GDPR at Qualflare

Which role we play depends on whose data it is.

• For the data you put into Qualflare — test results, logs, attachments and the rest of your workspace — you are the controller and Qualflare is the processor. We process it only on your documented instructions.
• For your own account and billing data — the details you give us to have a relationship with us — Qualflare is the controller.

Qualflare OÜ is a private limited company registered in Tallinn, Estonia (registry code 17481021, Sepapaja tn 6, 15551 Tallinn). Because the controller is established inside the EU, no Article 27 representative is required. We have not appointed a Data Protection Officer: on our assessment our processing does not meet the Article 37(1) threshold. Privacy questions go to legal@qualflare.com.

Full detail: DPA §3 — Scope and Roles and Privacy Notice §2 — Who We Are.

Account details (name, email, hashed credentials), workspace and project metadata, the test artifacts you upload through the application or the CLI (results, stack traces, logs, screenshots, attachments, Git branch and commit metadata), payment metadata, support conversations, and product telemetry including session recordings of in-app activity. On the marketing site (qualflare.com) we additionally record consent-gated session replay through Microsoft Clarity, with form input masked; it is never loaded in the application.

We do not knowingly process special categories of personal data under Article 9. Test artifacts can incidentally contain personal data — fixture users, seeded email addresses, values captured in a failing assertion — so scrub anything sensitive before uploading it.

Full detail: Privacy Notice §3 — Personal Data We Collect and DPA Annex 1B — Description of Processing.

Every processing activity is mapped to an Article 6 basis. Running your account, delivering the Services and sending transactional email rest on performance of a contract (Art 6(1)(b)). Tax and accounting records rest on legal obligation (Art 6(1)(c)) — Estonian law requires some records to be kept for up to seven years. Security monitoring, fraud prevention and audit logging rest on legitimate interest (Art 6(1)(f)), with a balancing test on file.

The complete purpose-by-purpose table is in Privacy Notice §5 — Legal Bases for Processing.

You can exercise access (Art 15), rectification (Art 16), erasure (Art 17), restriction (Art 18), portability (Art 20), objection (Art 21), the right not to be subject to a solely automated decision (Art 22), and withdrawal of consent where processing rests on consent.

Email legal@qualflare.com and we will deliver a verified export within 30 days. You also have the right to lodge a complaint with your supervisory authority.

If you are our customer and the request reaches you from one of your own users, we assist you as your processor — self-service tooling covers the common cases, and we help directly where it does not. See Privacy Notice §13 and DPA §10 — Assistance with Data Subject Rights.

Article 28 requires a written contract between controller and processor. Ours is published in full — you do not have to request it, negotiate it, or wait for sales to send a copy.

It includes the European Commission's 2021 Standard Contractual Clauses (Decision 2021/914, Modules 2 and 3), a description of the processing, the technical and organisational measures, the named sub-processor list, and an explicit commitment that we do not train, fine-tune or evaluate AI models on your data and have contracted with our AI sub-processors so that they do not either.

Read it: Data Processing Addendum · §15 — No Training of AI Models on Customer Data

Qualflare is established in Estonia and stores customer data inside the European Union. Application servers and the primary PostgreSQL database run in Google Cloud's europe-central2 region (Warsaw, Poland). Object storage and edge services run on Cloudflare with EU-region routing. In the ordinary course of operating the Services we do not store customer data outside the EEA.

Where personal data does leave the EEA — some sub-processors are US-based or run global infrastructure — we rely on the EU-US Data Privacy Framework where the recipient is certified, on Standard Contractual Clauses supplemented by a transfer impact assessment, or on an adequacy decision.

Full detail: Privacy Notice §9 and DPA §9 (party details in Annex 1A).

We use a short, named list — not a generic “we may share with service providers” clause. It covers hosting and database (Google Cloud, EU), edge and object storage (Cloudflare), payments (Stripe), AI inference (Google, OpenAI and Cloudflare's own Clef model, all via Cloudflare AI Gateway), AI observability (LangWatch, EU), product analytics on EU endpoints (Amplitude), error monitoring (Sentry), application log and metric monitoring (Grafana Cloud, EU), marketing-site analytics (Google Analytics and Microsoft Clarity, consent-gated and confined to qualflare.com) and live chat/support messaging (Intercom).

Each is engaged under terms carrying the Article 28 obligations and, where applicable, the Standard Contractual Clauses, except where the Privacy Notice and DPA Annex 3 say otherwise: LangWatch's data processing agreement has not been requested, and OpenAI's was executed on 24 October 2026.

Current list with locations and purposes: Privacy Notice §8 · DPA Annex 3

We implement technical and organisational measures appropriate to the risk, as Article 32 requires: TLS 1.2+ in transit and AES-256 at rest, role-based access control with no standing production access for engineers, mandatory SSO and MFA for staff, and an immutable audit log of employee access to customer data kept for at least 365 days. The measures are written down and versioned rather than described in the abstract.

Physical data-centre security is provided by our infrastructure sub-processors — Google Cloud and Cloudflare — which operate ISO 27001-certified facilities. That certification is theirs, not ours; Qualflare does not operate its own data centre.

To be straightforward about what we do not have: Qualflare does not currently hold a SOC 2 Type II or ISO 27001 certification. We intend to pursue independent third-party attestation as the company grows, and will make any resulting report available under confidentiality.

It is also worth being precise about what GDPR certification is. There is no blanket certificate that makes a company “GDPR compliant”. Articles 42 and 43 do provide for certification mechanisms, seals and marks — the EDPB approved Europrivacy as a European Data Protection Seal in 2022 — but such schemes certify specific, defined processing operations rather than an organisation as a whole. Qualflare holds none of them.

Full detail: DPA Annex 2 — Technical and Organisational Measures · DPA §13 — Audit Rights · Security Policy

Account data lives until you delete your account, then leaves active systems within 30 days and encrypted backups within 90 days. Test artifacts are kept for the lifetime of the project unless you delete them sooner — you can set a shorter retention window per project. Audit logs are kept for at least 365 days.

On termination you choose: we return your data in a machine-readable format (JSON or CSV) within 30 days, or delete it from production within 60 days, or both in that order. Residual copies in encrypted backups age out on the backup rotation.

Full schedule: Privacy Notice §10 · DPA §14 — Return and Deletion

If a personal data breach is likely to result in a risk to individuals, we notify the Estonian Data Protection Inspectorate (AKI) without undue delay and, where feasible, within 72 hours of becoming aware (Article 33). Where the risk is high, we notify affected individuals directly (Article 34).

As a processor, we notify you — our customer — of a breach affecting your data without undue delay and in any event within 72 hours of becoming aware, with the categories and approximate numbers affected, the likely consequences, and the measures taken.

Full detail: Privacy Notice §15 · DPA §11

Is Qualflare GDPR compliant?

Qualflare is built to align with the GDPR. Qualflare OÜ is established in Tallinn, Estonia, inside the EU, and customer data is stored in the European Union — application servers and the primary database run in Google Cloud europe-central2 (Warsaw, Poland). A full Data Processing Addendum including the 2021 Standard Contractual Clauses is published at qualflare.com/dpa rather than offered on request. Note that there is no blanket certification that makes a company GDPR compliant: the certification mechanisms in Articles 42 and 43 cover specific, defined processing operations, and Qualflare holds none of them.

Is Qualflare a data controller or a data processor?

Both, depending on the data. For the test results, logs and attachments you upload into your workspace, you are the controller and Qualflare is the processor, acting only on your documented instructions. For your own account and billing data, Qualflare is the controller.

Where does Qualflare store customer data?

Inside the European Union. Application servers and the primary PostgreSQL database run in Google Cloud europe-central2 (Warsaw, Poland), with object storage and edge services on Cloudflare using EU-region routing. In the ordinary course of operating the Services, customer data is not stored outside the EEA. Where data does leave the EEA via a sub-processor, Qualflare relies on the EU-US Data Privacy Framework, Standard Contractual Clauses with a transfer impact assessment, or an adequacy decision.

Does Qualflare offer a Data Processing Agreement (DPA)?

Yes, and it is published in full at qualflare.com/dpa — it does not need to be requested or negotiated. It includes the European Commission 2021 Standard Contractual Clauses (Modules 2 and 3), a description of the processing, the technical and organisational measures, and the named sub-processor list.

Does Qualflare train AI models on customer data?

No. The Data Processing Addendum contains an explicit commitment that Qualflare does not use customer data to train, fine-tune or evaluate foundation models, and that its AI sub-processors are contractually bound not to either. Data sent through Qualflare AI features is processed by Google via the Gemini API under enterprise terms that exclude API inputs and outputs from improving Google models.

Does Qualflare hold SOC 2 or ISO 27001 certification?

No. Qualflare does not currently hold a SOC 2 Type II or ISO 27001 certification, and says so plainly in both its Privacy Notice and its DPA. Qualflare intends to pursue independent third-party attestation as the company grows and will make any resulting report available under confidentiality. The technical and organisational measures that are in place are documented in Annex 2 of the DPA. Physical data-centre security is provided by Google Cloud and Cloudflare, which do operate ISO 27001-certified facilities.

How quickly does Qualflare report a personal data breach?

Qualflare notifies affected customers without undue delay and in any event within 72 hours of becoming aware of a breach affecting their data. Where a breach is likely to result in a risk to individuals, Qualflare notifies the Estonian Data Protection Inspectorate (AKI) within 72 hours under Article 33, and notifies individuals directly where the risk is high under Article 34.

How do I exercise my GDPR rights with Qualflare?

Email legal@qualflare.com. Qualflare supports access, rectification, erasure, restriction, portability, objection, the right not to be subject to a solely automated decision, and withdrawal of consent. A verified data export is delivered within 30 days. You may also lodge a complaint with your supervisory authority.

Questions about any of the above, or to exercise a right: legal@qualflare.com or the contact form. This page summarises our GDPR posture for convenience; the Privacy Notice and DPA are the documents that bind us.