Last updated 5 October 2026

1. Who we are and what this policy covers

QAbility (“QAbility”, “we”, “us”) provides cloud-based quality management software for regulated manufacturers, together with our website and related support, onboarding and messaging services (the “Services”).

This policy covers personal data we handle for our own purposes: visitors to our website, people who contact us or request a demo, the people who sign up for and administer accounts, and recipients of our communications. It does not cover third-party websites or services we link to.

Data we process on behalf of our customers

Our customers use QAbility to run their quality systems, and in doing so they put information into the software: users’ names and work contact details, records such as nonconformances, CAPAs, complaints, audits, training and documents, and the information their own suppliers and partners submit through the software (“Customer Data”). For Customer Data, our customer decides what is collected and why; we process it on their behalf and under their instructions, as set out in our agreement with them. If your information is in a customer’s QAbility account and you have a question or request about it, please contact that organization first; we will help them respond.

2. Information we collect

Information you give us

• Contact and demo requests: your name, work email, company, job title, phone number and anything you write in your message.
• Account information: the name, work email, role and sign-in details of people who use or administer a QAbility account.
• Billing information: billing contact and company details. Payment card details, where used, are handled by our payment processor rather than stored by us.
• Support and communications: the content of emails, calls, chats and support requests, and your communication preferences, including whether you have opted in to SMS messages.

Information collected automatically

• Usage and device information: IP address, browser and device type, pages viewed, referring pages, and the date and time of access.
• Activity within the software: sign-ins and the actions taken on records. As described on our Security and Audit trail pages, sign-in events and record history are append-only, and each electronic signature stores its meaning, the time, and the IP address and browser it was made from.
• Cookies and similar technologies, as described in section 7.

Information from others

We may receive information about you from your employer or organization when they invite you to an account, from partners and event organizers when you ask to hear from us, and from publicly available professional sources.

3. How we use information

• To provide, operate, maintain and secure the Services, including authenticating users and keeping the records our customers rely on.
• To respond to enquiries, arrange demos, provide onboarding and support, and send service and account messages.
• To send marketing communications where permitted. You can opt out at any time.
• To send SMS messages you have opted in to, as described in section 5.
• To monitor, investigate and prevent fraud, abuse, security incidents and violations of our Terms.
• To understand how the website and Services are used so we can improve them.
• To bill customers, keep business records, and comply with our legal obligations and enforce our agreements.

We do not sell personal data, and we do not use Customer Data to advertise to anyone.

4. Legal bases (EEA and UK)

Where the EU or UK General Data Protection Regulation applies, we rely on: performance of a contract (to provide the Services); our legitimate interests (to secure, support, improve and market the Services, balanced against your rights); your consent (for example, for SMS messages and non-essential cookies, which you can withdraw at any time); and compliance with legal obligations.

5. SMS Messaging

We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you with the services of that campaign. We may share your Personal Data, including your SMS opt-in or consent status, with third parties that help us provide our messaging services, including but not limited to platform providers, phone companies, and any other vendors who assist us in the delivery of text messages.

You can stop receiving text messages at any time by replying STOP, and get help by replying HELP. Message and data rates may apply. The Messaging Terms & Conditions in our Terms of Service also apply.

6. How we share information

• Service providers who process personal data for us under contract, such as hosting and infrastructure, email and messaging delivery, customer support, analytics and payment processing. They may use it only to provide their services to us.
• Within a customer’s account: information in a QAbility account is visible to that customer’s administrators and to the users and external parties they grant access to.
• Professional advisers, such as lawyers, auditors and insurers, under a duty of confidentiality.
• Authorities, where required by law or legal process, or where necessary to protect the rights, property or safety of QAbility, our customers or others.
• A buyer or successor, if QAbility is involved in a merger, acquisition, financing or sale of assets, subject to this policy.
• Anyone else with your consent or at your direction.

7. Cookies and similar technologies

We use cookies and similar technologies that are necessary to run the website and the software, for example to keep you signed in and to remember your settings, and we may use analytics to understand how the website is used. Where the law requires consent for non-essential cookies, we ask for it. You can also block or delete cookies in your browser settings; some features may not work without them.

8. How long we keep information

We keep personal data for as long as we need it for the purposes in this policy: for the life of an account, for as long as needed to respond to an enquiry or maintain a business relationship, and for longer where the law requires it or where we need it to resolve disputes or enforce our agreements. We keep Customer Data as our customer instructs and as our agreement with them sets out.

Quality records are often subject to retention obligations of their own, and an audit trail is designed so that its history cannot be altered. A request to delete information held in a customer’s quality records is therefore handled with that customer and may be limited by the obligations that apply to them.

9. Security

We use technical and organizational measures designed to protect personal data against unauthorized access, loss and misuse. Our Security page describes the controls in the product. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you and the relevant authorities where the law requires it.

10. International transfers

QAbility and our service providers may process personal data in countries other than the one where you live, including the United States, whose data protection laws may differ from yours. Where the law requires it, we put appropriate safeguards in place for those transfers, such as the European Commission’s Standard Contractual Clauses.

11. Your rights and choices

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to receive a copy of it in a portable format, to restrict or object to how we use it, and to withdraw consent you have given. Residents of certain US states, including California, also have the right to know what we collect and share and to not be discriminated against for exercising their rights. We do not sell personal data or share it for cross-context behavioral advertising.

• To make a request, email privacy@qability.com. We may need to verify your identity before we act, and you may use an authorized agent where the law allows.
• To stop marketing emails, use the unsubscribe link in any of them. To stop text messages, reply STOP.
• If your information is in a customer’s QAbility account, contact that organization; we will support them in responding.
• If you are in the EEA or the UK, you also have the right to complain to your local data protection authority.

12. Children

The Services are designed for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. We will change the “Last updated” date above, and where a change is significant we will give notice through the Services or by email.

14. Contact us

Questions or requests about this policy or your personal data: privacy@qability.com. Our Terms of Service are at qability.com/legal/terms.