Privacy Policy - Quantum Neuron Dashboard

Privacy Policy

Quantum Neuron Dashboard

Version: 3.2 (ENG)

Effective date: September 9, 2026

1. Introduction and Scope

This Privacy Policy describes how Quantum Neuron Inc. ("Quantum Neuron", "we", "us") processes Personal Data in connection with the Quantum Neuron Dashboard available at https://brain.quantumneuron.ai (the "Dashboard").

Quantum Neuron Inc. is the controller of the Personal Data described in this Privacy Policy in connection with the operation, maintenance, security and use of the Dashboard. Quantum Neuron Inc. is also the owner and provider of the Platform technology and the operator of the Dashboard.

Quantum Neuron Inc. is also the contracting and invoicing entity and the controller of billing, invoicing, tax and administrative data of clients that have entered into an Order Form or another commercial agreement with Quantum Neuron Inc.

Quantum Neuron Inc. is a corporation organized and existing under the laws of the State of Delaware, United States of America, holding federal tax identification number EIN: 30-1448079, with its principal place of business at 169 Madison Ave STE 15768, New York, NY 10016, United States of America. Quantum Neuron has appointed a representative in the European Union and a representative in the United Kingdom, identified in Section 2.

This Privacy Policy applies exclusively to the Dashboard. Other Quantum Neuron properties, including the marketing landing pages available at quantumneuron.ai and related domains, are subject to their own separate privacy notices.

This Privacy Policy does not govern the processing of Client Personal Data submitted by business clients to operationalize AI Personas, including End User conversations, Lead Data, Outbound Communication, knowledge base content or integration data. Such processing is carried out by Quantum Neuron in the role of processor or, where the client itself acts as a processor, sub-processor, and is governed by the applicable Master SaaS Agreement and Data Processing Agreement.

Access to the Dashboard is limited to:

• authorized personnel of Quantum Neuron's business clients that have entered into a Master SaaS Agreement with Quantum Neuron and have been added to the Dashboard as members of the client's team;
• authorized Quantum Neuron personnel operating, supporting and maintaining the Dashboard; and
• registered prospective users who have created a Dashboard account but whose organization has not yet entered into a Master SaaS Agreement, in which case access is limited to the meeting booking flow described in Section 5.7.

The Dashboard is a business-to-business product intended exclusively for adult professional users. Quantum Neuron does not knowingly collect Personal Data from persons under 18 years of age through the Dashboard.

2. Controller, Data Protection Officer and Representatives

2.1 Controller

Quantum Neuron Inc. is the controller of the Personal Data described in this Privacy Policy in connection with the operation, maintenance, security and use of the Dashboard.

Quantum Neuron Inc., a corporation under the laws of the State of Delaware, United States of America, EIN: 30-1448079, with its principal place of business at 169 Madison Ave STE 15768, New York, NY 10016, United States of America. General contact: contact@quantumneuron.ai. Privacy contact: privacy@quantumneuron.ai.

2.2 Data Protection Officer

Quantum Neuron has appointed and maintains - voluntarily, in accordance with the principles of Articles 37-39 EU GDPR - a Data Protection Officer. The Data Protection Officer is Mr. Krzysztof Kochanowski. Contact: ido@quantumneuron.ai.

2.3 Representative in the European Union (Article 27 EU GDPR)

Quantum Neuron has no establishment in the European Union, and the processing described in this Policy falls within the scope of Article 3(2) EU GDPR. Quantum Neuron has appointed, on the basis of a written mandate, Quantum Neuron Sp. z o.o. with its registered office in Warsaw, ul. Żurawia 6/12/745, 00-503 Warsaw, Poland, entered in the register of entrepreneurs of the National Court Register under KRS number: 0001222865, as its representative in the European Union pursuant to Article 27 EU GDPR. The representative constitutes a point of contact - alongside Quantum Neuron - for data subjects and supervisory authorities in all matters relating to the processing; contact: privacy@quantumneuron.ai and the representative's postal address indicated above. Quantum Neuron Sp. z o.o. does not participate in the processing of the Personal Data described in this Policy and does not act as a processor or subprocessor.

2.4 Representative in the United Kingdom (Article 27 UK GDPR)

To the extent Quantum Neuron processes Personal Data subject to the UK GDPR and has no establishment in the United Kingdom, Quantum Neuron has appointed, on the basis of a written mandate, Kochanowski Consulting Ltd, 151 Picton Road, Liverpool, Merseyside L15 4LG, United Kingdom, as its representative in the United Kingdom pursuant to Article 27 UK GDPR. Contact: ido@quantumneuron.ai.

3. Our Role in the Processing

Depending on the type of data and the purpose of the Processing, Quantum Neuron acts in different roles:

• Controller - with respect to the Personal Data described in this Privacy Policy, including Dashboard account data, authentication, account configuration, security telemetry, error monitoring, support communications and prospective-user data collected through the meeting booking flow. Quantum Neuron (Quantum Neuron Inc.) processes such data as a controller established in a third country; the EU GDPR applies to this processing directly on the basis of Article 3(2) EU GDPR.
• Processor - with respect to data submitted by our clients to the Dashboard to operate their AI Persona deployments. This includes, without limitation, End User conversation content, Lead Data, recipient data, Outbound Communication data, knowledge base content and integration data submitted by or on behalf of the client, to the extent such data is processed to operate the client's AI Persona deployment. Such Processing is governed by the Data Processing Agreement (the "DPA") entered into between Quantum Neuron and the relevant client and falls outside the scope of this Privacy Policy. The DPA is available at https://quantumneuron.ai/legal/m26/dpa.

If you are an End User of an AI Persona deployed by one of our clients, or a recipient of outbound communication initiated by one of our clients through the Services, the relevant controller of your Personal Data is the client operating the AI Persona or campaign. For the legal basis, purpose and scope of such processing, please consult that client's privacy notice.

4. Who this Policy Applies to

This Privacy Policy applies to the following categories of Data Subjects:

• Client Team Members - employees, contractors and other authorized personnel of our business clients who have been granted Dashboard access by their organization.
• Quantum Neuron Personnel - our employees and contractors operating, supporting and maintaining the Dashboard.
• Prospective Users - persons who have registered a Dashboard account but whose organization has not yet entered into a Master SaaS Agreement with Quantum Neuron; in such cases they are presented with the meeting booking flow described in Section 5.7.

Where a Data Subject is located in a jurisdiction whose data protection laws apply to the processing described in this Policy in addition to or instead of the EU GDPR or the UK GDPR, including a GCC Jurisdiction whose laws so provide, Quantum Neuron applies to such processing the same protections, safeguards and rights-handling machinery described in this Policy, which are designed to the standard of the EU GDPR.

5. Personal Data We Process and Purposes

5.1 Account and Profile Data

We process the following information about Dashboard users:

• first and last name;
• business email address;
• the organization (client) to which the user belongs;
• the user's role and permissions in the Dashboard;
• hashed credentials (passwords are stored exclusively as bcrypt hashes with a unique cryptographic salt; we never store passwords in plain text or in any reversible form);
• account preferences (including the selected interface language and account-level settings).

Purposes: providing Dashboard access, account administration, role-based access control, user authentication and applying user preferences. Legal bases: Article 6(1)(b) EU GDPR (performance of the contract between Quantum Neuron and the client through which the user obtains access) and Article 6(1)(f) EU GDPR (the legitimate interests of Quantum Neuron and the client in operating a secure user account system).

5.2 Authentication and Session Data

We process authentication events, session identifiers, login timestamps, IP addresses associated with sessions and the information necessary to maintain a secure logged-in state for the duration of the user's session.

Purposes: user authentication, session security, detection and prevention of unauthorized access, protection against brute-force attacks, rate limiting and account lockouts in accordance with NIST SP 800-63B guidelines. Legal bases: Article 6(1)(b) EU GDPR and Article 6(1)(f) EU GDPR (legitimate interest in securing our service).

5.3 Cookies and Local Storage

The Dashboard uses a strictly limited set of cookies and browser local storage entries, all of which are necessary for the operation of the Dashboard. The Dashboard does not use any advertising, profiling or third-party analytics cookies and does not embed Google Analytics, Meta Pixel, LinkedIn Insight Tag or any equivalent tracking technology.

Because all cookies and local storage entries described above are strictly necessary to deliver the Dashboard at the user's request, a consent banner is not required under Article 5(3) of Directive 2002/58/EC and its national implementations. Users may delete cookies and clear local storage at any time through their browser settings; doing so may, however, disrupt the operation of the Dashboard.

Should any non-essential cookies, advertising cookies, profiling cookies or third-party analytics technologies be introduced in the Dashboard in the future, we will update this Privacy Policy and implement the appropriate consent mechanism required by applicable law before activating such technologies.

5.4 Dashboard AI Persona Widget

After logging in, users have access to an AI Persona widget in the Dashboard designed to assist them in operating the Dashboard. The widget stores its operational state (conversation identifier, conversation history and similar information necessary to maintain the conversation) exclusively in the user's browser local storage.

Conversation content exchanged through the widget is processed in Quantum Neuron's underlying infrastructure to provide the assistant functionality. Where required by applicable AI transparency rules, including Regulation (EU) 2024/1689 (the "EU AI Act") to the relevant extent, the widget is designed to inform the user at the start of the interaction that they are conversing with an AI system. AI-generated outputs may be labeled or technically identifiable to the extent required or technically supported.

Legal bases: Article 6(1)(b) EU GDPR (performance of the contract between Quantum Neuron and the client) and Article 6(1)(f) EU GDPR (legitimate interest in providing user support within the Dashboard).

5.5 Error Monitoring and Session Replay (Sentry)

The Dashboard uses Functional Software, Inc. ("Sentry") for application error monitoring, performance telemetry and session replay recording of front-end interactions. Session replay records user interface events (such as clicks, navigation and page rendering) for the purposes of diagnosing errors, reproducing bugs and improving the stability and quality of the Dashboard. Sensitive form fields and similar fields are masked at the source to the extent supported by Sentry's data scrubbing features.

We configure masking, scrubbing or equivalent controls for sensitive form fields and user-entered content to the extent technically supported by Sentry or the relevant diagnostic tools. Session replay is used for diagnostics, security investigations and product stability - not for advertising, profiling or behavioral marketing.

Purposes: application error diagnostics, performance monitoring, security incident investigations and continuous improvement of the Dashboard. Legal basis: Article 6(1)(f) EU GDPR (legitimate interest in maintaining a secure, stable and high-quality service). Location: Sentry processes such data within the European Union on the basis of a Data Processing Agreement entered into with Quantum Neuron.

5.6 Support Communications

If a user contacts Quantum Neuron by email or other support channels, we process the content of such communications, including any Personal Data contained in them, for the purposes of providing support, troubleshooting and keeping a record of communications.

Legal bases: Article 6(1)(b) EU GDPR (performance of a contract) and Article 6(1)(f) EU GDPR (legitimate interest in providing client support and keeping a record of communications).

5.7 Pre-Contract Meeting Booking Flow (Calendly)

If a user creates a Dashboard account before their organization has entered into a Master SaaS Agreement with Quantum Neuron, the user is presented with an embedded meeting booking widget operated by Calendly LLC ("Calendly") in place of the standard onboarding path. The widget enables the user, at their sole discretion, to book a meeting with a Quantum Neuron sales representative.

Information the user enters into the embedded Calendly widget (such as name, email address and any additional details the user chooses to provide) is collected directly by Calendly and processed by Calendly as an independent controller in accordance with Calendly's own privacy notice. Quantum Neuron does not pass any user data to Calendly through the embedded widget; the user provides such data to Calendly through the widget on their own initiative.

Once a meeting is booked through the widget, Calendly informs Quantum Neuron of the booking and makes the booking details available to us. From the moment of receiving such booking details, Quantum Neuron processes them as a separate, independent controller for the purposes set out below.

Purposes (Quantum Neuron's processing of received booking data): preparing for and conducting the booked meeting; lead qualification; pre-contract communication. Legal bases: Article 6(1)(b) EU GDPR (steps taken at the data subject's request prior to entering into a contract) and Article 6(1)(f) EU GDPR (legitimate interest in qualifying and responding to leads). Location: Calendly processes data in the United States. To the relevant extent, the Chapter V EU GDPR transfer mechanisms apply, as described further in Section 9.

Calendly is not a Subprocessor with respect to Client Personal Data within the meaning of the DPA. It is used exclusively in the pre-contract meeting booking scenario described in this Section. To the extent Calendly processes Personal Data in the United States, the relevant Chapter V EU GDPR transfer mechanisms apply, as described in Section 9.

5.8 Security Telemetry, Audit Logs and Operational Logs

We process security-relevant telemetry, access logs, audit logs and similar operational data generated as a result of the use of the Dashboard, including IP addresses, user agent strings, device information, login and logout events, administrative actions and error events.

Purposes: protecting the security, integrity and availability of the Dashboard; preventing, detecting and investigating fraud, abuse and security incidents; complying with our legal obligations and demonstrating compliance with applicable data protection laws. Legal bases: Article 6(1)(f) EU GDPR (legitimate interest in protecting our service) and Article 6(1)(c) EU GDPR (compliance with legal obligations, including those under Article 32 EU GDPR).

6. What We Do Not Do in the Dashboard

For the avoidance of doubt, in the Dashboard we do not:

• use Google Analytics, Meta Pixel, LinkedIn Insight Tag or any other third-party advertising or web analytics tools;
• place any advertising, profiling or marketing cookies;
• share Personal Data with advertising networks or data brokers;
• sell or rent Personal Data;
• subject users to automated decision-making producing legal effects or similarly significantly affecting them within the meaning of Article 22 EU GDPR; or
• collect biometric identifiers or perform biometric categorization of users.

The statements above relate to the Dashboard operated by Quantum Neuron. They do not relate to third-party websites, platforms or communication channels operated by our clients or by independent external providers.

7. Use of Data for AI Model Training

Quantum Neuron does not use the Personal Data of Dashboard users in identifiable form to train, fine-tune or otherwise improve the AI models underlying its services. For model improvement purposes, Quantum Neuron uses exclusively data that has first been subjected to a documented, irreversible anonymization process and verified through a manual verification step. Following successful anonymization, the resulting data no longer constitutes Personal Data within the meaning of applicable data protection laws.

Anonymized datasets used for model improvement do not contain raw conversation logs and are not linked to any client, tenant, account or user identifier.

The detailed terms governing the use of client-submitted data for AI model improvement, the anonymization process and non-production test environments, including the client's right to opt out by notice or directly in the applicable Order Form, are set out in the DPA available at https://quantumneuron.ai/legal/m26/dpa.

8. Recipients and Subprocessors

The Personal Data described in this Privacy Policy is processed on the infrastructure of, or with the support of, the following service providers, acting as our processors or, where so indicated, as separate independent controllers:

Not all Subprocessors named on the Subprocessor List are used in every client deployment. The providers actually used depend on the Services, features, integrations, regions and communication channels activated for the relevant client.

The full and current list of subprocessors used by Quantum Neuron in connection with the services provided to clients is available at https://quantumneuron.ai/legal/m26/subprocessors. Calendly is not included on that list because it does not process Client Personal Data under the DPA; it is engaged exclusively in the pre-contract scenario described in Section 5.7.

We may also disclose Personal Data: (a) to competent public authorities, courts or regulators where required by applicable law or in response to valid legal process; (b) to professional advisors, such as auditors, lawyers and accountants, bound by appropriate confidentiality obligations; and (c) to a legal successor in the context of a merger, acquisition or similar corporate transaction, subject to appropriate safeguards.

9. International Data Transfers

The controller is Quantum Neuron Inc., established in the United States. The EU GDPR applies directly to the processing described in this Policy on the basis of Article 3(2) EU GDPR, and Quantum Neuron has appointed a representative in the European Union and a representative in the United Kingdom, identified in Sections 2.3 and 2.4. The primary processing of Personal Data takes place within the European Economic Area (AWS infrastructure in the Ireland region). Quantum Neuron may access Personal Data from the United States to the extent necessary to operate, maintain, secure and support the Dashboard. In addition, certain providers, in particular Calendly, operating the pre-contract meeting booking widget, and Stripe, processing payments, process Personal Data in the United States.

Where Personal Data is transferred outside the European Economic Area to further processors or separate controllers, Quantum Neuron relies on the appropriate Chapter V EU GDPR transfer mechanisms, including:

• the EU standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914;
• where applicable, European Commission adequacy decisions with respect to the recipient country.

With respect to Personal Data subject to the UK GDPR, the Chapter V UK GDPR transfer mechanisms apply accordingly, including the UK International Data Transfer Addendum to the EU SCCs, the "UK Addendum", or the relevant UK adequacy decisions.

Where a transfer impact assessment is required, Quantum Neuron has carried out or will carry out such an assessment in accordance with Recommendations 01/2020 of the European Data Protection Board and has implemented appropriate supplementary measures where necessary. A summary of such assessments is available on request.

With respect to Client Personal Data processed by Quantum Neuron as a processor, international transfers are governed by the DPA. With respect to Personal Data processed by Quantum Neuron as a controller under this Privacy Policy, Quantum Neuron relies on the transfer mechanisms described in this Section.

10. Data Retention

We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, including any legal, accounting or reporting requirements. The following retention periods apply:

Where Personal Data is processed by Quantum Neuron as a processor on behalf of a client, retention, return, deletion and anonymization are governed by the DPA and the client's instructions, subject to the provisions of the applicable Master SaaS Agreement and Order Form.

Upon expiry of the applicable retention period, Personal Data is deleted or irreversibly anonymized in accordance with our internal procedures, except where applicable law requires further retention.

11. Security of Processing

Quantum Neuron implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk of the Processing, in accordance with Article 32 EU GDPR. These measures include, without limitation:

• encryption of Personal Data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent);
• storage of credentials exclusively as bcrypt hashes with a unique cryptographic salt per credential;
• multi-factor authentication for administrative accounts;
• role-based access control and the principle of least privilege;
• network segmentation, firewalls, intrusion detection and continuous threat monitoring;
• logging of security-relevant events and centralized monitoring;
• regular vulnerability scanning, dependency management and security patching;
• external penetration testing in accordance with the security schedule and certification roadmap;
• documented incident response procedures and 24/7 on-call coverage;
• regular data backups, encrypted and stored within the European Economic Area;
• personnel confidentiality obligations and recurring security awareness training;
• documented subprocessor due diligence and ongoing monitoring;
• masking or scrubbing of sensitive fields in diagnostic, error monitoring and session replay tools where technically supported; and
• access restrictions and retention controls for voice recordings, transcripts, SMS content, WhatsApp content, email content, call metadata and communication logs, where such data is processed in connection with the Services.

Further details of our technical and organizational measures are set out in the Quantum Neuron Security Annex, made available to clients upon request subject to appropriate confidentiality obligations.

12. Your Rights

Subject to the conditions set out in applicable data protection laws, you have the following rights with respect to your Personal Data:

• Right of access - to obtain confirmation as to whether your Personal Data is being processed and, if so, to obtain access to such data and related information (Article 15 EU GDPR).
• Right to rectification - to obtain the rectification of inaccurate Personal Data and the completion of incomplete Personal Data (Article 16 EU GDPR).
• Right to erasure - to obtain the erasure of your Personal Data where the conditions of Article 17 EU GDPR are met.
• Right to restriction of Processing - to obtain the restriction of Processing where the conditions of Article 18 EU GDPR are met.
• Right to data portability - to receive your Personal Data in a structured, commonly used, machine-readable format and to transmit such data to another controller where the conditions of Article 20 EU GDPR are met.
• Right to object - to object, on grounds relating to your particular situation, to the Processing of your Personal Data based on Article 6(1)(f) EU GDPR (legitimate interests), in accordance with Article 21 EU GDPR.
• Right to withdraw consent - where Processing is based on your consent, you may withdraw such consent at any time, without affecting the lawfulness of Processing carried out before the withdrawal.
• Right not to be subject to automated decision-making - not to be subject to a decision based solely on automated Processing, including profiling, that produces legal effects concerning you or similarly significantly affects you (Article 22 EU GDPR). As stated in Section 6, the Dashboard does not subject users to such decision-making.

Where the data protection laws of your jurisdiction, including, where applicable, the UAE PDPL, the DIFC or ADGM data protection laws or the KSA PDPL, grant you corresponding rights with respect to the processing described in this Policy, you may exercise those rights through the same contact points, and we will handle your request under the machinery described in this Section.

To exercise any of these rights, contact us at privacy@quantumneuron.ai or contact our Data Protection Officer at ido@quantumneuron.ai. We will respond to your request without undue delay and in any event within one month of receiving it, in accordance with Article 12(3) EU GDPR. This period may be extended by a further two months where necessary due to the complexity and number of requests, in which case we will inform you of the extension and its reasons within the first month.

If your Personal Data is processed by Quantum Neuron as a processor on behalf of one of our clients, including conversations with End Users of an AI Persona deployed by that client or recipient data used for Outbound Communication, we may redirect your request to the relevant client, which is the controller responsible for responding to your request.

13. Right to Lodge a Complaint

If you believe that our Processing of your Personal Data violates applicable data protection laws, you have the right to lodge a complaint with the competent supervisory authority, in particular:

• the supervisory authority of the European Economic Area Member State of your habitual residence, place of work or the place of the alleged infringement, in accordance with Article 77 EU GDPR. Contact details of the EEA supervisory authorities are available through the European Data Protection Board (https://edpb.europa.eu).

Quantum Neuron, as a controller with no establishment in the European Union, is subject to the jurisdiction of the supervisory authorities of the Member States where the relevant data subjects are located. With respect to Personal Data subject to the UK GDPR, the competent authority is the UK Information Commissioner's Office (ICO), https://ico.org.uk. Where the data protection laws of your jurisdiction, including a GCC Jurisdiction, provide for a complaint to a local data protection authority, you may also lodge a complaint with that authority in accordance with those laws. A complaint may also be routed through the representative in the European Union or the representative in the United Kingdom identified in Sections 2.3 and 2.4.

Nevertheless, we would appreciate the opportunity to address your concerns directly before you approach a supervisory authority. Please contact us at privacy@quantumneuron.ai.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version is published at https://quantumneuron.ai/legal/m26/privacy and is identified by the version number and effective date indicated at the top of this document. Dashboard users will be informed of material changes by email or by a prominent notice in the Dashboard at least thirty (30) days before such changes take effect. Previous versions are kept in our version control system and are available on request.

15. Contact

If you have any questions or concerns regarding this Privacy Policy, please contact us:

• General contact: contact@quantumneuron.ai
• Legal matters: legal@quantumneuron.ai
• Privacy and data protection matters: privacy@quantumneuron.ai
• Data Protection Officer (appointed and maintained by Quantum Neuron voluntarily): Krzysztof Kochanowski, ido@quantumneuron.ai
• Contracting entity and postal address: Quantum Neuron Inc., 169 Madison Ave STE 15768, New York, NY 10016, United States of America; state of incorporation: Delaware; EIN: 30-1448079
• Representative in the European Union (Article 27 EU GDPR): Quantum Neuron Sp. z o.o., ul. Żurawia 6/12/745, 00-503 Warsaw, Poland, KRS: 0001222865 - contact point for data subjects and supervisory authorities: privacy@quantumneuron.ai
• Representative in the United Kingdom (Article 27 UK GDPR): Kochanowski Consulting Ltd, 151 Picton Road, Liverpool, Merseyside L15 4LG, United Kingdom; contact: ido@quantumneuron.ai