What Q holds, and why.

Q Division is a department of Elementary. For this website, Q Division is the controller of the small amount of information described in clause 02. For the product, your organisation is the controller of the information it places in Q, and Q Division processes that information on its instructions and under the data processing terms issued with your organisation's agreement.

This website sets one cookie, q-locale, which records the language you chose and is kept for one year. It sets no analytics or advertising cookies and loads no third-party tracking. The contact page opens your own mail program; nothing you type is stored by the site.

Q processes the documents and content your organisation places in it, the runs its roles start, the approvals its people give, the journal each run writes, the spend each run incurs, the request logs and traces needed to operate the service, and the memories a user's work produces. All of it is held inside your organisation's own tenant, isolated at the database layer, and is not shared with other customers.

Information is processed to do the work your organisation has asked for, to keep the record of that work, to bill for it, and to keep the service secure and working. Q Division does not sell personal information, does not use your content to advertise to anyone, and does not use your content to train or evaluate models unless your organisation has opted in. Both opt-ins are off by default.

To do a run, Q sends the content that run needs to a model provider. Which providers may be used, and in which regions, is set by your organisation's policy, and a policy may restrict both. Residency is never taken from the request itself. The receipt for every run names the provider and model used. The providers in service and the regions available are set out in the data processing terms.

Documents and content are kept until your organisation erases them. Approval records and spend lines are kept as evidence of what was decided and what it cost. Request logs are kept for 7 days and traces for 30 days by default; an organisation's policy may shorten either or extend them to 30 and 90 days. Cached responses are kept for 24 hours by default and never more than 7 days. Q Division's own copy of what was sent to and returned by a model provider is kept for at most 30 days, with long content truncated.

Your organisation may export a document and its derived records, within a size limit of 8 MB per operation, and may erase a document. Erasure removes the document's chunks, artefacts and memories from the tenant and marks the document deleted. Some obligations cannot be attested by the system alone: copies held by external services, historical logs, backups and prior exports. Each erasure returns a receipt that lists these obligations; the operation stands as awaiting external evidence until an operator attests each one with a hash of the evidence.

Individuals have rights over personal information under the law that applies to them, including access, correction, erasure and objection. Where Q Division is the controller, write to the address below and we will answer within the time the law allows. Where your organisation is the controller, address the request to your organisation; Q Division will assist it within the same time.

Every organisation is isolated at the database layer, protected actions stop for a person, and every run keeps a record of what it did. Q is not yet certified against an external standard, and that will be stated on the security page when it is.

The revision and its date appear at the top of this page and in the list below. A change that affects what is held or why is announced to organisations in service before it takes effect.