Privacy Policy

TQMU.com — The Quality Marketing Unit, 2102, Sunny Enclave, Sector 125, Mohali, Punjab, India ("TQMU", "we") is the data controller (and "business" under California law) for this website and dashboard. Privacy contact and Grievance Officer (India DPDP Act): jpannu@gmail.com.

• Account data: name, email, password (hashed), two-factor settings.
• Audit data: website addresses you submit and the reports we generate from public pages.
• Citation checks: brand names, questions you enter and the AI answers returned.
• Leads and contact: name, work email, company, website, message, consent time and policy version.
• Agency data: client names, contact emails, team invites and branding you add.
• Technical data: IP address (hashed for spam protection), browser type, request time.
• Payments: handled by our payment provider; we never see or store card numbers.

We do not knowingly collect data from children under 16, and we do not collect sensitive personal information.

• Running audits, reports and your account — contract.
• Security, fraud and spam prevention — legitimate interests.
• Sending the full scoring rulebook and marketing emails — consent (withdraw any time).
• Tax, accounting and legal duties — legal obligation.

Only service providers that process data on our behalf under contract:

• Cloud hosting and database (app, storage, authentication).
• AI model providers, for citation checks (your questions and brand only).
• Payment provider / merchant of record, for purchases and tax.
• Email delivery, for verification and account emails.

We do not sell your personal information and do not share it for cross-context behavioral advertising. We honor Global Privacy Control (GPC) signals as an opt-out.

We are based in India and our providers may process data in the US, EU or elsewhere. Where GDPR or UK GDPR applies, transfers rely on Standard Contractual Clauses or equivalent safeguards.

• Account data and reports: while your account is active; deleted when you delete your account.
• Leads: 12 months. Contact messages: 24 months.
• Spam-protection records: 2 days. Closed privacy requests: 36 months (proof of compliance).
• Purchase records: as required by tax law.

Essential storage keeps you signed in and holds your latest report. Optional analytics and marketing cookies only run with your consent. Details in our Cookie Policy.

EU / UK (GDPR): access, correction, deletion, restriction, portability, objection, withdraw consent, and complaint to your local data protection authority.

California (CCPA/CPRA) and other US states: know/access, delete, correct, opt out of sale/sharing, limit use of sensitive data, and no discrimination for using these rights. You may use an authorised agent.

India (DPDP Act 2023): access, correction, erasure, grievance redressal and nominating a person to act for you.

Signed-in users can download or delete their data from Dashboard → Account. Anyone can use our privacy request form or email us. We reply within 30 days (45 days for US state requests) and may verify your identity first.

Encrypted connections, row-level access controls, hashed passwords, optional authenticator 2FA for clients and mandatory 2FA for staff.

Material changes update the date above; we ask for fresh consent where the law requires.