Privacy Policy — QanTech Platform

I. Who we are

QanTech ("we", "us") operates the QanTech Platform at app.qantech.ai, a legal practice platform for law firms in Jordan. Operator: QanTech, Amman, Jordan. Subscription payments are collected and invoiced by BARQ LTD (company no. 15777868, United Kingdom) as billing agent. Contact: privacy@qantech.ai.

This policy covers the Platform only. The public website at qantech.ai has its own privacy notice.

II. Our role

For the case content a firm places in the Platform, the firm is the controller and we process that content on its behalf under the Data Processing Agreement. For the account, security, usage and billing data we need to run the service, we are the controller.

III. What we collect

• Account data: full name, email address, firm, and role (team admin, senior or junior). Accounts are opened by signing up on the Platform, or by accepting an invitation from a firm's team admin.
• Authentication data: passwords (stored hashed by our authentication provider) and session tokens.
• Billing data: the firm's plan, number of seats, subscription status, renewal dates and payment history, and the reference Stripe assigns to the firm as its customer.
• Signup security data: the result of the Cloudflare Turnstile check, and a keyed hash of the IP address used to sign up (the address itself is never stored), deleted after 24 hours. Both are used only to prevent automated and abusive signups.
• Case content: case titles and descriptions, uploaded documents (PDF and DOCX), discussion messages, notes, tasks and due dates, and AI case briefs.
• AI inputs and outputs: questions put to the Assistant and its answers with cited sources; documents submitted to the Analyzer.
• Usage records: the number and size of AI requests per user and per team, used for fair-use limits and billing.
• Technical data: IP address, browser type, timestamps and error logs, processed by our hosting and security providers.

We do not collect or store payment card data. Card details are entered on Stripe's own pages and processed by Stripe (Section VI).

IV. How we use it

We use personal data to provide the Platform; authenticate users and keep each firm's data isolated; generate the AI answers, analyses and briefs you request; apply rate limits and prevent abuse, including automated signups; process subscription payments; provide support; and meet our legal obligations.

We do not sell personal data, we do not show advertising in the Platform, and we do not use your content to train or fine-tune AI models.

V. AI processing

When you use the Assistant, the Analyzer or case briefs, the relevant text (your question, extracts from your documents, relevant case content, and passages from our Jordanian law corpus) is sent to Anthropic, whose Claude models generate the response. To find the relevant passages, your question is also converted into a numerical representation (an embedding) by OpenAI.

Where the corpus does not cover a question, search queries drawn from it are sent to Perplexity, which searches a fixed list of official Jordanian sources and returns what it finds with links. Perplexity receives those queries, which may reflect details of the document under discussion, but not the documents themselves.

These providers process the data under commercial API terms that do not permit using it to train their models.

Documents you upload to the Analyzer, their analyses, and your Assistant conversations are stored in your account until you delete them.

AI output is an aid to research and review. It is not legal advice and must be verified by a qualified lawyer.

VI. Service providers

We use the following providers, which process personal data on our behalf under obligations of confidentiality. Most are companies based in the United States; our database and file storage are located in the EU.

Where this involves transferring personal data across borders, we do so under contractual safeguards, consistent with the Personal Data Protection Law No. 24 of 2023. Client data is not used to train AI models.

We will update this list before adding or replacing a provider that processes Customer data, as set out in the Data Processing Agreement.

VII. International transfers

Some of our providers are located outside Jordan. We transfer personal data only to the extent needed to provide the service, and we rely on contractual safeguards with each provider, consistent with the Personal Data Protection Law No. 24 of 2023.

VIII. Security

We protect data through encryption in transit and at rest; database-level access rules that isolate each firm and each private case; private document storage reachable only through short-lived signed links; server-side access checks on every request; rate limiting; and restricted administrative access.

IX. Retention

• Case content: kept until deleted by the firm's users. If the firm's subscription ends, the account remains available read-only and the content is kept until the firm asks us to delete it. Backup copies expire within 7 days of deletion.
• Assistant history: kept until the user deletes it or the account is closed.
• Analyzer uploads: the extracted text and its analysis are kept until the user deletes them or the account is closed; the original file is not retained unless saved to a case.
• Usage and billing records: kept as long as needed for billing, tax, accounting and legal obligations.
• Signup security records: the hashed IP address is deleted after 24 hours.
• Account data: kept while the account is active, then deleted or anonymised.

X. Your rights

Under Jordanian law you may request access to your personal data, its correction or deletion, restriction of or objection to its processing, and you may withdraw consent where processing relies on it. You may also lodge a complaint with the competent authority under the Personal Data Protection Law.

Where your data sits in a firm's case content, please contact that firm first: we act on its instructions. Send any request to privacy@qantech.ai. We respond within 30 days.

XI. Cookies

The Platform uses strictly necessary cookies only. See the Cookie Policy.

XII. Changes

We will notify firm administrators by email before any material change to this policy takes effect.

XIII. Confidentiality and non-disclosure

We do not share, sell or disclose any information about the lawyers and firms that subscribe to the Platform, including their names, their firms' names, or the fact that they use QanTech. We do not display their logos or name them in any case study, testimonial or other reference without their prior written consent.

The same applies to all case data, documents, messages, notes, and AI inputs and outputs.

The only exceptions are service providers that process information on our behalf under obligations of confidentiality (see Section VI), and disclosures required by Jordanian law or by court order.

XIV. Contact

privacy@qantech.ai