Privacy Policy

This Policy explains how we handle personal data when you visit theq11.com, use app.theq11.com, subscribe to Q11 AI, participate in a workspace, generate test plans or contact us. It covers consumers, business customers, authorised users and other individuals whose information we process.

We process personal data under the General Data Protection Regulation (GDPR/AVG) and other applicable laws. This Policy provides information; accepting it is not blanket consent to processing.

1. Who is responsible for your data

Q11 AI is operated by Hidden Variants, trading as Q11 AI, at Poortland 66, 1046 BD, Amsterdam, The Netherlands. Our KvK number is 81513399 and VAT number is NL003571308B27.

For privacy questions and rights requests, email q11ai.privacy@theq11.com or write to the address above.

We act as controller for account administration, our customer relationships, subscription entitlement records, security and the other purposes we determine in this Policy. Where an organisation submits personal data for processing on its behalf in product descriptions or test-plan requests, that organisation generally acts as controller and we act as processor under the applicable data-processing agreement. The actual role depends on the processing, rather than simply on whether a customer is a business.

If we process your information on an organisation’s instructions, its privacy notice also applies. You may contact that organisation to exercise your rights. If you contact us, we will assist it or route the request as appropriate.

Paddle is Merchant of Record for subscription purchases and independently controls its purchase, payment, tax and fraud-prevention processing. Its notice is available at https://www.paddle.com/legal/privacy. Deleting a Q11 AI account does not automatically delete Paddle’s records.

2. Data we collect and where it comes from

We receive information from you, your authorised workspace members, the person inviting you, Paddle, service providers and your use of the Service. When the AI agent researches relevant public sources, it may also retrieve publicly available product information, issue reports and any personal data contained in them.

Account and contact information: name, email, organisation details, account identifier, authentication records, preferences and correspondence. Additional details such as a job title or telephone number are processed only where supplied or needed for the relevant interaction.

Workspace and team information: workspace name, ownership, membership, role, invitations, acceptance status and records of authorised actions. An invitation may provide your name and email before you create an account.

Subscription and usage records: selected plan, subscription and billing-period dates, status, Paddle customer and transaction references, limited billing/contact details, credit grants and deductions, restorations, adjustments, cancellation and plan-change records. Paddle collects payment details through its checkout. We do not receive or store your full payment-card number or card security code through that checkout.

Product and generation content: saved product descriptions, Q11 answers, requirements, platforms, integrations, risk and data-sensitivity classifications, languages, drafts, submitted input versions and generated scenarios and files. These can contain personal data if included in your content or generated from it.

Operational and security information: IP address, browser/device information, request timestamps, session and access events, job identifiers and status, error records, download events, support-access audit records and email delivery status. Approximate country or region may be derived from an IP address; we do not require precise location to generate plans.

Support, feedback and marketing information: communications, reported problems, survey responses, marketing preferences and consent or objection records. Cookie and similar-technology data depends on the tools actually used and your preferences, as explained in Section 7.

We ask you to use synthetic or anonymised examples. Do not submit credentials, live customer databases, payment-card details or unnecessary sensitive personal data. Describing that your product handles medical or financial information does not require sending real medical or financial records. If special-category data is genuinely necessary, contact us before submitting it so the lawful basis, safeguards and processing agreement can be assessed.

3. Why we process data and our legal bases

Where we are controller, we use the following bases. We rely on a contract only where processing is objectively necessary for a contract with the individual concerned or steps requested before entering it.

Providing a subscription to an individual customer: creating and managing the account, activating plan entitlements, recording credits, processing requests, delivering files and providing necessary support. Basis: contract, Article 6(1)(b).

Providing access to an organisation’s users and business contacts: managing invitations, membership, workspaces and communications needed to provide the contracted service. Basis: legitimate interests, Article 6(1)(f), in operating the service and supporting our customer’s authorised collaboration. The organisation’s contract is not automatically a contract with each employee.

Service notifications: invitations, authentication messages, completion or failure notices, billing-status updates and essential security notices. Basis: contract where applicable, otherwise legitimate interests in providing and securing the service. These are separate from optional marketing.

Security and reliable operation: detecting misuse, controlling unauthorised access, diagnosing incidents, reconciling billing events and credit records, preventing duplicate submissions and maintaining necessary audit trails. Basis: legitimate interests in protecting customers and operating a dependable service; legal obligation, Article 6(1)(c), where a specific duty applies.

Performance and service improvement: assessing reliability, capacity, generation failures, feature use and operating costs using minimised event data. Basis: legitimate interests in maintaining and improving the service, subject to a balancing assessment. Where analytics uses technologies requiring consent, we obtain that consent separately. Pseudonymised identifiers remain personal data where they can be linked back to a person.

Billing, tax and legal compliance: keeping records we are legally required to retain and responding to valid legal requirements. Basis: legal obligation. Necessary fraud investigation and establishing, exercising or defending legal claims rely on legitimate interests unless a specific legal duty applies.

Optional marketing and non-essential tracking: basis: consent, Article 6(1)(a), where required. Any lawful existing-customer marketing exception is limited to its legal conditions and includes an easy opt-out. You may object to direct marketing at any time.

When we act as processor for customer content, we process it on documented instructions under the processing agreement. The customer is responsible for identifying its own lawful basis and providing required information to individuals. A processor agreement does not create a legal basis for unrelated use by us.

4. AI processing and public research

We use automated systems and AI model providers to analyse submitted product information and Q11 answers and generate test scenarios, ODS and CSV files and a summary PDF. Processing may include preparing prompts, sending relevant content to model providers, handling responses and running technical retries.

The agent may research similar products and public issue reports. Where external research is used, queries should contain only the information necessary for that research. Search providers receive the query content and associated technical data. Do not include personal or confidential material that is unnecessary for the request.

AI-generated results can contain inaccurate or inferred information, including personal data. Review output before relying on it and contact us if it contains personal information that requires correction or removal.

We do not use test-plan generation to evaluate individuals for employment, financial eligibility or other legal or similarly significant decisions. Analysing a product description is not, by itself, profiling a person. Subscription access and credit limits are applied automatically from payment status and usage records; contact support if an automated restriction appears incorrect.

AI provider handling: We use the OpenAI API for our AI agent. Our configuration does not allow data supplied via their API to be used for training purposes. You can find more information on their terms and conditions here: https://trust.openai.com/?product=api 

Generating a plan is not consent to unrelated model training. Any additional use of identifiable or confidential customer content for training or evaluation must have an appropriate lawful basis and, where we act as processor, be permitted by the customer’s documented instructions and agreement. We do not treat general use of the platform as permission for such reuse.

5. Workspace visibility and access

Your workspace is a shared environment. Its Owner and authorised members can access account or membership information and workspace content according to their assigned roles. This may include products, drafts, submitted versions, generated files and relevant usage records. Billing management is limited to authorised roles.

An organisation controlling a workspace determines who it invites and the access it grants. Removing a member does not necessarily delete that person’s contributions from the organisation’s workspace. We distinguish those records from the individual’s account data and assess deletion requests under the applicable roles and legal obligations.

Authorised support personnel may access relevant records when necessary to resolve a problem, investigate security or meet a lawful requirement. Access should be limited to the task and recorded. We do not make your test plans publicly available merely because you generate them.

6. Who receives personal data

We share data only where needed for the described purpose and with an appropriate legal basis. We do not sell your personal data.

Recipients can include providers of hosting, authentication, databases, private file storage, the generation service, AI models, external search, transactional email, support, security and permitted analytics. Providers acting as our processors are subject to appropriate processing terms. Some recipients, including Paddle, independently determine their purposes and are controllers for that processing.

Service-provider disclosure: 

We may disclose necessary information to professional advisers, competent authorities or courts where legally required or necessary to establish or defend rights. A lawful business sale or restructuring may involve disclosure to advisers and a successor under appropriate confidentiality and data-protection safeguards. We will give required notice if the controller or processing purposes change.

7. Cookies, analytics and email preferences

Essential cookies and similar storage support functions such as authentication, session security and recording cookie choices. Non-essential analytics, advertising or tracking technologies are used only with consent where required by law, and must remain disabled until that consent is given.

Our Cookie Policy at https://theq11.com/cookie-policy/ and the cookie settings explain the tools, purposes, providers and durations used on the relevant website or application. You can change or withdraw optional choices through those settings. Blocking essential storage may affect login or other core functions. Rejecting optional tracking does not prevent use of core subscription features.

You can unsubscribe from optional marketing using the email link or by contacting us. This does not stop essential account, security or service messages. We retain only the suppression information needed to honour an unsubscribe. Any tracking of email opens or clicks must be disclosed and use the required lawful basis and consent.

8. International transfers

Providers or authorised personnel may process data outside the European Economic Area, including through remote access. An EU-hosted database alone does not establish that every processing operation stays in the EEA.

Where an international transfer requires protection under GDPR Chapter V, we use an applicable adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with transfer assessments and supplementary measures where needed. A provider’s participation in a framework is relied on only where current and applicable to the particular recipient and transfer.

Contact q11ai.privacy@theq11.com for information or a copy of relevant safeguards, with necessary protection of confidential information.

9. How long we retain information

We keep personal data only for the relevant purpose and lawful period. Subscription cancellation, credit expiry, file expiry and account deletion are different events.

Generated files and submitted plan-version content: the normal download window is 30 days from successful completion for Starter, Professional and Expert, and customisable for Enterprise, unless the applicable agreement specifies another period. Each version shows its exact expiry. Expired files become inaccessible and their content is purged by the deletion process. Renewing a subscription does not restart an earlier version’s expiry.

Minimal plan operational metadata: after plan content is deleted, necessary minimised metadata is normally retained for three calendar months from the deletion date, then deleted or anonymised. This can include request references, lifecycle dates, status and limited diagnostic or reconciliation records. The period is not three months from delivery and is not automatically 90 days. Metadata can still be personal data. Category-specific lawful exceptions are described below.

Accounts, memberships, saved products and drafts: retained while needed for the account and workspace service. Cancellation may leave the workspace read-only and does not erase all content. A user account and all created data including products, test plans and workspaces will be automatically deleted within 30 days of a user account becoming inactive. An account becomes inactive when there is no active subscription. 

Subscription, credit-ledger and financial records: records needed for current entitlements and reconciliation are retained for those purposes; legally required accounting and tax records are normally kept for seven years under Dutch requirements, or longer where a specific duty applies. Not every usage event or credit record automatically qualifies as a tax record. 

Invitations, support, security logs and analytics: retained for the period needed to administer invitations, resolve requests, investigate incidents and measure relevant performance. For active accounts data may be retained for up to 24 months from creation. For inactive accounts, anonymised data may be retained for up to 24 months. A legal hold may require restricted retention of relevant records for a pending dispute or investigation, with deletion reviewed when the hold ends.

Marketing: contact details and preferences are retained while the lawful marketing relationship continues, subject to withdrawal, objection and inactivity review. A minimal suppression record may remain to prevent further unwanted contact. 

Backups and provider copies: deleted information may remain in restricted backups until they expire through the backup cycle. Backups are not available as ordinary customer archives. If restored for recovery, applicable deletion and restriction requests must be reapplied. These backups may be available for up to 24 months. This is subject to change based on the retention periods of our partners. Do not assume deleting platform files immediately deletes every provider copy.

Genuinely anonymised statistics may be retained longer because they no longer identify individuals. Pseudonymisation alone does not make data anonymous. Retention settings can be updated for justified legal or contractual requirements, but configuration alone does not authorise unnecessary retention.

10. Security

We use appropriate technical and organisational safeguards, proportionate to the information and risks. These include access controls, workspace isolation, private file storage and authenticated download links, secure transmission, restrictions on support access, minimised logging and recovery procedures.

No system can guarantee absolute security. If a personal-data breach occurs, we assess it and notify the relevant authority and affected individuals where legally required. Please report suspected exposure or unauthorised access to our privacy contact.

11. Your rights and how to exercise them

Depending on the circumstances, you can request access to your personal data, correction, erasure, restriction of processing and portability of data processed by automated means on the basis of consent or a contract. Portability applies to qualifying personal data and does not automatically give access to proprietary models or every generated file.

You may object to processing based on legitimate interests for reasons related to your situation. You can object to direct marketing at any time. Where we rely on consent, you may withdraw it without affecting the lawfulness of earlier processing. You have rights concerning solely automated decisions with legal or similarly significant effects where Article 22 applies.

Contact q11ai.privacy@theq11.com. We may ask for proportionate information to verify identity, but do not require unnecessary identity documents. We normally respond and act within one month. For a complex request or numerous requests, the law may permit up to two additional months; we will explain any extension within the first month.

Requests are normally free. A reasonable fee or refusal is possible only under the applicable legal conditions, such as a manifestly unfounded or excessive request. If we cannot fulfil all or part of a request, we will explain why and your complaint options.

Erasure is subject to exceptions such as legal record-keeping and necessary legal claims. We will distinguish records that must remain from those that can be deleted. An append-only ledger or frozen submitted version is a product design choice and does not remove GDPR duties: correction, restriction, minimisation or deletion must still be addressed lawfully.

You may complain to the Dutch Autoriteit Persoonsgegevens at https://www.autoriteitpersoonsgegevens.nl or another competent supervisory authority, including where you live or work. You do not have to contact us first to use a statutory complaint right.

12. Required information and account deletion

Account identifiers, a working email address and necessary subscription and product information are required to provide the relevant features. If you do not provide them, we may be unable to create access, activate a plan or generate a useful test plan. Optional marketing and tracking choices are not conditions of core access.

Contact us to request account or workspace deletion. We may need to verify workspace authority and consider other members’ rights. Account deletion and subscription cancellation must be coordinated; deleting information does not by itself instruct Paddle to stop billing. We will help you confirm the cancellation route and explain any records that must remain.

Download files you wish to retain before deletion or expiry. This practical step does not limit your data-protection rights.

13. Children

The Service is not directed at children under 18. We do not knowingly seek accounts or personal data from children under 18. If you believe such data has been provided, contact us so we can assess and take appropriate action. Customer content describing products for children should use synthetic examples rather than identifiable children’s records.

14. Changes and contact

We will update this Policy when processing or legal requirements change and revise its date. For material changes, we will give appropriate notice, such as email or a prominent platform notice, before new processing begins where required. A policy update does not create consent or override an existing processing agreement. We will obtain fresh consent where legally necessary.

Privacy contact: q11ai.privacy@theq11.com. Postal address: Q11 AI, Poortland 66, 1046 BD, Amsterdam, The Netherlands.