Privacy policy

Who we are

Qouh is run by 12651696 Canada Inc., 6 Topbank Drive, Toronto, ON M9W 7C2, Canada, Canadian Business Number 787777861, Ontario corporation no. 003272655 (“we”). Questions about privacy: use the contact form.

Our role

For the accounts of businesses and their staff, and for this website, we decide what happens with the data: we are the controller. The details of a business's own customers (who book through its booking page) belong to that business: it is the controller and we process them on its behalf, only to run the service. The data processing agreement sets out how.

What we collect

Only what the service needs:

• Account: name, email address, password (stored as a hash), two-step verification settings (secrets encrypted), language and time zone.
• Work set-up: departure address, working hours and appointment types.
• Customers and bookings: name, email address, phone number, address and its map position, booking times, notes and the language of the booking.
• Calendar, only if you connect Google Calendar: your busy times and the events we create. Access tokens are stored encrypted.
• Billing: your plan and subscription status. Payments are handled by Stripe; we never see or store card numbers.
• Messages to us: what you write in the contact form (name, email address, company and message), kept in our mailbox as long as we need it to answer you.
• Website visits: we count visits to this website ourselves, without cookies and without storing your IP address. We keep the page, the website you came from, your country, the kind of device and a code that changes every day, so a visitor is counted once a day but never recognised later. These counts are kept for 400 days.
• Route planner: when you plan a route on this website we keep your IP address for 3 months, with your country and the kind of device, to stop misuse of the free planner. The addresses you type are not stored.
• Technical: IP address and browser in server logs, your push subscription if you turn notifications on, and how this website is used (see the cookie policy).

Data from Google Calendar

If you connect Google Calendar, we read the start and end times and the locations of your events, never their titles or descriptions, so customers can't book times you're busy. We add your booked visits to your calendar and update or remove them when they move or are cancelled. We use this data only for these features: we don't sell it, use it for advertising or share it with anyone else, and people read it only when you ask us for help or the law requires it. “Disconnect” under Settings → Calendar deletes our access and every busy time we copied. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Why and on what basis

To provide the service you signed up for (performance of a contract): bookings, routes, calendar sync, confirmations and reminders. To keep accounts and the service secure (legitimate interest). To keep invoices and accounting records (legal obligation). We don't sell data and don't use it for advertising. To see how this website is used and improve it (legitimate interest for visit counts without cookies; your consent for session recordings).

Who receives data

Only these services, each for its own part of the work:

• Hosting: ZAP-Hosting GmbH (Germany), with the data stored in the European Union (the Netherlands).
• Network and protection: Cloudflare carries the traffic to this site and protects it from attacks, so it sees your IP address.
• Spam protection: when it is switched on, Google reCAPTCHA checks the sign-up and contact forms and the route planner on the website for automated use, so Google receives your IP address and details about your browser and how you use the form.
• Email delivery: Emailit.
• Payments: Stripe.
• Google, only if you connect Google Calendar.
• Maps: OpenFreeMap serves the map tiles, so it sees your IP address when a map loads.
• Visit statistics: our own analytics software on our own server; nobody else receives them.
• Session recordings, only if you allow them on this website: Microsoft Clarity, so Microsoft receives your IP address, browser details and how you use the pages.
• Notifications: the push service of your browser (for example Apple, Google or Mozilla) delivers them in encrypted form.

Data outside the EU

We are a company in Canada. The European Commission has decided that Canada protects personal data adequately for businesses like ours, so data may go from the EU to us without further safeguards. Your data is stored in the European Union (the Netherlands). Stripe, Google, Cloudflare and Microsoft may process data in the United States; they do so under the EU-U.S. Data Privacy Framework or the European Commission’s standard contractual clauses.

How long we keep it

Account and customer data are kept while the account exists and deleted after it is closed. Invoicing records are kept as long as accounting law requires. Server logs are kept for a limited time, for security.

Your rights

You can ask to see, correct or delete your data, to limit or object to its use, and to receive it in a usable format. Use the contact form. Customers of a business that uses Qouh can best contact that business first. You can also complain to the data protection authority of your country (in Belgium: the Data Protection Authority, www.dataprotectionauthority.be; in the Netherlands: the Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

Security

Connections use HTTPS, staff accounts can use two-step verification, and calendar tokens and verification secrets are stored encrypted.

Changes

When this policy changes, we update the date at the top and tell account owners by email about important changes.