Privacy Policy

• Users: the agency owners, studio operators, and their team members who create Qorp accounts ("you").
• Client contacts: the leads, clients, and prospects whose data you (the User, acting as data controller for that information) input into Qorp's CRM, outreach, and invoicing modules. Qorp processes this data on your behalf, as described in Section 6 and our Data Processing Agreement.

• To provide the Service — running your pipeline, generating AI outputs, sending outreach and webhook events you configure, and processing payments;
• To maintain and improve the Service, including monitoring for abuse and debugging;
• To communicate with you about your account, billing, and material changes to the Service;
• To comply with legal obligations, including responding to lawful requests from regulators or courts.

We do not sell personal data. We do not use Customer Data (including client contacts' data) to train third-party AI models beyond what is necessary to generate the specific output you requested, and we do not share Customer Data with other Qorp users.

• Performance of our contract with you (providing the Service you signed up for);
• Your consent, where required (e.g. certain integrations or marketing communications);
• Our legitimate interests in operating and securing the Service, balanced against your rights;
• Compliance with legal obligations.

We share personal data only with service providers who process it on our behalf under contract, including:

• Supabase (database hosting and authentication);
• AI model providers used to generate Brand Audit, Outreach, Ballpark, and AI Director outputs;
• Meta Platforms, Inc. (Instagram Graph API), for accounts you connect;
• Email/SMTP and notification providers (Telegram, Discord) you configure;
• Payment processors, once billing is enabled.

A current sub-processor list is available on request at hello@qorp.app.

For your own account information, Qorp acts as data controller. For the client and lead data you input into Qorp on behalf of your studio's clients, you act as data controller and Qorp acts as data processor, processing that data only on your instructions as set out in our Data Processing Agreement.

We retain account and Customer Data for as long as your account is active, and for [30] days after account closure to allow export, after which it is deleted or anonymized, except where longer retention is required by law (e.g. financial records).

Some sub-processors (e.g. AI model providers, Meta) may process data outside Nigeria. Where this occurs, we rely on contractual safeguards consistent with NDPA requirements for cross-border transfer.

Subject to applicable law, you (and, where you act as controller, your clients through you) may request to access, correct, delete, or export personal data, or object to certain processing. Requests can be sent to hello@qorp.app; we aim to respond within the timeframe required by the NDPA.

We use industry-standard measures — encrypted connections, access controls, and signed webhook payloads (HMAC-SHA256) — to protect data. No system is completely secure, and we encourage you to use strong, unique passwords and enable available account protections.

In the event of a data breach affecting personal data, we will assess the risk and, where required by the NDPA, notify the Nigeria Data Protection Commission and affected users without undue delay.

qorp.app uses essential cookies for authentication and session management, and may use analytics cookies to understand product usage. [Expand with a cookie table once analytics tooling is finalized.]

The Service is not directed to individuals under 18, and we do not knowingly collect data from them.

We may update this Policy from time to time and will post the updated version with a new "Last updated" date, with notice of material changes where required.

Questions or data protection requests: hello@qorp.app.