Privacy Policy

This policy explains what data QRefAI collects, why, how long it is kept, who it is shared with, and what rights you have. It applies to the website at qrefai.info and the newsletter operated by QRefAI (“we”, “us”).

Data controller: QRefAI. Contact: privacy@qrefai.info

1. What we collect

Newsletter subscribers

When you subscribe using the form on this site, we store:

• Your email address
• Your topic preferences (AI Coding, Advanced RAG, Custom AI Agents, AI Governance)
• The page you subscribed from (e.g. “footer” or “advanced-rag”) — used only for internal analytics on which content drives subscriptions
• The date and time of subscription (stored automatically by the database)

We do not collect your name, IP address, or any other identifying information through the subscription form.

Analytics cookies

We intend to enable analytics to understand which articles are most useful. Analytics will only activate after you accept via the cookie consent banner. If you choose “Essential only”, no analytics cookies will be set.

When analytics are active, typical data collected includes: pages visited, approximate country (derived from IP, not stored), device type, and referral source. No cross-site tracking or advertising profiling is performed. This section will be updated with the specific analytics provider and their data processing terms before analytics are activated.

This site currently sets no cookies unless you accept analytics.

2. Legal basis for processing

• Newsletter subscription: your freely given, specific consent (GDPR Art. 6(1)(a)). You can withdraw it at any time by unsubscribing.
• Analytics cookies: your consent via the cookie banner (GDPR Art. 6(1)(a) and ePrivacy Directive). No analytics data is collected before you consent.

3. How we use your data

• To send you email notifications when new articles are published in the topics you selected. We do not send promotional, sponsored, or advertising content.
• To understand, at an aggregate level, which content is most useful (analytics — with your consent only).
• We do not sell, rent, or share your data with third parties for their own marketing purposes.

4. Data processors

We use the following sub-processors. Each is bound by a data processing agreement and is not permitted to use your data for their own purposes.

• Turso (ChiselStrike Inc.) — managed SQLite database where subscriber records are stored. turso.tech/privacy
• Vercel Inc. — hosting and serverless infrastructure. vercel.com/legal/privacy-policy

When analytics are enabled, the analytics provider will be listed here with a link to their privacy policy and data processing agreement.

5. How long we keep your data

• Subscriber records: kept until you unsubscribe or request deletion, at which point the record is permanently removed from our database.
• Analytics data: subject to the analytics provider's retention policy (typically a rolling 12-month window). This will be specified when analytics are activated.

6. Your rights

Under the GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data. For newsletter subscribers, unsubscribing deletes your record.
• Restriction — ask us to limit how we process your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal. Unsubscribe via the link in any email, or email us. Withdraw cookie consent by clearing your cookies or changing your preference.
• Lodge a complaint — with the data protection supervisory authority in your country of residence or where an alleged infringement occurred.

To exercise any right, email privacy@qrefai.info with “Privacy Request” in the subject line. We will respond within 30 days.

7. Cookies

A single first-party cookie, qrefai_consent, records your cookie preference (“all” or “essential”). It is set only after you interact with the consent banner and expires after one year. No third-party cookies are set unless you choose “Accept all”.

8. Changes to this policy

We may update this policy when we add new services (such as analytics) or when regulation changes. Material changes will be communicated to newsletter subscribers by email. The “Last updated” date at the top of this page reflects the most recent revision.