Privacy policy

1.Who is responsible for your data

The controller of the personal data described in this notice is Axperts Dariusz Zalewski, ul. Pelikana 1/3, 71-698 Szczecin, Poland, a sole proprietorship entered in the Polish CEIDG register, NIP 851 319 2109, REGON 363785540 (in this notice, "QuickISO", "we" or "us").

Contact for anything in this notice: [email protected], or +48 789 072 764.

No data protection officer has been appointed. QuickISO is not required to appoint one under article 37 of the GDPR: its core activities are not large scale regular and systematic monitoring of data subjects, and it does not process special category data on a large scale.

2.Two different roles, and why the difference matters to you

QuickISO handles personal data in two capacities, and your rights work differently in each.

As a controller, QuickISO decides why and how data is processed. This covers the waitlist, user accounts, signing in with Google, the records of the terms you accepted, protection against abuse, the mobile app, usage measurement, server logs, security reports and correspondence with us. Sections 3 to 13 of this notice describe that processing.

As a processor, QuickISO processes personal data that a customer organization puts into its own workspace: the people named as owners of actions, the authors and approvers of documents, the contents of uploaded evidence, including photographs taken with the app, and anyone a customer chooses to describe in a risk, an incident or a supplier record. QuickISO does not decide what goes in there and does not use it for its own purposes. The customer organization is the controller of that data, and the terms of that processing are in the data processing agreement, not in this notice. If you are an employee, contractor or supplier of a QuickISO customer and want to exercise a right over data your employer put into QuickISO, address the request to them; if you send it to us, we will pass it on and tell you that we have.

3.What we process, why, and on what legal basis

3.1 Account requests and the US region waitlist

Processed when you submit the form on quickiso.app or the United States region page.

Purposes: confirming the address before we contact you (double opt in), contacting you about the list you joined, for an account request setting up the workspace you asked for under the company name you gave and sending its invitation to your address, for an enquiry from the KSC page answering it at your address, and understanding in aggregate which messages bring interested visitors.

Legal basis: for confirming the address, contacting you and the aggregate measurement, your consent, article 6(1)(a) GDPR, and article 398 of the Polish Electronic Communications Law for the message itself; for setting up the workspace you asked for and sending its invitation, the steps you asked us to take before entering into a contract, article 6(1)(b) GDPR. You can withdraw consent at any time, and the fastest way is the removal link in every message we send you: it deletes the entry immediately. The lawfulness of what happened before you withdrew is unaffected.

3.2 Your account

Processed when you create an account yourself, with an email address and a password or with Google, or when you accept an invitation from an organization.

Anyone may create an account for use in their business while registration is open. We decide when it is open. While it is closed, an account is created only by accepting an invitation, and signing in with Google works only for an existing account: one that already has that provider connected, or one whose address the provider is authoritative for, which we connect after that account's own two factor code (section 3.3).

Purposes: providing the service you or your employer asked for, authenticating you, keeping the account secure, and supporting you when you write to us.

Security emails: we write to your account address when your password is changed or set, a passkey is added or removed, your account signs in from a browser or device it has not used recently (judged from the browser and system names your sessions reported), and when a change of your address is requested and completed. They protect your account and cannot be switched off (article 6(1)(b) and (f) GDPR). When you ask to move your account to an address that already has an account, that address receives a short notice that names nobody.

Legal basis: performance of a contract, article 6(1)(b) GDPR, where you are our customer, which includes everybody who creates an account for their own business, and our legitimate interest in providing a secure service to the organization that invited you, article 6(1)(f), where the contract is with your employer. Two factor authentication is required and is not optional: we consider an account holding a customer's security evidence to need it.

3.3 Signing in with Google

You can sign in, and while registration is open create an account, with a Google account instead of a password. Google's page opens in your browser. The provider confirms who you are, and QuickISO then still asks for its own two factor code before anything opens, so the provider replaces the password and nothing else.

We ask Google only for openid, email and profile. We never receive your Google password.

When a provider reports a verified address that already belongs to a QuickISO account, we connect the two only after that account's own two factor code has been entered, and only where the provider is authoritative for the address: Google for Gmail addresses and for addresses of the Google Workspace domain the Google account belongs to. Otherwise you sign in to the existing account first and connect the provider from Account security. Every connection and disconnection is announced by email.

You can disconnect a provider in Account security at any time, as long as the account keeps another way to sign in. If your organization set up company single sign on, the same rules apply to its identity provider, which the organization chose.

Legal basis: performance of a contract, article 6(1)(b) GDPR, because you chose this way of signing in, and our legitimate interest in recognizing you securely, article 6(1)(f). Google is responsible for the data it holds about your account with it; see section 5.

3.4 Records of the terms you accepted

When you create an account, accept an invitation or accept a new version of a text, we record which version of the terms of service and of this notice you were shown, the language, whether it was on the web or in the app, the situation (sign up, sign up with Google, invitation, or a new version), and the time. A record can be added to but never changed.

Purpose: being able to show which terms applied to an account and when they were accepted.

Legal basis: performance of a contract, article 6(1)(b) GDPR, and our legitimate interest in being able to prove what was agreed, article 6(1)(f).

3.5 Protection against automated sign ups and abuse

Open registration attracts automated sign ups, so we use the controls below. None of them involves a third party and none sets a cookie.

• Rate limits. We count attempts to sign in, to sign up and to request emails per network address, where our own network edge can vouch for the address, and per account, keyed by a hash of the email address made with a server secret rather than by the address itself. Every counter expires within a day.
• A proof of work. Before an email sign up is sent, your browser or the app solves a small calculation. It runs entirely on your device and uses no outside service. We keep only a note that the puzzle was used, for ten minutes, so that it cannot be used twice.
• Disposable addresses. A sign up with an address at a known disposable email service is refused, using a list kept in our own code.
• Limits. A daily limit on new accounts overall, limits on how many workspaces one person can create, a limit on how many account emails one address is sent in a day, and a storage limit for each workspace.
• Unfinished accounts. An account whose address was never confirmed, or that never set up two factor authentication, and that belongs to no workspace, is removed after 7 days. We record only how old it was.

Legal basis: our legitimate interest in keeping the service available and its users' accounts safe, article 6(1)(f) GDPR, and our obligation to secure the service under article 32.

3.6 The mobile app

The QuickISO app for iPhone and Android uses the same account as the web. In addition to what is described above:

• Photographs you take or choose as evidence. The app opens the camera or your photo library only when you choose to answer an evidence request with a photograph, and sends that photograph to the workspace that asked for it. It does not otherwise read your library and it does not use the microphone. Photographs are workspace content, for which the customer organization is the controller (section 2).
• What the app keeps on the phone. Your sign in is kept in the system's secure storage, on that device only, and is removed when you sign out. An answer that could not be sent, with its photograph, waits in the app's own storage until it is sent, and goes when the app is removed. Deleting your account from the app removes both from that phone.
• No tracking. The app contains no advertising or analytics library, and does not track you across other companies' apps or websites.

Legal basis: as in section 3.2.

3.7 How the product is used

QuickISO records events describing what happened in a workspace: an account was created, a scope was approved, a standard was selected, a question was answered, a document draft was generated, and which screen of the workspace somebody reached, from a fixed list of ten screen names.

These events carry the organization, the user and the name of the event. They carry no content: no answer text, no document text, no evidence, no file names, no URLs, no IP addresses. The screen names come from a list in the source code, so a page address can never be stored even if something sent one.

Purpose: understanding where people get stuck, which is the only way a product this young can be improved deliberately rather than by guessing.

Legal basis: legitimate interest, article 6(1)(f) GDPR. Our assessment is that measuring which of our own screens a signed in user reached, with no content and a fixed vocabulary, has a small effect on privacy and is necessary to run the service; you can object at any time under section 11.

3.8 Marketing site page views

The public site records, for each page load, the page address, its language, the message variant, the domain of the referring site and the campaign tag, together with a visitor identifier derived from the visiting address and a salt that exists only in memory and is replaced every day. The salt is never written down, so yesterday's identifiers cannot be linked to today's and none of them can be turned back into an address.

Purpose: counting visits without tracking people.

Legal basis: legitimate interest, article 6(1)(f) GDPR. No cookie is set for this and no third party receives it.

3.9 Server and security logs

Our servers record the usual: time, request path, status, response time, a request identifier and the network address the request came from. Uploaded files are scanned for malware before they are accepted.

Purpose: operating the service, diagnosing faults, and detecting and investigating abuse.

Legal basis: legitimate interest, article 6(1)(f) GDPR, and our obligation under article 32 GDPR to secure the service.

3.10 Correspondence

If you write to us, we keep the message and our answer.

Legal basis: legitimate interest in answering you, article 6(1)(f) GDPR, or performance of a contract where you are a customer, article 6(1)(b).

3.11 Audit trail

Actions inside a workspace that change the management system, such as approving a scope, a document or a risk acceptance, and security events of an account, such as signing in, connecting Google, or asking for deletion, are recorded in an append only trail with the time, the actor and what changed. Each entry also records the network address the request came from and the description your browser or the app gives of itself (the user agent). Entries about company single sign on record the email address the identity provider reported when an account was linked or created through it. The trail is protected by a hash chain, so an entry cannot be altered or removed without the next verification failing.

This exists because an ISO management system has to be auditable, and because a compliance product whose own record can be edited is worth nothing. It means an entry about you cannot be deleted on request without breaking the record for everyone. Section 12 says what the trail keeps after an account is deleted.

Legal basis for our own operation of it: legitimate interest and our obligations as a processor to customers, article 6(1)(f) and article 28(3)(h) GDPR. For workspace content the customer is the controller.

3.12 Security reports

Processed when you send a report through the form on the disclosure policy page.

Purposes: confirming receipt with the reference, investigating and fixing what the report describes, answering you and telling you where the report stands, and keeping a record of the security reports we received and how each was handled, which our own information security management needs.

Legal basis: our legitimate interest in securing the service and in answering the people who report problems to us, article 6(1)(f) GDPR, and our obligation to secure the processing under article 32. A report that asks to use one of your rights is also handled as section 11 describes.

The network address you send the report from is used only to limit how many reports one network can send in an hour (section 3.5) and is not stored with the report; server logs record it as section 3.9 says. Each decision on a report, with who made it, when and why, is recorded in the audit trail (section 3.11) under the reference, without the text of the report and without the internal note.

4.Cookies and browser storage

The public marketing site sets no cookies at all and loads no third party scripts, fonts, pixels or analytics. There is no consent banner because there is nothing to consent to.

The application sets five cookies, all strictly necessary for a service you asked for, which is the exception in article 400 of the Polish Electronic Communications Law:

All five are set with HttpOnly, so page scripts cannot read them, are restricted to the exact host that set them with no Domain attribute, and on https carry the __Host- prefix and the Secure flag. qi_session and qi_sso use SameSite=Lax, because they must come back with a link from another site; the other three use SameSite=Strict. The cookie policy has the details.

The application also uses your browser's local storage for the interface theme. That never leaves your device.

5.Who receives your data

We do not sell personal data and we do not share it for anybody else's marketing.

Google, when you choose it. If you sign in with Google, you deal with that provider directly, and it is responsible for your account there under its own privacy policy; it is not our processor. Our server exchanges with it only what completes the sign in you started: the one time code your browser or the app brings back, in return for the details in section 3.3.

We will also disclose data where the law requires it, and we will tell you unless we are forbidden to.

6.Transfers outside the European Economic Area

Customer content, the database and uploaded files stay in the European Union. Two suppliers are in the United States and are listed above; both are certified under the EU-US Data Privacy Framework, which the European Commission recognised as providing an adequate level of protection in decision (EU) 2023/1795. Signing in with Google is an exchange with that provider, described in section 5.

We record for your information that the framework's validity is under challenge. The General Court dismissed the first challenge on 3 September 2025 and an appeal to the Court of Justice was lodged on 31 October 2025 and is pending. If the decision is annulled, we will move to standard contractual clauses with a transfer impact assessment or change supplier, and we will say so here.

7.How long we keep things

Deleting data from a live system does not delete it from a backup immediately. A backup expires on the schedule above, so deleted data can remain in a backup for up to 365 days, the life of a monthly set. Restoring a backup brings back what it holds, including an account or a workspace deleted after the backup was taken, and nothing yet repeats those deletions automatically. We restore only to recover from a failure, and after a restore we repeat by hand, following a written procedure, the deletions completed since the backup was taken.

8.How we protect it

This is a summary. The measures themselves are in the technical documentation available to customers under the data processing agreement.

• Every organization's data is separated at the database level by row level security, so a query without an organization cannot return rows belonging to one.
• Two factor authentication is mandatory for every account, and signing in with Google never skips it.
• Passwords are stored as hashes; two factor secrets and recovery codes are encrypted with a key kept outside the database, and the key can be rotated without downtime.
• Uploads are scanned for malware and the scanner's signature age is enforced, so an upload is refused rather than accepted unscanned if the database goes stale.
• The audit trail is append only and hash chained, and its integrity is verified during a weekly restore drill.
• Backups are encrypted and a restore is tested weekly.
• Access by us to a customer's workspace happens through an audited break glass procedure, not casually.
• Traffic reaches the service through an outbound tunnel, so the origin server does not accept connections from the internet.

9.Automated decisions and artificial intelligence

There is no automated decision making that produces legal effects or similarly significantly affects anyone, within the meaning of article 22 GDPR. The controls against automated sign ups in section 3.5 refuse an attempt or slow it down; they do not decide anything about a person.

QuickISO calculates a readiness figure from the answers a customer gives and the evidence they record. It is an arithmetic result with its inputs shown next to it, not a decision, and it never states or predicts an audit outcome.

QuickISO is designed to draft documents with a language model. Today it does not: drafts are produced from deterministic templates, because QuickISO has no AI provider account. When that changes we will update this notice before the feature is enabled, and it will say which provider receives what, what the provider may retain, and that every draft is marked as a draft until a competent authorized person in the customer's organization approves it. A draft is never an approval.

From 2 August 2026, article 50 of Regulation (EU) 2024/1689 requires that people are told when they are interacting with an AI system and that synthetic content is marked. QuickISO will comply before it enables the feature, not after.

10.Is providing data required

The waitlist is entirely voluntary. A security report needs an email address, so that we can answer it; a name is optional. For an account, an email address is necessary and so is a name, although when you sign up with Google we fill in a name for you if the provider gives none. We cannot create an account without them. Everything a customer puts into a workspace is their decision, and QuickISO asks for the minimum its function needs. Leaving an optional field empty is an allowed answer in this product, and "I don't know" is recorded as an open question rather than as a failure.

11.Your rights

Under the GDPR you have the right to access your data and receive a copy, to have inaccurate data corrected, to have data erased, to restrict processing, to receive data in a portable format, to object to processing based on legitimate interest, and to withdraw consent at any time without affecting what happened before.

How to use them:

• Waitlist: the removal link in any message we sent you deletes the entry immediately, with no need to write to anybody.
• A copy of your account data: signed in on the web, download your data as a JSON file. It holds your profile, how you sign in (without any secret), connected Google accounts, passkey names, sessions, memberships, your choice about the daily reminder email, the terms you accepted, deletion requests and your own security events of the last 12 months. The app links to the same page.
• Correcting your name or language: Account, then Profile, on the web.
• Deleting your account: in the app, on the web, or from a public page if you cannot sign in. Section 12.
• A workspace's content: the owners of a workspace can export all of it, with its evidence files, from the workspace settings. Each export is kept for 7 days.
• Everything else: write to [email protected]. We answer within one month and tell you if we need longer, which article 12(3) GDPR allows in complex cases.
• Data your employer put into a workspace: address the request to them. See section 2.

Two honest limits. The audit trail cannot have individual entries removed without breaking the record, so a request touching it is answered by explaining what the trail contains and by restricting further processing where that is the right remedy. And a backup already written is not edited; it expires on the schedule in section 7.

You can complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, or to the supervisory authority where you live or work.

12.Deleting your account

You can delete your account yourself: in the app (Account, then Delete account), on the web, or, if you cannot sign in, from the public deletion page. The account deletion page explains each path step by step. Deleting the app from your phone does not delete your account.

1. If you have not entered your two factor code in the last 10 minutes, you enter it first.
2. For each workspace you own alone, you choose: delete it with your account, or make someone else an owner first. A workspace you delete with your account becomes read only at once, and its other members are told by email.
3. At once, every session on every device ends, and we email you the date the deletion takes effect.
4. For 30 days nothing is erased. Signing in during that time, with your two factor code as always, offers only to cancel the deletion or to sign out. Cancelling restores the account and its workspaces as they were.
5. After 30 days the account is erased: your name and email address are replaced by a pseudonym, your password, two factor secret, recovery codes, passkeys, sessions and Google connections are deleted, your memberships end, and the workspaces you chose are erased with their files. We send a last email before your address is removed.

If you cannot sign in, the emailed link asks for your two factor code or a recovery code. Without one, access to your mailbox alone does not delete an account: we first confirm that the request is yours, and we answer within one month.

What is kept after the account is erased, and for how long:

• The audit trail keeps the account's identifier, which then shows a pseudonym, together with the network address and the user agent recorded with each of its entries, and the email address recorded when company single sign on linked or created an account. The trail is not purged (section 3.11), so these stay for as long as it does.
• Records you created in the workspace of an organization you were a member of stay in that workspace and show the pseudonym, because they are part of that organization's management system.
• The records of the terms you accepted and of your deletion request stay with the pseudonymized account, for the period in section 7.
• Product events and AI job metadata keep the pseudonymized identifier until they are purged after 12 months.
• Backups keep everything until they expire on the schedule in section 7.

13.Changes

We will publish a new version here with a new number and date, and we will say what changed. Where a change materially affects you and we have your address, we will tell you before it takes effect. When a new version of this notice or of the terms of service is published, the app and the web ask you once to accept it, without blocking your work, and we record your answer as section 3.4 describes.

Version history