Privacy
Policy
How we collect, use, and protect your personal data in accordance with GDPR.
Product Privacy Policy
0. Scope of this policy
This Product Privacy Policy explains how personal data is processed in connection with the QMutator platform and related services (the "Service").
It applies to the Service itself (the application, APIs, administration interface, and endpoints). Cookies and similar technologies used on our public website are addressed in our separate Cookie Policy.
Capitalized terms not defined here have the meaning given in the QMutator Terms of Use.
1. Controller and contact
Controller (responsible party under the GDPR):
Emmet Software Labs GmbH & Co. KG
Hertzstr. 6, 32052 Herford, Germany
Phone: +49 5221-763 999-10
Email: [email protected]
Data Protection Officer:
Emmet Software Labs GmbH & Co. KG
Hertzstr. 6, 32052 Herford, Germany
Email: [email protected]
2. Our role — controller, not processor of customer content
2.1 Controller data. We act as the controller for the personal data we process to make the Service available to you and your users — for example account, contact, authentication, usage, support, and billing data described in Section 3.
2.2 No processing of personal data on your behalf. The Service is designed for product and catalog data and is not intended to process personal data on your behalf. Under the Terms of Use you agree not to submit personal data as Customer Data. Accordingly, we do not act as your processor with respect to Customer Data, and no data-processing agreement under Article 28 GDPR is required for that purpose.
2.3 If personal data is submitted anyway. If you nonetheless submit personal data through the Service, you do so contrary to the Terms of Use and remain responsible for it as controller; we may remove or delete such data as described in the Terms of Use.
3. Personal data we process
3.1 Account and registration data. Name, business email address, organization, role, and similar details of the individuals who register for or administer the Service.
3.2 Authentication and access data. Login identifiers, security tokens, and the connection identifiers used to link the Service to your systems or to a third-party AI Client (for example via the Model Context Protocol).
3.3 System logs and usage data. (a) System, security, and operational logs — including diagnostic and performance data, IP address, device/browser information, and timestamps — used to operate and secure the Service. (b) Usage data recording how the Service is used (for example feature and API activity and configuration actions). Raw usage records are high-volume and are aggregated shortly after collection into reduced-detail summaries that are less granular than a full audit trail.
3.4 Support and communications data. Information you provide when you contact us for support or otherwise correspond with us.
3.5 Billing and subscription data. Where the Service is obtained through the Microsoft Azure Marketplace, subscription and consumption information is handled by Microsoft as part of the Marketplace transaction. We receive limited billing and subscription identifiers necessary to provision and meter the Service; we do not receive full payment-card details.
3.6 Customer Data. Product and catalog data you connect to or process through the Service. This is not intended to contain personal data (see Section 2).
4. Purposes and legal bases
We process personal data for the following purposes and on the following legal bases under Article 6(1) GDPR:
- To provide, operate, and support the Service, manage accounts, and perform our contract with you — Art. 6(1)(b) (contract).
- To secure the Service, prevent abuse, ensure availability, and maintain, analyze, and improve the Service — Art. 6(1)(f) (legitimate interests).
- To handle billing and meet legal, tax, and accounting obligations — Art. 6(1)(c) (legal obligation) and Art. 6(1)(b) (contract).
- Where we ask for your consent (for example certain optional communications or cookies/local storage that are not strictly necessary) — Art. 6(1)(a) (consent), and Section 25(1) TDDDG (formerly TTDSG) for device access.
Where we rely on legitimate interests, we balance those interests against your rights and freedoms; contact us for more information about this balancing.
5. AI features and third-party AI Clients
5.1 AI features. Certain features use artificial-intelligence models to categorize, generate, transform, or enrich content. Because the Service is not intended to process personal data (Section 2), the content processed by these features should not contain personal data.
5.2 Self-hosted models; customer-integrated models (BYOT). The Service's standard AI features run on models that we self-host within our EU/EEA infrastructure; content processed by these features is not transmitted to any third-party model provider. You may optionally integrate an external model — for example using a bring-your-own-token (BYOT) approach with your own credentials — in which case the external provider processes the relevant data at your direction under your own arrangement and that provider's terms, is not our sub-processor, and is not our responsibility.
5.3 Third-party AI Clients. If you operate or configure the Service through a third-party AI Client (for example ChatGPT or Claude), that provider acts as an independent controller for the data you exchange with it, under its own privacy terms. We are not responsible for third-party AI Clients.
5.4 Admin MCP purpose and data limits. The QMutator Admin app for AI Clients is limited to administration of product and catalog data. Do not submit authentication material, payment-card or banking data, health information, government identifiers, biometric data, or personal contact data through its tools. Connection authentication is configured in the QMutator dashboard and is not returned to the AI Client. Tool responses are minimized to the information needed for the requested administration action.
6. Hosting and sub-processors
6.1 Hosting. The Service is hosted on Microsoft Azure in data-center regions located within the European Union / European Economic Area. Microsoft acts as our infrastructure provider for the Service.
6.2 Sub-processors. We engage a limited number of service providers to help us provide the Service. Each is bound by appropriate data-protection obligations. Current sub-processors include:
- Microsoft (Microsoft Ireland Operations Ltd. / Microsoft Corporation) — cloud hosting, infrastructure, and operational and platform services within EU/EEA regions, and Azure Marketplace billing. Individual Azure services are components of this single provider and are not listed separately.
- AI models: standard AI features use models self-hosted by us within our EU/EEA infrastructure (no third-party model provider acts as our sub-processor for these features). Models you integrate yourself via a BYOT approach are engaged by you, not by us (see Section 5).
- Customer support is provided through a support portal integrated into the Service and hosted on the same Microsoft Azure EU/EEA infrastructure; we do not use a separate third-party helpdesk or support sub-processor.
6.3 Updates. The sub-processors we use are those set out in this Section. We will update this Product Privacy Policy whenever we add or change a sub-processor. You may also request the current list from the contact in Section 1.
7. International transfers
7.1 EU/EEA by default. The Service is hosted within the EU/EEA, and we seek to keep processing within the EU/EEA wherever practicable.
7.2 Transfers outside the EU/EEA. Where personal data is transferred to a country outside the EU/EEA (for example to a provider in Section 6), we rely on an appropriate transfer mechanism under Chapter V GDPR, such as a European Commission adequacy decision (including, for certified U.S. recipients, the EU-U.S. Data Privacy Framework) or the Standard Contractual Clauses, together with any supplementary measures required. A copy of the relevant safeguards is available on request.
8. Retention
8.1 We retain personal data only for as long as necessary for the purposes in Section 4.
8.2 Account data is retained for the duration of your use of the Service. Following termination or expiry of the applicable Azure Marketplace subscription, deletion of associated data is governed by the subscription lifecycle described in the Terms of Use, subject to Section 8.3.
8.3 System, security, and operational logs are retained for up to 30 days. Raw usage records are aggregated shortly after collection; the resulting reduced-detail aggregates are retained for up to 30 days. Billing and accounting records are retained for the periods required by German tax and commercial law (generally up to 10 years).
9. Security
We maintain appropriate technical and organizational measures to protect personal data, including encryption of data in transit (TLS) and at rest, access controls and least-privilege access, logging, and hosting within EU/EEA Azure regions. No method of transmission or storage is completely secure, but we work to protect personal data using measures appropriate to the risk.
10. Your rights
10.1 Subject to applicable law, you have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting prior processing.
10.2 To exercise these rights, contact us using the details in Section 1.
10.3 You also have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, LDI NRW). You may also complain to the authority in your place of residence or work.
11. Automated decision-making
We do not use personal data for automated decision-making that produces legal or similarly significant effects on individuals within the meaning of Article 22 GDPR. AI features are tools operated by you and are not used to make decisions about data subjects.
12. Cookies and local storage in the application
The Service uses cookies and similar technologies that are strictly necessary to authenticate users and operate the application. Any non-essential cookies or similar technologies are used only with your consent. For cookies on our public website, see our separate Cookie Policy.
13. Changes to this policy
We may update this Product Privacy Policy from time to time. We will post the updated version with a new effective date and, for material changes, provide reasonable notice.
14. Contact
Emmet Software Labs GmbH & Co. KG
Hertzstr. 6, 32052 Herford, Germany
Represented by: Emmet Software Labs Verwaltungs GmbH, acting through its managing director Timo Lindemann
Commercial register: Amtsgericht Bad Oeynhausen, HRA 9351 (general partner: Emmet Software Labs Verwaltungs GmbH, Amtsgericht Bad Oeynhausen HRB 15868)
VAT ID (USt-IdNr.): DE 277517528
Phone: +49 5221-763 999-10
Email: [email protected]
Data Protection Officer: [email protected]
Website: https://www.emmet-software-labs.com/