Insights Privacy Policy

Last updated: May 16, 2026

This Privacy Policy explains how Quivereg, Co. ("Quivereg," "Insights," "we," "us," or "our"), a Delaware corporation operating the Insights finance analytics platform, collects, uses, shares, and protects information about you when you use our finance analytics platform and related services (collectively, the "Services"). It also explains your rights and how to exercise them.

By using the Services, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, do not use the Services.

1. Information We Collect

1.1 Information you provide directly. We collect information you give us when you create an account, upload data, communicate with us, or use the Services:

• Account information: name, email address, password (stored as a cryptographic hash), organization name, and billing information.
• Data you upload: finance spreadsheets, CSV files, database exports, and other files you connect to the Services for analysis. You retain ownership of this data.
• Communications: messages you send us via email or in-product support channels.
• Payment information: payment card details are collected and processed by Paddle.com, Inc. ("Paddle"), our Merchant of Record, and are not stored on our servers. We receive only a tokenized reference and the last four digits of your card.

1.2 Information collected automatically. When you use the Services, we collect certain information automatically:

• Usage data: features accessed, queries submitted, reports or reviews created, and session duration.
• Device and browser information: IP address, browser type and version, operating system, and device identifiers.
• Log data: server logs including request timestamps, pages visited, and error reports.
• Cookies and similar technologies: see Section 5.

1.3 Information from third parties. If you connect a third-party integration (for example, Google Sheets or a cloud database), we receive the data you authorize that integration to share with us. We do not collect more data from those sources than what is necessary to provide the Services.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Services.
• Process queries you submit against your data using AI-assisted analysis.
• Generate charts, finance reports, reviews, and analytical summaries on your behalf.
• Authenticate you and protect your account.
• Process payments and send invoices and receipts.
• Send you service-related communications (security alerts, product updates, billing notices). You cannot opt out of transactional messages while you have an active account.
• Send you marketing communications, where you have consented or where we have a legitimate interest and applicable law permits. You may opt out at any time.
• Comply with legal obligations and enforce our Terms of Service.
• Detect and prevent fraud, abuse, and security incidents.

We do not sell your personal data to third parties. We do not use your uploaded business data to train AI models.

3. AI Processing and Your Data

The Services use large language models (LLMs) to interpret your queries and generate analysis. When you submit a query, relevant portions of your data may be sent to an AI subprocessor to generate a response.

• AI subprocessors are listed in Section 4.
• Your data is sent only to produce the output you requested and is not used by those subprocessors to train their models under our agreements with them.
• You should not upload data that includes special categories of personal data (health records, financial account numbers, government ID numbers) unless you have a lawful basis to process such data and have reviewed our Data Processing Agreement.

4. Sharing Your Information

We do not share your personal data except in the following circumstances:

4.1 Service providers (subprocessors). We share data with trusted vendors who process it on our behalf under written data processing agreements. Current subprocessors include:

We maintain an up-to-date subprocessor list. Enterprise customers may request notification of subprocessor changes via their Data Processing Agreement.

4.2 Legal requirements. We may disclose your information if required by law, regulation, or valid legal process (such as a court order or subpoena). Where permitted, we will notify you before disclosing.

4.3 Business transfers. If Quivereg, Co. is acquired, merges with another company, or transfers substantially all of its assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Services before your data becomes subject to a materially different privacy policy.

4.4 With your consent. We may share information for any other purpose with your explicit consent.

5. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

• Strictly necessary cookies: required for authentication and core functionality. These cannot be disabled.
• Analytics cookies: help us understand how users interact with the Services (e.g., which features are used most).
• Preference cookies: remember your settings (e.g., theme, language).

You can control non-essential cookies through our cookie preference center. Disabling analytics or preference cookies does not affect your ability to use the Services.

We do not use advertising cookies or share data with ad networks.

6. Data Retention

We retain your personal data for as long as your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. Specifically:

• Account data: retained for the duration of your subscription plus 90 days after account closure, after which it is deleted or anonymized.
• Uploaded data: retained while your account is active and deleted within 30 days of account closure, unless you request earlier deletion.
• Billing records: retained for 7 years to comply with financial record-keeping laws.
• Log data: retained for up to 12 months for security and fraud prevention purposes.

7. Data Security

We implement industry-standard technical and organizational measures to protect your data, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
• Access controls limiting employee access to personal data to those who need it.
• Regular security reviews of our infrastructure and code.

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at team@quivereg.com.

In the event of a personal data breach that poses a risk to your rights, we will notify affected users and, where required, relevant supervisory authorities within the timeframes required by applicable law (72 hours under GDPR).

8. International Data Transfers

Insights is headquartered in the United States. If you are located outside the United States, your data may be transferred to and processed in the United States and other countries where our subprocessors operate.

For transfers from the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission for transfers to countries without an adequacy decision.
• UK International Data Transfer Agreements (IDTAs) for transfers from the United Kingdom.

For transfers from Egypt, we comply with the requirements of Egypt's Personal Data Protection Law No. 151 of 2020 and its executive regulations.

You may request a copy of the transfer mechanism applicable to your data by contacting us at team@quivereg.com.

9. Your Privacy Rights

Depending on where you are located, you may have the following rights regarding your personal data. To exercise any of these rights, contact us at team@quivereg.com. We will respond within 30 days (or the timeframe required by applicable law).

9.1 Rights for all users.

• Access: request a copy of the personal data we hold about you.
• Correction: request that we correct inaccurate or incomplete data.
• Deletion: request deletion of your personal data, subject to our legal obligations to retain certain records.
• Data portability: request your data in a structured, machine-readable format.

9.2 Additional rights for EEA and UK residents (GDPR / UK GDPR).

• Object to processing: object to processing based on legitimate interests or for direct marketing.
• Restrict processing: request that we restrict processing of your data in certain circumstances.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Lodge a complaint: you have the right to lodge a complaint with your local supervisory authority. A list of EU supervisory authorities is available at edpb.europa.eu. UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk.

9.3 Additional rights for California residents (CCPA / CPRA).

California residents have the right to:

• Know what personal information we collect, use, disclose, and sell (we do not sell personal information).
• Delete personal information we have collected, subject to certain exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioral advertising.
• Non-discrimination for exercising your privacy rights.

To submit a verifiable consumer request, contact us at team@quivereg.com. We may need to verify your identity before processing your request.

9.4 Rights for Egypt residents (PDPL).

Residents of Egypt have rights under Egypt's Personal Data Protection Law No. 151 of 2020, including the right to access, correct, and request deletion of their personal data. Requests may be submitted to team@quivereg.com.

10. Children's Privacy

The Services are not directed to children under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at team@quivereg.com and we will delete it promptly.

11. Links to Third-Party Services

The Services may contain links to third-party websites or integrations. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access through our platform.

12. Legal Bases for Processing (EEA and UK)

If you are in the EEA or UK, we process your personal data on the following legal bases under GDPR / UK GDPR:

You may request more information about the legal bases we rely on by contacting us at team@quivereg.com.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (to the address associated with your account) or by a prominent notice within the Services at least 14 days before the changes take effect. Your continued use of the Services after the effective date constitutes your acceptance of the updated policy.

We will maintain a version history of this policy. Prior versions are available on request.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at:

Quivereg, Co. c/o The Corporation Trust Company, 1209 Orange Street, Wilmington, Delaware 19801, United States Email: team@quivereg.com

For all inquiries including security incidents: team@quivereg.com