Privacy Policy - QLines Platform

Introduction

At QLines, we are committed to protecting your privacy and ensuring compliance with applicable data protection laws, including the European Union's General Data Protection Regulation (GDPR). This policy outlines our approach to data handling and privacy protection across our platform and services.

EU Privacy Compliance

QLines complies with the European Union's General Data Protection Regulation (GDPR) and other applicable EU privacy laws. Our commitment to EU privacy standards includes:

• Lawful Basis for Processing: We process personal data only when we have a lawful basis, such as consent, contractual necessity, or legitimate interests
• Data Minimization: We collect and process only the minimum amount of personal data necessary for our services
• Purpose Limitation: Personal data is processed only for specified, explicit, and legitimate purposes
• Data Accuracy: We maintain accurate and up-to-date personal data and provide mechanisms for data correction
• Storage Limitation: Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected
• Security: We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or destruction
• Transparency: We provide clear information about our data processing activities through this privacy policy

Your EU Privacy Rights

Under GDPR and applicable EU privacy laws, you have the following rights regarding your personal data:

• Right of Access: You can request access to your personal data and receive information about how it is processed
• Right to Rectification: You can request correction of inaccurate or incomplete personal data
• Right to Erasure: You can request deletion of your personal data under certain circumstances
• Right to Restrict Processing: You can request restriction of processing in certain situations
• Right to Data Portability: You can request transfer of your personal data to another service provider
• Right to Object: You can object to processing of your personal data for certain purposes
• Right to Withdraw Consent: Where processing is based on consent, you can withdraw consent at any time

To exercise any of these rights, please contact us through our contact form.

Data Collection and Storage

Our platform and applications are designed with your privacy in mind:

• Account Information: When you create an account, we collect email address and authentication credentials necessary for service provision
• Usage Data: We collect technical data such as IP addresses, device information, and usage patterns necessary for service operation and security
• Content Data: Data you provide through our services, such as meter readings, device configurations, and activity logs
• Communication Data: Information you provide when contacting us through our contact forms or support channels
• Meeting requests: your name, work e-mail address, organization and the details you enter (for example role, topic, segment, use case, approximate number of buildings or devices, integration needs). We use them only to answer your request and to prepare a possible collaboration (Art. 6(1)(b) GDPR, steps prior to entering into a contract). We store the consent you give in the form with its date. We do not pass your request to partners such as SigmaEnergie or Cedroswan without asking you first, and we keep it only as long as needed for these purposes

All data is stored securely on our servers and processed in accordance with applicable data protection laws.

Keeping Your Device and Account Secure

The apps keep you signed in on your device and your data is stored on our servers, so we recommend:

• Keeping your iPhone, iPad or Android device updated with the latest security patches
• Using device-level security features such as passcodes or biometric authentication
• Using a strong password that you do not use anywhere else, and signing out on devices you share

Service Providers and Third Parties

We do not sell your personal data. To provide the service we use the following providers, only for the purposes described:

• Hosting: our servers are located in Germany.
• AI assistant: when you ask the AI assistant a question, your question and the meter data needed to answer it are sent to Google (Gemini models) for processing.
• Bill scanning: a photo or PDF of a utility bill that you upload is sent to Google Cloud Vision to read its text.
• Meter scan: a photo of a meter taken with the iOS or Android app is read on your device (Apple Vision on iOS, Google ML Kit on Android). The photo is not uploaded or stored.
• Sign-in: if you sign in with Apple or Google, we receive your e-mail address and an identifier from them to create and recognise your account.
• E-mail: your e-mail address is stored with our e-mail provider Brevo for our product e-mails. Every such e-mail has an unsubscribe link.
• Purchases: subscriptions bought in the iOS app are processed by Apple through the App Store. When subscriptions are offered in the Android app, they are processed by Google Play. We receive your subscription status, not your payment details.

Data Deletion

• You can delete your account and all its data at any time in the app (Delete Account in the settings of the iOS and Android apps) or by contacting us
• Uninstalling the app removes it from your device, but it does not delete your account or the data stored on our servers; use Delete Account for that
• Data that only exists on your device, such as a meter photo you scanned, is never sent to us

Data Processing and Legal Basis

We process personal data based on the following legal bases under GDPR:

• Contract Performance: Processing necessary to provide our services and fulfill our contractual obligations
• Legitimate Interests: Processing necessary for our legitimate business interests, such as service improvement and security
• Consent: Processing based on your explicit consent, such as for marketing communications, analytics and advertising cookies
• Legal Obligations: Processing necessary to comply with legal requirements

Cookies, Web Analytics and Advertising (Google Analytics 4, Google Ads)

On our website and on the public sign-up pages of our apps we use services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), but only if and as far as you consent in our cookie banner. The banner offers two separate categories, Statistics and Marketing; "Accept all", "Reject all" and "Settings" are offered at the same level. Until you have made a choice, no Google service is loaded and no data is sent to Google. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Statistics: Google Analytics 4

• Purpose: to understand how our website and sign-up pages are used, for example which pages are visited and whether a contact, newsletter or sign-up form was sent successfully.
• Data: pages viewed, time and duration of the visit, referring website, approximate location (country/city, derived from the IP address, which Google Analytics 4 does not store), device and browser type, page category and product, and events such as a successfully sent form, a click on our e-mail address or phone number, on a sign-up button or on an App Store link. We do not send names, e-mail addresses or message contents to Google Analytics.
• Cookies: _ga and _ga_<ID> distinguish visits; they are stored for up to 2 years.
• Storage period: analytics event data is deleted automatically after at most 14 months.

Marketing: Google Ads conversion tracking, remarketing, Google signals and enhanced conversions

• Conversion tracking: if you came to us via a Google ad, Google Ads records whether this led to an enquiry, a newsletter sign-up or an account, so we can measure and improve our ads. The ad click identifier (gclid) is stored for this purpose.
• Remarketing: Google may show you our ads on other websites and in Google services based on your visit to our pages.
• Google signals: if you are signed in to a Google account and have allowed ad personalisation there, Google can link visits across your devices and use them for aggregated reports and audiences.
• Enhanced conversions: when you successfully send our contact form, sign up for the newsletter or confirm a new account, we pass a hashed (SHA-256) version of your e-mail address to Google, so Google can attribute the conversion to an ad click. The address is hashed on our server; your plain e-mail address is not sent to Google for this purpose.
• Cookies: _gcl_au (conversion linker), _gcl_aw and _gac_* (ad click information), stored for up to 90 days. Google may also use its own advertising cookies on google.com and doubleclick.net (for example IDE, up to 13 months).

Recipients, third-country transfer and your choices

• Recipients: Google Ireland Limited; data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR).
• Your choice is stored in the cookie_consent cookie for 1 year (technically necessary). When the categories change, we ask again.
• Withdrawal: you can change or withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer; the Google cookies of the withdrawn category are then deleted. You can also control personalised advertising in your Google ad settings.
• Accounts: inside our apps (after you sign in) no Google Analytics or Google Ads is used, and no user ID is sent to Google.

More information: Google Privacy Policy, how Google uses data from sites that use its services and data use in Google Analytics.

Website Language

Our website is available in English, German and Spanish. On your first visit we choose the language from the country of your IP address: German-speaking countries (Germany, Austria, Switzerland, Liechtenstein) get German, Spanish-speaking countries get Spanish, all other visitors get English. The lookup runs on our own server against a local table of IP ranges; your IP address is not sent to any third party for this and is not stored for this purpose. The table is derived from the "IP to Country Lite" database by DB-IP.com (licence CC BY 4.0).

• Language cookie: the qlang cookie stores your language (or your choice in the language switch) for 1 year, so that the automatic choice is made only once. It is technically necessary for the language function you request and contains no personal data. The legal basis is our legitimate interest in showing the site in a suitable language (Art. 6(1)(f) GDPR, § 25(2) TDDDG).
• Your choice: the language switch at the top right of every page changes the language at any time; the switch to English is remembered as well.
• Search engines and bots are not redirected; every language has its own address (/de, /es).

Data Storage and Processing Locations

Your personal data is processed and stored primarily within the European Economic Area (EEA). Our servers and data processing infrastructure are located in Germany and other EU member states to ensure compliance with GDPR requirements.

If data is transferred to or processed in countries outside the EEA, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions by the European Commission
• Other appropriate safeguards as required by GDPR

We maintain Data Processing Agreements (DPAs) with all third-party service providers who process personal data on our behalf to ensure GDPR compliance.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority (in Germany: the competent state data protection authority) within 72 hours as required by GDPR Article 33
• Inform affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms, as required by GDPR Article 34
• Document all data breaches, including the facts, effects, and remedial actions taken

Our data protection contact for breach notifications: contact@qlines.net

Data Protection Contact

For data protection inquiries and to exercise your GDPR rights, you can contact us:

Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us through our contact form or using the contact information above.

Changes to This Policy

We reserve the right to update this privacy policy at any time. Any changes will be reflected in the "Last Updated" date below. By continuing to use our application after such changes, you accept the updated policy.

Last updated: Oct 2026