---
title: "Qualy's Privacy Policy"
description: "What personal data Qualy collects, why, how long it is kept, and the rights you have over it."
updated: "Draft — version 2026.1 · Pending legal review"
lastModified: "2026-09-10"
lang: "en"
wordCount: 2167
url: https://qualyhq.com/privacy-policy
---
## Site navigation

- [For schools](/international-education/for-schools.md) — For international education schools
- [For agents](/international-education/for-education-agents.md) — For international education agents
- [Explore](/training.md) — Watch videos on how to use Qualy
- [About](/about.md) — Learn about Qualy's mission and values
- [Pricing](/pricing)
- [5-min demo](/demo.md)
- [Login](https://dashboard.qualyhq.com)

# Qualy's Privacy Policy

> What personal data Qualy collects, why, how long it is kept, and the rights you have over it.

This policy explains what we do with personal data we are responsible for.

There are two different situations, and it matters which one you are in.

**You have a Qualy account, or you visit our website.** We decide what happens to your data, so we are responsible for it. **This policy covers that.**
**You paid a school or an agent who uses Qualy.** They decide what happens to your data and we handle it on their instructions. **Their privacy policy applies, not this one** — though the section on [paying through Qualy](#if-you-paid-someone-through-qualy) tells you what we do and who to contact.

## Who we are

**Qualy Services OÜ** is responsible for your personal data, wherever you are:

> Qualy Services OÜ · registration 16558543
> Sepapaja tn 6, 15551 Tallinn, Estonia

We also have companies in Australia and Brazil. They exist to connect to local payment providers, and they handle payment data in those markets. They are not who you contract with, and this policy covers all of them. **They are also our local points of contact**, so you do not have to write to Estonia to reach us:

| | |
| --- | --- |
| **Brazil** | Qualy Services Brazil LTDA · CNPJ 58.720.637/0001-32 — our representative for the LGPD, alongside the *Encarregado* named below |
| **Australia** | ELBOW 48 PTY LTD · ABN 76 648 713 302 — our contact for the Australian Privacy Principles and the Notifiable Data Breaches scheme |

Whichever you write to, the address is [privacy@qualyhq.com](mailto:privacy@qualyhq.com) and it reaches the same team.

Which privacy law protects you does not depend on which company you deal with — it depends on where you are. If you are in Brazil the LGPD applies, if you are in Australia the Privacy Act applies, and if you are in the EU the GDPR applies, whichever Qualy company is handling your data.

Reach us at [privacy@qualyhq.com](mailto:privacy@qualyhq.com) for anything about personal data — that address also reaches our *Encarregado* under the LGPD — or [support@qualyhq.com](mailto:support@qualyhq.com) for everything else.

## What we collect, and why

### If you have a Qualy account

| What | Why | Our legal basis |
| --- | --- | --- |
| Name, email, phone, job title, profile picture | Running your account and letting your team sign in | Performing our contract with you |
| Password credentials and login history | Keeping the account secure | Performing our contract, and our legitimate interest in security |
| Your company's business details, and identity documents for the people who own or control it | Verifying who we are dealing with, as financial regulation requires | Complying with a legal obligation |
| Bank account details for receiving payouts | Paying you the money you collect | Performing our contract |
| Billing contact and payment method | Charging you for your subscription | Performing our contract |
| How you use the product — pages, features, actions | Understanding what works and fixing what does not | Our legitimate interest in improving the product |
| Support conversations, including chat and email | Helping you when you ask | Performing our contract |

### If you visit qualyhq.com

| What | Why | Our legal basis |
| --- | --- | --- |
| Pages viewed, referring site, approximate location from IP | Understanding what people look for | Your consent, where required, through the cookie banner |
| Anything you type into a contact or demo form | Replying to you | Taking steps at your request before a contract |

We do not sell personal data. We do not share it with advertisers.

## If you paid someone through Qualy

If you are a student, a parent, or anyone paying a school or agent, then **that school or agent decides what happens to your data**. Ask them for their privacy policy, and send requests about your data to them.

What we do with it on their behalf:

We hold your name, contact details, the payment records, and any document that was uploaded about your enrolment.
We pass what is needed to the payment provider handling your payment — including your **billing address and IP address**, which providers use to check the payment is genuine, and which cross-border payments are legally required to carry. Those providers are listed at [payment processors](/payment-processors.md).
We may use automated processing to read a document about you — see [below](#how-we-use-artificial-intelligence).

If you contact us directly we will acknowledge you, tell you who the controller is, and pass the request to them. Where Australian law applies we also have our own obligations to you directly, so we will respond within 30 days and give written reasons if we cannot help — and where the request concerns data we are responsible for ourselves, we answer it.

## How we use artificial intelligence

We use automated processing, including machine learning models, in a few places:

**Reading documents.** When a letter of offer or similar document is uploaded, a model reads it and pulls out the payment schedule — the amounts, the dates, and what they are for. To do that it processes whatever the document contains, which typically includes a student's name, date of birth, contact details and course, and sometimes an identity document number printed on the page.
**Matching names** against records already held, so the same person is not created twice.
**Helping our support team** draft and summarise.

What we commit to:

**A person reviews the result before it is acted on.** No decision with a legal or similarly significant effect on anyone is made by a model alone. Nothing is used to assess creditworthiness, eligibility or admission.
**Your data is not used to train models.** For each provider we rely on either a data processing agreement prohibiting it, or a technical setting that excludes providers who train on inputs. The [sub-processor list](/subprocessors.md) records which applies to each, and where neither is yet in place it says so.
**We are reducing what is sent.** Where a task does not need to know who a person is, identity fields are removed before the request leaves our systems. This runs today on part of the extraction pipeline and is being extended to the rest; the [sub-processor list](/subprocessors.md) states what each provider currently receives.
**The providers are named.** They are on our [sub-processors](/subprocessors.md) page, with what each receives and where it processes.

Customers who would rather their documents were not processed by a provider outside our own first-party infrastructure can ask us. We will confirm within 10 business days whether we can configure their account that way, and where we cannot we will say what the alternative is.

## Who else sees your data

Everyone we share personal data with is listed, with what they receive and where they process it:

**[Sub-processors](/subprocessors.md)** — the companies that help us run the platform.
**[Payment processors](/payment-processors.md)** — the licensed providers that actually move the money.

We also share data where the law requires it — with regulators, or in response to a valid legal request — and with professional advisers under confidentiality. If Qualy is ever sold or reorganised, data may transfer as part of that, and this policy continues to apply until you are told otherwise.

## Sending data to other countries

Running an international payments platform means data crosses borders.

Where data goes to a country without an adequacy decision, we put an approved safeguard in place — European Commission Standard Contractual Clauses, the ANPD's standard clauses for Brazil, or another mechanism the law allows. The safeguard that applies to each company is shown on the [sub-processors](/subprocessors.md) page.

**For Australia:** we take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles, and we remain accountable under section 16C of the Privacy Act 1988 for what they do with it.

## How long we keep it

| What | How long | Why |
| --- | --- | --- |
| Financial and transaction records | **10 years** | Tax and anti-money-laundering law requires seven; we keep ten because that is how long a claim about a payment can be brought. |
| Identity verification records | **10 years** after we stop working with you | The same reason, and financial regulators contemplate this length for these records specifically. |
| Documents uploaded about an enrolment | **10 years** | They are the evidence behind the payment schedule taken from them. |
| The contract record for a closed account | **10 years** after it closes | It is the document a dispute would be argued from. |
| Profile and settings — your picture, preferences, anything not part of the contract | **While the account is open, then 90 days** | Nothing here would be evidence of anything, so it does not earn the longer period. |
| Sign-in history | **24 months** | So we can answer "who accessed this, and when". |
| Support conversations | **10 years** | What we told you is often the whole question in a dispute. |
| Website and product analytics | **14 months** | You consented to this one, and there is no reason to hold it longer. |
| Records of what our AI read | **90 days**, or longer once identifying details are stripped out | Kept to improve how well it reads documents. Once your name and details are removed, what is left is not about you. |
| Backups | **Up to 12 months** | A deleted record survives in a backup until that backup expires, which for our monthly snapshots can be up to a year. We do not read deleted data back, and if we ever restore a backup we re-apply any deletion that was pending. |

**Ten years is not us keeping things indefinitely.** Seven is what tax and
anti-money-laundering law obliges us to keep. The extra three is so that if
someone brings a claim about a payment years later — or a bank asks us to
evidence one — the records still exist. Both European and Brazilian law allow
data to be kept for defending legal claims, and that is the basis we rely on.

**How deletion happens today.** These are the periods we apply. Automatic
deletion is being built; until it is finished we delete on request rather than
on a timer, so if you want something removed, ask us and we will do it and tell
you what we had to keep and why.

Where you are a customer's payer rather than our own customer, **that customer sets how long their data is kept**, and we act on their instruction.

## Your rights

Wherever you are, you can ask us to:

**See** the personal data we hold about you, and get a copy.
**Correct** anything wrong.
**Delete** it, where we are not required to keep it.
**Limit or object** to how we use it.
**Take it elsewhere**, in a machine-readable format.
**Withdraw consent** at any time, where consent is what we relied on.

Ask at [privacy@qualyhq.com](mailto:privacy@qualyhq.com). We reply within 30 days; if a request is complicated we will tell you and may take up to two months more. It is free unless a request is excessive.

**If you are in Brazil**, the LGPD also gives you the right to confirm processing exists, to know who we share data with, to be told what happens if you refuse consent, and to ask for anonymisation or blocking of data that is not being handled lawfully.

### Complaints

If you think we have mishandled your personal data, write to our privacy contact at **[privacy@qualyhq.com](mailto:privacy@qualyhq.com)**. We acknowledge within 5 business days and respond within 30 days.

If you are not satisfied with our response, or we do not respond in time, you can complain to your data protection authority:

**European Union** — the Estonian Data Protection Inspectorate (*Andmekaitse Inspektsioon*), or the authority in your own country.
**Australia** — the Office of the Australian Information Commissioner, [oaic.gov.au](https://www.oaic.gov.au), 1300 363 992.
**Brazil** — the *Autoridade Nacional de Proteção de Dados* (ANPD). Our *encarregado* under Article 41 of the LGPD is Raphael Arias, reachable at the same privacy address, and Qualy Services Brazil LTDA is our representative in Brazil.

## Keeping data safe

Personal data is encrypted in transit and at rest. Bank account details get a second layer of encryption, field by field, with a separate key for every customer, so even direct database access does not reveal them. Every customer's data lives in its own database. Access is limited, requires two-factor authentication, and is logged.

Our [trust centre](/trust.md) describes this in more detail. No system is perfect, and if a breach affects you we will tell you as the law requires.

## Cookies

We use cookies that are necessary for the site to work, and — only with your consent — cookies that help us understand how the site is used. You can change your mind at any time from the cookie settings link in the footer.

## Changes to this policy

We will post any change here and update the date at the top. If a change materially affects your rights, we will give notice before it takes effect. Customers with a contract also get the notice period set out in our [Terms](/terms-and-conditions.md).

## Contact

[support@qualyhq.com](mailto:support@qualyhq.com), or write to Qualy Services OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia.

Everything else — our terms, the data processing agreement and the disclosure lists — is at [qualyhq.com/trust](/trust.md).

## More on Qualy

**Industries**

- [For schools](/international-education/for-schools.md) — For international education schools
- [For agents](/international-education/for-education-agents.md) — For international education agents

**Support**

- [Training](/training.md)
- [System status](https://qualyhq.statuspage.io/) — Qualy system status
- [Product updates](https://changelog.qualyhq.com) — As we work on Qualy, here we spotlight what we’ve learned and updated across our products
- [Contact](/contact-us.md)

**Product**

- [Demo](/demo.md)
- [Enterprise](/enterprise.md)
- [Testimonials](/testimonials.md) — Learn what some customers have to say about Qualy
- [About](/about.md) — Learn about Qualy's mission and values
- [Blog](/blog) — International education payments blog by Qualy
- [Trust center](/trust.md)
- [API](/api.md) — Qualy API for international education payments
- [Zapier](/integrations/zapier.md) — Connect Qualy to 7,000+ apps with Zapier
- [NexPay](/nexpay.md) — Qualy + NexPay — automate everything around the payment

**Legal**

- [General terms](/terms-and-conditions.md)
- [Payer terms](/terms-for-payers.md)
- [Privacy policy](/privacy-policy.md)
- [Service levels](/sla.md)
- [Accessibility](/accessibility.md)
- [Legal & compliance](/trust.md)