Privacy policy

• Controller: Quorax LLC
• Address: 447 Broadway, 2nd Floor, Suite 3368, New York, NY 10013, US
• Email: desteban@quorax.ai
• Phone: +1 865 307 6200

We have not appointed a data protection officer (DPO), as none of the circumstances that make one mandatory apply (Art. 37 GDPR and Art. 34 LOPDGDD). Any data protection query may be sent to the email address above.

Representative in the European Union (Art. 27 GDPR): [EU representative — to be appointed]. We are in the process of appointing an EU representative; their contact details will be published here and in the legal notice as soon as the appointment is formalised.

2.1 Contact form

When you write to us through the contact form we collect the data you enter: name, email address and message and, optionally, phone number, organisation, service of interest and estimated budget, together with a record that you accepted this policy (consent checkbox) and the date and time we received the message.

To prevent abuse of the form (bulk or automated submissions) we temporarily record your IP address in the server’s memory for the sole purpose of limiting the number of submissions per address within a 10-minute window. This record is not stored persistently and is not linked to the content of your message.

2.2 Browsing data and analytics

When you access the website, our hosting provider (Vercel) receives the technical data needed to serve the pages (IP address, browser and device type, pages requested, date and time), which may appear in its technical logs for security and service-operation purposes.

We use Vercel Analytics and Vercel Speed Insights to measure, in aggregate, how the website is used and how it performs (page views, approximate country, device and browser type, loading times). These tools do not use cookies or persistent identifiers, cannot track you across sessions or websites, and do not allow us to identify you. See section 9 for details.

Some illustrative images are loaded from Unsplash servers (images.unsplash.com). When they are displayed, your browser sends Unsplash your IP address and the usual technical data of any web request, which Unsplash processes under its own privacy policy. We do not send Unsplash any other data about you.

2.3 WhatsApp channel

The website includes a button that opens a WhatsApp conversation with our number. If you choose to use it, the communication takes place through WhatsApp, a service of Meta Platforms Ireland Limited (for EU/EEA users) or Meta Platforms, Inc., which will process your phone number, profile and conversation metadata under its own privacy policy and terms. We will process your number and the content of your messages solely to handle your enquiry.

2.4 Other communications

If you contact us directly by email or phone, we will process the identification and contact data you provide and the content of the communication in order to handle it.

We do not process special categories of data (health, beliefs, etc.) through the website and ask you not to include them in your messages. We do not make automated decisions or build profiles with your data.

We process your data for the following purposes and on the following legal bases:

• Handling your enquiry and, where applicable, preparing and sending you a service proposal: taking pre-contractual steps at your request (Art. 6(1)(b) GDPR) and, as regards your acceptance of this policy through the form checkbox, your consent (Art. 6(1)(a) GDPR).
• Preventing abuse of the form and protecting the security of the website: our legitimate interest in keeping our systems working and secure (Art. 6(1)(f) GDPR).
• Measuring website usage and performance in aggregate in order to improve it: legitimate interest (Art. 6(1)(f) GDPR), using technologies that do not require consent under Art. 22(2) LSSI-CE and the Spanish Data Protection Agency (AEPD) cookie guidelines.
• Remembering your language preference: providing the service you request through a technical cookie exempt from consent (Art. 22(2) LSSI-CE).
• Complying with legal obligations that may apply, such as responding to requests from competent authorities (Art. 6(1)(c) GDPR).

Providing the form fields marked as required is necessary for us to handle your request; if you do not provide them, we will not be able to reply. We will not use your data to send you unsolicited marketing communications.

• Contact form and communications: for as long as needed to handle your enquiry and, at most, 24 months from the last contact, unless a contractual relationship begins, in which case the data will be kept in accordance with the contract and the applicable statutory limitation periods.
• IP address for rate limiting: at most 10 minutes, in the server’s memory; it is not stored persistently.
• Analytics data: kept only in aggregate form, without personal identifiers.
• Language cookie: 12 months from when it is set or changed.

Once these periods have elapsed, the data is deleted or anonymised, unless it must be kept, blocked, to meet potential legal liabilities during the applicable limitation period (Art. 32 LOPDGDD).

We do not sell your personal data or disclose it to third parties for commercial purposes. To provide the service we rely on providers that process data on our behalf as processors (Art. 28 GDPR), under contracts that oblige them to process the data only on our instructions and with appropriate security measures:

• Vercel Inc. (United States): website hosting, execution of the contact form, aggregate analytics and performance measurement.
• Resend Inc. (United States): email delivery service through which we receive contact form messages.

In addition, certain third parties process data as independent controllers when you use their services from our website:

• Meta Platforms Ireland Limited / Meta Platforms, Inc. (WhatsApp): if you use the WhatsApp button, under its privacy policy.
• Unsplash, Inc.: receives your IP address when images hosted on images.unsplash.com are loaded, under its privacy policy.
• LinkedIn, GitHub and other linked sites: only if you choose to visit them through the links on the website.

We may also disclose data to public authorities, courts and tribunals where there is a legal obligation to do so, and to professional advisers bound by confidentiality where necessary to defend our legitimate interests.

Quorax LLC is established in the United States and its hosting and email providers (Vercel and Resend) also process data there. Data of users located in the European Economic Area (EEA) is therefore transferred outside the EEA.

These transfers are covered by the safeguards provided for in Chapter V of the GDPR: the European Commission adequacy decision on the EU-U.S. Data Privacy Framework for providers certified under it and, in all other cases, the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR), supplemented where appropriate with additional security measures. You may request a copy of the applicable safeguards by writing to the email address in section 1.

If you contact us from outside the EEA, your data will be processed in accordance with this policy and the data protection rules applicable in your territory.

You may exercise the following rights at any time:

• Access: find out which of your data we process and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer needed or you withdraw your consent.
• Objection: object to processing based on legitimate interest on grounds relating to your particular situation.
• Restriction: ask us to restrict processing in the cases provided for in Art. 18 GDPR.
• Portability: receive the data you provided in a structured, commonly used format, or have it transmitted to another controller where technically feasible.
• Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.

To exercise them, write to desteban@quorax.ai or by post to 447 Broadway, 2nd Floor, Suite 3368, New York, NY 10013, US, stating the right you wish to exercise and a detail that allows us to identify you (for example, the email address you contacted us from). If we have reasonable doubts about your identity, we may ask for additional information. We will reply within one month, extendable by two further months in complex cases. Exercising these rights is free of charge.

If you believe that the processing of your data does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es, or with the supervisory authority of the EU Member State where you live, work or where the alleged infringement took place. We would appreciate the chance to resolve your concern first by writing to the email address above.

The website does not use third-party, advertising or tracking cookies and does not install social media trackers. That is why we do not display a cookie banner: the only technologies we use are exempt from the consent requirement (Art. 22(2) LSSI-CE and the AEPD cookie guidelines), although we inform you about them below.

• quorax-lang cookie (first-party, technical): stores the language you have chosen so that the site is shown in that language on later visits. Duration: 12 months. It is only set when you expressly switch language. You can delete it from your browser settings; the site will keep working and will be shown in the language detected by default.
• Vercel Analytics (cookieless audience measurement): records page views and aggregate data (approximate country, device type, browser, operating system and referring page). It does not use cookies or store identifiers on your device; visitors are counted using a temporary identifier derived from the request that is not retained and does not allow tracking across sessions or websites.
• Vercel Speed Insights (cookieless performance): collects technical loading-speed metrics (Core Web Vitals) in aggregate, without cookies or persistent identifiers.

Fonts are hosted on our own servers, so no connections are made to third-party font services. If we ever add cookies or technologies that require consent, we will update this policy and ask for your consent beforehand.

We apply technical and organisational measures appropriate to the risk to protect your data against unauthorised access, alteration, loss or disclosure: HTTPS/TLS encryption of communications, security headers and a content security policy (CSP), validation and rate limiting of form submissions, restricted access to provider accounts, and selection of processors that offer sufficient guarantees. No system is completely secure; if we became aware of a security breach affecting your data, we would notify you in accordance with Arts. 33 and 34 GDPR.

The website and our services are aimed at professionals and organisations and are not intended for children under 16. We do not knowingly collect data from minors; if you become aware that a minor has provided us with data, please write to us and we will delete it.

We may update this policy to reflect changes in the law, in our services or in the providers we use. We will publish the current version on this page with its last-updated date and, if the changes are material, we will flag them prominently on the website. We recommend that you review it periodically. See also our legal notice and terms of service.