Privacy Policy

1. Overview

This policy describes what QBRkit ("we", "us") collects and how it is used. The short version: we collect what is needed to run the service, we do not sell your data, and we do not run ads or third-party trackers.

2. What we collect

Account data. Your email address and a hashed version of your password. Passwords are stored using scrypt hashing and are never stored in plain text.

Product data. The content you put into QBRkit:

• Client names and the IT metrics, targets, and notes you enter or upload by CSV.
• Answers you provide in self-assessment modules and the scores generated from them.
• Shareable report links you generate. Anyone with a report link can view that report, so share links carefully.

Logs. Standard server logs, including IP address, request path, and timestamp, kept for security and debugging.

3. Cookies

QBRkit sets a single signed session cookie so you stay logged in. There are no advertising cookies, analytics trackers, or fingerprinting.

4. Payments

Paid plans are billed by Stripe. Your card details go directly to Stripe and never touch our servers. We receive only your subscription status and a Stripe customer reference.

5. Service providers

We use a small number of providers to run QBRkit: Stripe for payments, Cloudflare for networking and DDoS protection, and a transactional email provider for emails the product sends. Data is stored on servers in the United States. We share data with these providers only as needed to operate the service.

6. How we use data

To provide the service, secure it, fix problems, and communicate with you about your account. We do not sell personal data and we do not use your product data to train AI models.

7. Retention and deletion

Your data is kept while your account is active. To delete your account and its data, email [email protected] and we will remove it within 30 days, except minimal records we must keep for legal or billing reasons.

8. Security

All traffic is encrypted over HTTPS, passwords are hashed with scrypt, and access to production systems is restricted. No system is perfectly secure, so use a strong, unique password.

9. Children

QBRkit is a business tool and is not directed at children under 16. We do not knowingly collect their data.

10. Changes

If this policy changes materially, we will note it here and update the effective date.

11. Contact

Privacy questions or requests: [email protected].