Privacy Policy for Q

This Privacy Policy explains how The Nexus Collective GmbH ("we", "us", "our") collects, uses, and protects your personal data when you use Q at https://heyq.com.

1. Data Controller

The Nexus Collective GmbH is the data controller responsible for your personal data.

2. Data We Collect

2.1. Account Data

When you create an account, we collect:

• Email address
• Name (if provided)
• Profile information you choose to add
• Authentication data via Google OAuth or email/password through Supabase Auth

2.2. Content Data

Data you create while using the service:

• Ideas, decisions, learnings, and related content
• Workspace and collaboration data
• Files and attachments you upload

2.3. Usage Data

We collect anonymized usage data including:

• Pages visited and features used
• Session duration and interaction patterns
• Device type and browser information

This data is collected anonymously and cannot be used to identify you personally.

2.4. Payment Data

Payment information is collected and processed directly by Stripe. We do not store your credit card details on our servers. We receive only transaction confirmations and billing history.

2.5. Browser Extension Data

If you install the Q browser extension, data is only sent from your browser to our servers when you explicitly open the popup and submit a prompt. At that point we transmit:

• the URL and title of the tab that was active when you opened the popup,
• a plain-text excerpt of the page content,
• any text you had selected on the page, and
• the prompt you typed.

Nothing is transmitted passively or in the background. The extension reuses your existing Q login cookie and does not store a separate API key. You can uninstall the extension at any time; data already stored in your Q workspace is unaffected until you delete it from within the product.

3. How We Use Your Data

We use your data to:

• Provide and maintain the service
• Process your transactions
• Send transactional emails (account confirmations, receipts)
• Send marketing communications (with your consent)
• Improve our service based on anonymized usage patterns
• Respond to support requests
• Comply with legal obligations

4. Legal Basis for Processing (GDPR)

We process your data based on:

• Contract: Processing necessary to provide the service you requested
• Consent: For marketing communications and optional features
• Legitimate Interest: For service improvement, security, and fraud prevention
• Legal Obligation: For compliance with applicable laws

5. Third-Party Processors

We use the following third-party services to process your data. All processors are GDPR-compliant and data is primarily - where possible - processed within the European Union:

6. AI Features and Data Processing

When you use AI-powered features, relevant content is sent to our AI providers (currently OpenAI, Anthropic, Google, Vercel (Gateway)) to generate responses.

Important: We do not use your content to train AI models. Your data is processed only to provide the specific AI features you request.

7. Data Retention

• Account Data: Retained while your account is active
• Content Data: Retained until you delete it or your account
• Usage Analytics: Anonymized data retained for up to 24 months
• Payment Records: Retained as required by tax and accounting laws (typically 10 years in Germany)
• Support Communications: Retained for 3 years after resolution

8. Your Rights Under GDPR

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Delete your personal data
• Restriction: Limit how we process your data
• Portability: Receive your data in a portable format
• Object: Object to certain processing activities
• Withdraw Consent: Withdraw consent at any time for consent-based processing

9. Data Export and Account Deletion

9.1. Data Export

You can export your data at any time through your account settings or individual idea settings. Export options include:

• Cursor rules configurations
• MCP configurations
• ZIP archives containing all your content

9.2. Account Deletion

You can delete your account at any time from your account settings. Upon deletion:

• Your account and content will be permanently removed
• Some data may be retained as required by law (e.g., payment records)
• Anonymized analytics data is not affected

We recommend exporting your data before deletion.

10. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS) and at rest
• Row-level security in our database
• Regular security assessments
• Access controls and authentication

11. International Data Transfers

Your data is primarily stored and processed in the European Union (Supabase EU region). When data is transferred outside the EU (e.g., to AI providers), we ensure appropriate safeguards are in place.

12. Cookies

We use cookies for authentication, preferences, and anonymized analytics. For details, see our Cookie Policy.

13. Children's Privacy

Q is not intended for children under 16 (EU) or 13 (elsewhere). We do not knowingly collect data from children below these ages.

14. Changes to This Policy

We may update this Privacy Policy periodically. For material changes, we will notify you via email or through the service at least 30 days before the changes take effect.

15. Complaints

If you have concerns about our data practices, please contact us at support@heyq.com.

You also have the right to lodge a complaint with a supervisory authority. In Germany, this is the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI).

16. Contact

For privacy-related inquiries: