Privacy & transparency
Privacy notice.
How we handle information when you visit this website or contact QAi through the form or by email.
Last updated:
Who is responsible
QAi is operated by Nuvira EOOD (НУВИРА ЕООД), UIC / EIK 208352429, Sofia, Bulgaria. We are the controller for the website and enquiry processing described in this notice.
For privacy questions or to exercise your rights, contact hello@qai-global.com. Further operator details are on our company information page.
This notice covers qai-global.com, www.qai-global.com, the contact form on those sites and enquiries sent through their contact details. Any handling of customer workflow data requires its own agreed scope and data-protection arrangements.
Information we handle and why
Contact-form and email enquiries
When you use the contact form, we receive the name, organisation, work email, sector, workflow description, optional message and privacy acknowledgement you submit. When you email hello@qai-global.com or vladi@qai-global.com, we receive your email address, any name, role and organisation you provide, your message and attachments, and the correspondence that follows.
Contact-form messages are transmitted through our transactional email provider and delivered to the QAi mailbox hosted by Titan. Enquiries are handled personally by the company owner and are not copied into a separate CRM or website enquiry database. We use this information to answer you, discuss your request and manage the resulting business correspondence. Our basis is our legitimate interest in responding to people who contact QAi and maintaining relevant business relationships (GDPR Article 6(1)(f)). Where you ask us to take steps towards a contract with you personally, Article 6(1)(b) may apply.
Providing information is voluntary, but we need a reply address and enough context to answer. Please share only what is needed; use an agreed secure channel for sensitive information or customer case records.
Website delivery, security and traffic statistics
Your browser sends technical information when requesting a page, including your IP address, requested URL, browser information and, where supplied, a referring page. Our hosting and delivery services process requests to serve the website and protect it against misuse.
To reduce automated or repeated contact-form submissions, the contact endpoint may temporarily associate a request network address with a submission count in the active runtime. The counter contains no form content, is not written to the enquiry email or a separate customer database, is not included in application logs, and is designed to expire within 10 minutes. It may disappear earlier when the runtime is recycled. Hosting-edge security controls operate separately.
OpenAI Sites also records traffic automatically and provides visitor and page-view statistics. This is separate from the website code: QAi has not installed additional analytics tags, advertising pixels or embedded social-media widgets. See the hosting provider’s analytics documentation and our cookie notice.
Our purpose is to operate and protect this website and understand its use. We rely on legitimate interests for necessary operation and security (Article 6(1)(f)); any tracking requiring consent must be assessed separately and cannot rely on this statement as consent.
Legal obligations and enquiries about your rights
We may process relevant correspondence to meet legal obligations, including responding to data-protection requests (Article 6(1)(c)), or where necessary to establish, exercise or defend legal claims (Article 6(1)(f)). Enquiries are reviewed by a person; this website does not make solely automated decisions about you with legal or similarly significant effects.
Service providers and international processing
- Resend — contact-form delivery
- Our contact form uses Resend to transmit the submitted message to QAi’s email mailbox. Its privacy policy and data-processing addendum describe its processing and service arrangements.
- Titan — email
- Our email provider stores and delivers correspondence. Its privacy policy, data-processing addendum and sub-processor list describe its service arrangements.
- OpenAI Sites — hosting
- The website is hosted through OpenAI Sites, which handles website delivery and platform traffic statistics. Its service documentation describes automatic analytics and the absence of a data-residency guarantee.
- Cloudflare — delivery and security
- Cloudflare processes network traffic and provides bot protection within the hosting service. Its privacy policy explains end-user data, retention criteria and international transfers.
These services operate internationally, so information may be processed outside the European Economic Area, including in the United States. Titan’s published addendum provides for standard contractual clauses in the circumstances it describes. Cloudflare’s policy describes its use of the EU–US Data Privacy Framework and standard contractual clauses. These provider statements are not a guarantee of EU-only processing.
You can ask hello@qai-global.com for further information about the arrangements and applicable transfer safeguards. Relevant information may also be disclosed where required by law or necessary for legal claims. Service providers may process certain information for their own service or security purposes under their respective terms.
Links to LinkedIn and other external websites take you to services governed by their own privacy notices. A link on this website is not an embedded social-media tracker.
How long information is kept
Non-customer enquiries: 12 months after the last meaningful contact. We then delete the enquiry correspondence, unless a legal obligation or the establishment, exercise or defence of a legal claim justifies retaining relevant records for longer.
Temporary contact-form throttling counters are designed to expire within 10 minutes and may be cleared earlier by the hosting runtime. They are separate from delivered enquiry correspondence and provider-managed security logs.
If an enquiry becomes a customer relationship, relevant records move into the retention arrangements for that relationship and any applicable accounting or legal obligations. The 12-month enquiry period is our policy, not a general statutory deadline.
Provider-managed delivery logs, technical logs, traffic statistics and backup copies have separate retention arrangements. The enquiry period does not set their deletion schedule. Cloudflare’s published criteria include the processing purpose, security needs, sensitivity and legal requirements; Resend and Titan describe their service retention arrangements in their terms and privacy materials. Contact us for information about the provider arrangements relevant to a particular request.
Your rights and how to use them
Depending on the circumstances, you may request access to your personal data, correction, erasure or restricted processing. You may object to processing based on legitimate interests. Portability applies where its legal conditions are met, and you can withdraw any consent you have given without affecting earlier lawful processing.
Email hello@qai-global.com and describe your request. We may ask for proportionate information to confirm your identity. We normally respond within one month; where the GDPR permits an extension, we will explain it within that month.
You can complain to the Bulgarian Commission for Personal Data Protection, or to a competent supervisory authority in the country where you live, work or consider an infringement occurred. You do not need to contact us before making a complaint.
We will update this notice when the practices it describes change. The date above identifies the latest revision.