Privacy policy

1. Who we are and our two roles

Qnal is the capture, follow-up and proof system for trade-show exhibitors, provided by [Qnal legal entity name and registered address, to be confirmed] ("Qnal", "we", "us"). This policy explains how we handle personal information on qnal.com, in the Qnal app, and in the booth pages, forms and QR codes our customers publish with Qnal.

We handle personal information in two different roles:

• As a controller for our own website, our customers' account and user data, and the requests people send us through the request-access form. We decide why and how that information is used.
• As a processor (or service provider) for the lead data our customers collect at trade shows and events with Qnal. The exhibitor that collected the lead decides why and how it is used, and its own privacy notice applies. We process that data only to provide Qnal to that customer and on its instructions.

If you gave your details to an exhibitor at a booth, the exhibitor is the right first contact for questions about your data. See Your rights and privacy requests for how we help.

2. What we collect

Account data

When a customer's team uses Qnal, we collect each user's name, work email address, organization, workspaces and role (owner, admin, editor or analyst). We keep a log of security-relevant actions such as sign-ins, API key changes, follow-up approvals and sends. When a user connects a mailbox, CRM or webhook, we store the credentials Qnal needs to act for them, encrypted at rest.

Request-access submissions

When you ask for access on qnal.com, we collect your name, work email, company, how many shows you exhibit at each year, your CRM, and the email provider your reps use, together with your consent choice, the exact consent wording you saw, and when you gave it. The form runs on Qnal: your submission is stored as a lead in Qnal's own organization, with the same protections our customers' leads receive.

Lead data processed for customers

Depending on how an exhibitor uses Qnal, lead data can include:

• contact details a visitor enters on a booth page, form or kiosk, such as name, email, company and phone number;
• details a rep captures at the booth, such as a badge or business card photo, a voice note, notes and a hot, warm or cold rating;
• rows from the event organizer's badge-scan export, imported by the exhibitor;
• target-account lists and pre-show meeting invitations;
• follow-up drafts, approvals, send status and replies, meetings, and deals synced from the exhibitor's CRM.

Each raw capture is kept as a record of where the lead came from, and captures of the same person are merged into one lead with the history of each merge.

Booth page, link and QR code visitors

When someone scans a Qnal QR code, opens a Qnal link or views a hosted booth page, we record the time, which link, QR code and placement was used, the referring page, an approximate location (country, region and city) derived from our hosting provider's request headers, and the device type, operating system and browser parsed from the user agent. We do not store the full user agent.

We do not store IP addresses. To estimate unique visitors, we combine the IP address and user agent with a random value (a salt) that changes every day, and keep only the resulting one-way hash. Each daily salt is discarded after two days, after which that day's hashes can no longer be linked to later visits. Unique-visitor numbers are labeled as estimates. Redirects from Qnal links and QR codes set no cookies.

3. How we use information

For the information we control, we use it to:

• provide, secure and support the Qnal service and our customers' accounts;
• reply to your request for access and, if you agreed, email you about your request and about Qnal;
• detect and prevent abuse, such as spam submissions and links to unsafe destinations;
• send service messages, such as sign-in links, alerts and escalations;
• understand how the service is used, using counts that do not identify individuals;
• meet our legal obligations and enforce our terms.

[Legal bases for each purpose under GDPR and UK GDPR, to be confirmed by counsel.] We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use customers' lead data for our own marketing, and we do not use it to train machine learning models.

4. Lead data we process for customers

For lead data, we act on the exhibitor's instructions as set out in our agreement with them. The exhibitor is responsible for telling the people it meets how their information will be used, and for having a lawful basis, including any consent required, to collect it and to contact them. Qnal provides tools that help, such as consent capture, consent records, suppression and unsubscribe links, but these tools do not by themselves make any message lawful.

Follow-ups to leads are drafted in Qnal, approved by the rep who owns the lead, and sent once from that rep's own connected mailbox. They are not sent from a Qnal email domain. [A data processing agreement is available to customers on request, to be confirmed by counsel.]

5. Consent records

When a person gives consent through a Qnal form, kiosk or rep capture, we store a consent record for each purpose (for example, a post-show follow-up or marketing), with the exact wording the person saw, when they agreed, where the consent was captured, and the jurisdiction that applied. Consent records are kept as evidence. Users cannot delete them; they can only mark a consent as withdrawn. If a lead is deleted, its consent records remain, linked to a hashed email address instead of the person's details, so the exhibitor can still show what was agreed.

6. Unsubscribe and suppression

Every follow-up sent through Qnal includes an unsubscribe link. When you unsubscribe, we add your email address to the sending exhibitor's suppression list. Suppressed addresses are stored as a salted hash, not in readable form, and are checked before every send. A suppression survives the deletion of the lead, so you are not emailed again if you reappear later, for example in next year's badge export. Only a new, express consent from you lifts it.

To stop emails from Qnal itself, use the unsubscribe link in the email or write to hi@qnal.com.

7. Cookies

The Qnal app uses cookies that are needed to keep you signed in and to protect your session. The qnal.com marketing pages do not use third-party advertising or analytics cookies. Redirects from Qnal links and QR codes set no cookies. Some features an exhibitor turns on for its hosted pages may set a first-party cookie, for example to keep a visitor on the same version of a page. If this changes, we will update this section.

8. Subprocessors and sharing

We use a small number of service providers to run Qnal. By category:

We will share the current list of named subprocessors on request at hi@qnal.com. [Advance notice of new subprocessors, to be confirmed by counsel.]

When a customer connects a mailbox (Google Workspace or Microsoft 365), a CRM (HubSpot or Salesforce), EA AI Cloud, its own webhooks or the Qnal API, we send data to those services at the customer's direction. Those services are chosen by the customer and governed by the customer's own agreements with them. If a lead is deleted in Qnal, copies already sent to those services are not deleted by Qnal.

We may also disclose information when the law requires it, to protect the rights and safety of our users and the public, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to the information transferred.

9. Where data is stored

Qnal stores data in the United States. If you are outside the United States, your information is transferred to and processed in the United States. [Transfer safeguards for people in the EU, UK, Canada and elsewhere, to be confirmed by counsel.]

10. How long we keep data

• Account data: for as long as the account is open, then deleted after the organization is closed. [Post-closure period, to be confirmed.]
• Request-access submissions: until you ask us to delete them or they are no longer needed. [Period, to be confirmed.]
• Lead data: for as long as the exhibitor keeps it in Qnal. When a lead is deleted, it disappears from the app right away and is permanently removed, with its photos and files, within 30 days.
• Visit events: for the period the exhibitor sets for its workspace, by default 400 days, adjustable from 30 to 1,095 days. Daily totals that contain no personal information are kept for the life of the workspace.
• Exports: generated files expire after 7 days. Technical logs: API request logs are kept for 14 days and webhook delivery logs for 30 days.
• Consent records and suppressions: kept as evidence, as described above, so that a withdrawal or unsubscribe keeps working.

11. Security

Each organization's data is separated at the database with row-level security, credentials for connected services are encrypted at rest, API keys are shown once, webhook deliveries are signed, and security-relevant actions are logged. Our security page describes these controls in more detail. No system is perfectly secure. Qnal does not hold a SOC 2 or other security certification today. [Breach notification commitments, to be confirmed by counsel.]

12. Your rights and privacy requests

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict how it is used, to withdraw consent at any time, and to complain to your data protection authority. We will not treat you differently for using these rights.

To make a request, email hi@qnal.com. We may need to confirm your identity first, and we will respond within the time the law that applies to you requires.

If your request is about lead data an exhibitor collected, please contact that exhibitor. If you write to us instead, we will tell you which of our customers holds your data where we are allowed to, pass your request on, and help the customer answer it. Customers can find a person by email in Qnal, export that person's data as JSON, or delete it.

13. Children

Qnal is a business service and is not intended for anyone under 16. We do not knowingly collect personal information from children under 16, and customers must not use Qnal to capture leads from them. If you believe a child's information is in Qnal, contact hi@qnal.com and we will work with the customer to delete it.

14. Changes to this policy

We will post any change on this page and update the date at the top. If a change is material, we will also tell account owners by email before it takes effect.

15. Contact

Questions or requests: hi@qnal.com. Postal address: [to be confirmed]. [Representative in the EU or UK, if required, to be confirmed by counsel.]