “Report a problem or suggest an idea” in the signed-in app, the server associates the ticket with your user account and company. We process the account name and email address, report type, title, description, voluntarily attached images, app section, available release identifier, timestamps, processing status and replies. Images are resized in the browser before upload. No screenshot is captured automatically and no chat history is imported automatically. The sender and authorized internal support staff can access the report and images; other team members do not receive access through this feature. Processing serves troubleshooting, support and assessment of improvement suggestions. The legal basis is Article 6(1)(b) GDPR where the data subject is the contracting party, otherwise Article 6(1)(f) GDPR for necessary support of business contacts and product improvement. App reports are not automatically forwarded to the optional external ticket export system. Receipts and internal notifications use the platform email delivery described below; report bodies, freely entered titles, images and conversation replies are not automatically copied into these emails. Replies and status are available under “My reports”. Please limit voluntary information to what is necessary and check images for unnecessary personal data.

For configured transactional e-mails, such as booking/chat verification, account security messages, support receipts and internal ticket notifications, QORLYNT uses Amazon SES (AWS). Customer-initiated sending through the optional QORLYNT sending address also uses SES. To prevent repeated platform messages, we retain the organization reference, technical fingerprints and sending status in a delivery ledger without recipient addresses, message bodies or access tokens. The ledger is retained for duplicate detection; its retention and erasure are reviewed together with the associated delivery jobs. Amazon SNS forwards related delivery, bounce and complaint events to QORLYNT. SES sending and its associated SNS topic use the AWS region configured for that service; a separately connected SMTP account uses its own provider. For a QORLYNT sending address, we process the assigned sender address, a reply address derived from a verified account identity, recipient address, subject, message content, sending time, provider reference and delivery, bounce and complaint records. Bounces and complaints may suppress further delivery to the affected address. The sending address is not a mailbox and does not receive incoming mail; replies go to the customer's displayed existing mailbox. Messaging to the customer's recipients generally follows customer instructions under its data-protection responsibility as explained in section 2; the customer must assess the legality of marketing messages in particular. Smart TB Tech's own transactional messages serve the requested function and do not automatically constitute marketing. Provider information: https://aws.amazon.com/privacy/ and https://aws.amazon.com/compliance/gdpr-center/. A configured European AWS region is not a promise of exclusively European processing of all administrative and support data; section 15 continues to apply.

13. Abuse protection using Cloudflare Turnstile

We use Cloudflare Turnstile to protect public forms, including booking, chat and support forms. This establishes a connection to Cloudflare, Inc., USA. Technical connection/browser signals and verification results are processed to detect automated or abusive requests. A form requiring verification cannot be submitted without a successful check; e-mail is available as an alternative for our own support enquiries.

Our necessary abuse protection is based on Article 6(1)(f) GDPR. Device access is assessed separately under section 25 TDDDG: the necessary-access exception applies only where its statutory requirements are actually met. Cloudflare describes processing on behalf of website operators for protection and independent controllership for improving bot detection. Details: https://www.cloudflare.com/turnstile-privacy-policy/.

14. Subscriptions, payments and usage accounting

QORLYNT contracts involve company/billing information, selected plan, contract version, customer/subscription/payment identifiers, invoices, payment/termination status and purchased allowances. Usage meters record booking, messaging and AI consumption to enforce agreed limits and investigate errors.

Where the optional personal setup service is purchased, we additionally process order and payment status and e-mail contact details to schedule and conduct a Microsoft Teams appointment. Microsoft and the relevant communication services may process connection and usage data necessary for the meeting. The legal bases below apply to the necessary contract and business contact processing; the following Stripe notice applies to payments.

Stripe is used for checkout, subscription administration and payment reconciliation. Payment details are entered in the payment interface; QORLYNT receives identifiers and status needed for contract administration, not the full card number or security code. Stripe also processes data for its own payment, security and statutory purposes. Information and relevant entities: https://stripe.com/privacy.

Legal bases are Article 6(1)(b) GDPR for a contract with the individual, Article 6(1)(f) GDPR for necessary processing of business contacts, abuse prevention and evidence, and Article 6(1)(c) GDPR for statutory duties. A customer’s Stripe connection for its own automations is separate from QORLYNT billing.

15. Recipients and international transfers

Where necessary and lawful, recipients include authorized staff, technical processors, expressly connected integration providers and professional, payment or public bodies. Connected systems receive the data transmitted for their functions; credentials are not required as general AI context.

AWS, Cloudflare, OpenAI, Twilio, Meta/WhatsApp, Telegram, Google including Analytics and Ads, Microsoft including Microsoft 365 and Stripe may involve processing or access outside the EU/EEA. A European contractual entity or server location does not rule this out. Transfers must satisfy Articles 44 et seq. GDPR, for example an applicable adequacy decision or appropriate safeguards, particularly standard contractual clauses with any necessary additional measures.

An adequacy decision for certified US companies applies only to the entity and processing actually covered. Selecting a provider or granting OAuth authorization is not blanket consent to unprotected international transfers. You can request information about the safeguards used in a specific case and a copy from our privacy contact, with protected information redacted where necessary.

15a. Protection of sensitive data and Google API data

QORLYNT protects sensitive personal data and data obtained through connected Google APIs using technical and organizational safeguards appropriate to the relevant risk and the functions actually enabled. Data access is tenant-scoped and controlled by roles and permissions; ordinary users do not receive general access to other tenants or to stored credentials.

OAuth access and refresh tokens and comparable provider secrets are processed server-side and stored in encrypted form or in designated protected credential stores. Google Calendar authorization uses short-lived bound OAuth state and PKCE. Credentials are not exposed in plaintext through normal user interfaces or ordinary application APIs.

Transfers between the browser, QORLYNT and connected Google or other provider APIs use encrypted HTTPS/TLS connections. QORLYNT limits processing to data required for the relevant functionality and uses authorization checks, tenant isolation and security- or function-related logging to prevent or help trace unauthorized access.

Connections can be disconnected in QORLYNT; where necessary, the external app permission must also be revoked with the relevant provider. Security measures, permissions and retention are adjusted as functionality, risks or legal requirements change. No technical process can eliminate every risk; identified security incidents are handled in accordance with applicable legal and contractual requirements.

16. Retention, data maintenance and backups

Account and contract data is processed to perform the contract and complete necessary follow-up. Customer operational data follows customer instructions and the agreed deletion policy. For a QORLYNT sending address, the reserved sender name remains blocked after disconnection to preserve its unique assignment; it is not automatically reassigned. Bounce and complaint records and resulting recipient suppressions may remain to prevent repeat failed deliveries and complaints. Whether and when personal elements of these records must be erased or anonymized requires a separate assessment of purpose, customer instructions and statutory rights. Configurable retention for certain message content, media links, AI caches and related records is not an automatic deletion period for all contacts, appointments, logs or billing evidence.

Security events in personal accounts are removed by the current cleanup process after 90 days. Expired session records are removed by the current cleanup process 30 days after expiry once they no longer contain encrypted provider credentials required for revocation. A signed-out or revoked session may become technically invalid earlier; these periods describe the retention of records, not the validity of access. Closing an app report does not erase its text, images or replies. Customer-message retention settings and personal account deletion do not automatically erase this support data. Privacy requests about reports can be sent to our privacy contact with the ticket reference; handling also covers relevant copies in mailboxes, delivery records and backups. Support and other technical data is deleted when no longer needed unless necessary troubleshooting/security investigations, statutory retention or specific legal claims require retention. Statutory retention applies only to relevant documents: typically eight years for accounting vouchers, six years for business correspondence and ten years for books and accounts under section 257 HGB and section 147 AO. The start, exceptions and permitted extensions follow the law. These periods do not justify blanket retention of all chats or contacts.

Evidence needed for legal claims may be retained during applicable limitation or pending proceeding periods. Access and use must be limited to that purpose.

Backups are separate from live data. Portal deletion does not immediately remove data from existing backups. Backup copies must also be removed under the established backup/deletion procedure; necessary deletions must be reapplied following restoration. Information about the specific processing status and remaining copies is available on request. The Data deletion page explains available routes.

A statutory right to erasure does not depend on first closing an account or cancelling a paid service. Where processing is no longer necessary or lacks a legal basis and no statutory exception applies, the data concerned must be erased without undue delay. The one-month response period is not a general minimum retention period or a blanket waiting period for erasure.

17. Your rights and handling requests

Subject to statutory requirements, you have rights of access including a copy (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and portability (Article 20). Where correction, deletion or restriction is required, we observe recipient notification duties under Article 19 GDPR.

You may withdraw consent at any time for the future without affecting prior lawful processing. For processing based on legitimate interests, you may object on grounds relating to your particular situation (Article 21(1) GDPR). You may object to direct marketing, including related profiling, at any time without giving reasons (Article 21(2) and (3) GDPR).

Requests are generally free of charge. We respond without undue delay, generally within one month of receipt. Any legally permissible extension by up to two further months is explained within the first month. Where reasonable doubts exist, we may request necessary additional identity information; please do not send unsolicited identity document copies or secrets.

For data controlled by a QORLYNT business customer, please contact that business where possible. You may still contact us; we help identify the relevant business and assist on its instructions. Lack of portal access does not exclude your rights.

Data portability covers personal data concerning you that you provided, where processing is automated and based on consent or a contract. Under these conditions, you receive the data in a structured, commonly used, machine-readable format and may request direct transmission to another controller where technically feasible and without adversely affecting others’ rights. This right is distinct from access rights and from a business customer’s contractual or statutory export rights.

Following an objection based on your particular situation to processing under Article 6(1)(f) GDPR, we stop the processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing serves legal claims. An objection to direct marketing is not subject to that balancing exercise: processing for that marketing purpose, including related profiling, stops. On request, we inform you about recipients notified of rectification, erasure or restriction under Article 19 GDPR.

18. Supervisory authority and updates

You may lodge a complaint under Article 77 GDPR with a supervisory authority, particularly where you live, work or consider an infringement occurred. Our generally competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach: https://www.lda.bayern.de.

We update these notices when relevant circumstances change. The stated date identifies the text version. A new privacy policy does not replace required consent or automatically amend existing contracts.