Privacy Policy

1. Introduction & Scope

Quint Security, Inc. (“Quint,” “we,” “us,” or “our”) operates the website at quintai.dev and the Quint Security platform (collectively, the “Services”). This Privacy Policy describes how we collect, use, disclose, and protect personal information when you visit our website, create an account, or interact with us through marketing channels.

Quint acts as a conduit for AI agent traffic controlled by our customers. Customer data transits through the Quint infrastructure solely for security evaluation, compliance enforcement, and audit logging as configured by the customer. We do not own, sell, or use customer platform data for advertising.

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Information from Third Parties

We may receive information from:

• Analytics providers (e.g., Google Analytics) — aggregated website usage data
• Business partners — referral information when introduced by a partner
• Public sources — professional information from company websites or professional networks for sales outreach

3. How We Use Your Information

We use personal information for the following purposes:

1. Service Delivery — Creating and managing your account, providing access to the Quint platform, processing transactions
2. Communications — Responding to inquiries, sending service-related notices (security alerts, maintenance windows, policy changes)
3. Marketing — Sending product updates, newsletters, and promotional content (with opt-out available)
4. Analytics & Improvement — Understanding how our website and services are used to improve functionality and user experience
5. Security — Detecting, preventing, and responding to fraud, abuse, and security incidents
6. Legal Compliance — Complying with applicable laws, regulations, and legal processes
7. Business Operations — Internal administration, financial reporting, and business planning

We do not:

• Sell your personal information to third parties
• Use your personal information for automated decision-making or profiling that produces legal effects
• Use customer platform data (AI agent telemetry) for marketing or advertising purposes

4. How We Share Your Information

We share personal information only in the following circumstances:

4.1 Service Providers

We engage third-party service providers who process data on our behalf under contractual obligations:

A current list of sub-processors is maintained at quintai.dev/subprocessors and updated as changes occur.

4.2 Legal Requirements

We may disclose personal information if required by law, regulation, legal process, or governmental request. Where permitted, we will attempt to notify you before disclosing your information in response to legal process.

4.3 Business Transfers

In connection with a merger, acquisition, reorganization, or sale of assets, personal information may be transferred to the acquiring entity. We will notify you of any such transfer and any choices you may have regarding your information.

4.4 With Your Consent

We may share your information with third parties when you have given explicit consent.

5. Legal Bases for Processing (GDPR)

For individuals in the European Economic Area (EEA), United Kingdom (UK), and Switzerland, we process personal data under the following legal bases:

You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. Data Retention

We may retain anonymized, aggregated data indefinitely for statistical purposes.

7. International Data Transfers

Quint is based in the United States. If you are located outside the United States, your personal information will be transferred to and processed in the United States.

For transfers from the EEA, UK, and Switzerland, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Agreement (IDTA) or UK Addendum to SCCs
• Adequacy decisions where applicable

We are committed to applying for self-certification under the EU-U.S. Data Privacy Framework (DPF) and UK Extension to the DPF as the company scales.

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

To exercise your rights: Email privacy@quintai.com with your request. We will respond within 30 days (or sooner as required by applicable law).

9. Cookies & Tracking Technologies

We use cookies and similar technologies for:

We do not use advertising cookies or third-party tracking pixels for behavioral advertising.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies may affect website functionality.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know — Categories and specific pieces of personal information collected
• Right to Delete — Request deletion of personal information
• Right to Correct — Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing — We do not sell or share personal information for cross-context behavioral advertising
• Right to Non-Discrimination — We will not discriminate against you for exercising your rights

To exercise your California rights: Email privacy@quintai.com or submit a request through our website.

In the preceding 12 months, we have collected the following categories of personal information: Identifiers, commercial information, internet or electronic network activity, and professional or employment-related information. We have not sold personal information to third parties.

11. Children's Privacy

Quint's services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 16, we will promptly delete that information.

12. Security

We implement appropriate technical and organizational measures to protect personal information, including:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• API key hashing (SHA-256; plaintext keys are never stored)
• Role-based access controls with principle of least privilege
• Row-level security (RLS) for multi-tenant data isolation
• Regular security assessments and code reviews
• Tamper-evident audit logging with Ed25519 cryptographic signatures

No method of transmission or storage is 100% secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately at security@quintai.com.

13. What Quint Does NOT Collect

For clarity, the following data is never collected through our website or marketing operations:

• Content of conversations between users and AI agents
• User prompts or AI model responses
• Source code or file contents
• Personally identifiable information from AI agent tool calls (e.g., SSNs, credit card numbers)
• Keystroke data or screen recordings

For information about how the Quint platform handles AI agent telemetry data, please refer to our Data Processing Agreement.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website with a revised “Last Updated” date
• Sending an email notification to registered account holders for material changes

Your continued use of our services after any changes constitutes acceptance of the updated policy.

15. Data Protection Officer

While Quint is not currently required to appoint a Data Protection Officer under GDPR, we have designated a privacy contact responsible for data protection matters:

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices:

• Email: privacy@quintai.com
• Security issues: security@quintai.com
• Website: quintai.dev

For EEA/UK residents, you have the right to lodge a complaint with your local supervisory authority.