Privacy Policy — QFUtool

Who is responsible

The controller within the meaning of Article 4(7) GDPR is:

Controller: SNS Software Solutions GmbH
Address: Schrötlgasse 8a, 1220 Vienna, Austria
Email: office@sns-austria.com
Phone: +43 670 1922538

We are not required to appoint a data protection officer under Article 37 GDPR. Data protection questions go to the address above and are answered by the managing directors.

The two roles, and why the difference matters

QFUtool is a controller for the data about you and your company: the email address you sign in with, your company settings, your billing details. We decide what that data is for.

QFUtool is a processor for the data in the spreadsheets you upload — your customers, the people you quoted. You are the controller of that data. We only do what your use of the product tells us to do with it: read it, render it into an email, send it, and record what happened. We never use it for our own purposes, never sell it, and never use it to train anything.

The terms of that processing are set out in our Data Processing Agreement, which forms part of the contract with every customer.

Because your customers never sign in, they cannot exercise their rights against us directly. Requests about them are passed to you, and we help you answer them.

What we collect, and on what legal basis

Account: Your email address, your name if you give one, the company you belong to and your role in it. Collected because you cannot use the service without an account — Art. 6(1)(b) GDPR, performance of a contract.
Sign-in: Either a one-time link is emailed to you, or you sign in with your Google or Microsoft account. We store the session token in a cookie. No password is ever stored, because none is ever set. If you use Google or Microsoft, the provider tells us your name, email address and its own account identifier; we request only basic profile and email access for sign-in, never your mailbox, contacts or calendar. (Sending from your own Gmail or Outlook is a separate, optional connection; see below.) Art. 6(1)(b) GDPR.
Company settings: Sending domain, sender name, reply address, send window, daily cap, currency, quote ceiling. Art. 6(1)(b) GDPR.
Uploaded quotes: Whatever your spreadsheet contains — typically customer name, email address, phone, address, the quoted amount, what was quoted, and which of your people quoted it. Processed on your instructions under Art. 28 GDPR; the legal basis for the underlying processing is yours to hold.
Column names of imports: To measure and improve how QFUtool reads spreadsheets, we keep the column names of files you import and which field each column was mapped to. We do not keep cell contents for this purpose. A column name that looks like an email address or a phone number is not kept. Art. 6(1)(f) GDPR, our legitimate interest in reading your files correctly.
Email events: Whether a message was delivered, opened, clicked, bounced, or reported as spam, and whether a reply came back. Used to stop chasing people who have replied and to suppress addresses that bounce. Art. 6(1)(b) and, for deliverability and abuse prevention, Art. 6(1)(f).
Billing: Company name, billing address, VAT identification number, subscription status and invoices. Card numbers are entered on Stripe and never reach our servers. Art. 6(1)(b), and Art. 6(1)(c) for the records tax law requires us to keep.
Server logs: IP address, time, requested URL and user agent, kept briefly by our hosting provider for operation, security and troubleshooting. Art. 6(1)(f) GDPR, our legitimate interest in a service that stays up and is not abused.

There is no analytics on this site. We do not run Google Analytics, advertising pixels, session recording, heat maps or cross-site tracking of any kind, and there is nothing here that profiles you.

Fonts are served from our own servers

The typefaces used here are downloaded when the site is built and delivered from qfutool.com. Your browser never contacts Google Fonts, so your IP address is never disclosed to Google by visiting this site — the practice German courts have held to be an unlawful transfer.

Who else processes the data

We use a small number of providers, each under a data processing agreement, each doing one job. The full list, what each one gets and where it sits, is published at Subprocessors and is part of our contractual commitment to you.

Where a provider is outside the EEA, the transfer is covered by the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. The database holding your uploaded customers is in Ireland and does not leave the EU. Follow-up email is sent and replies are received through Amazon Web Services EMEA SARL in Frankfurt, where the data stays in the EU.

If you choose to sign in with Google (Google Ireland Limited, with Google LLC) or Microsoft (Microsoft Ireland Operations Limited), that provider acts as an independent controller for the sign-in under its own privacy terms; we list it in our subprocessor list nonetheless, so that you can see every party that receives data about you. Transfers to these providers outside the EEA rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.

If an account owner connects Gmail to send follow-ups from their own mailbox, Google also delivers those emails through the Gmail API; see “Sending from your own Gmail” below. In the same way, if an account owner connects Outlook, Microsoft delivers them through Microsoft Graph; see “Sending from your own Outlook or Microsoft 365” below.

Sending from your own Gmail (Google user data)

This is optional and off until an account owner chooses Connect Gmail in Settings. Then QFUtool sends the follow-up emails you scheduled from your own Gmail or Google Workspace mailbox instead of from our sending domain. It is a separate step from signing in with Google; signing in never asks for it.

What we access: Only the permission to send email as your mailbox (the Gmail API scope gmail.send) and the address of that mailbox (the openid and email scopes). QFUtool cannot read, search, list, change or delete anything in your mailbox, including your inbox and your sent folder, and we never ask for any permission that could.
Why: To send, from your own address, only the follow-up emails you asked QFUtool to send, and nothing else. Art. 6(1)(b) GDPR.
What we keep: The mailbox address and a refresh token, and, for each follow-up sent, the message and thread identifiers Gmail returns, kept with that follow-up record. The token is stored encrypted at rest, with a key that is not kept in the database, and is used only to obtain short-lived access tokens when a follow-up goes out. Access tokens exist in memory only and are never stored or logged.
How long, and deletion: Until you disconnect. When you disconnect, when the person who connected the mailbox is removed from the team, or when the account is deleted, QFUtool revokes the token at Google and deletes it immediately. You can also remove QFUtool’s access at any time at myaccount.google.com/permissions.
Bounce notices: If you set up bounce tracking, you choose to forward Gmail’s bounce notices to a QFUtool address. We read only those forwarded notices, to find which follow-up could not be delivered. This is mail you send to us, not access to your mailbox.

We use this data only to send the email you asked QFUtool to send. We do not use it for advertising, we do not sell it or transfer it to anyone, except to Google to send the email and to our hosting and database providers listed under Subprocessors, solely to run this feature; no person at QFUtool reads it except where you ask for support or the law requires it, and it is never used to develop, improve or train any machine learning or AI model.

The use of information received from Google Workspace scopes will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

QFUtool's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sending from your own Outlook or Microsoft 365 (Microsoft user data)

This is optional and off until an account owner chooses Connect Outlook in Settings. Then QFUtool sends the follow-up emails you scheduled from your own Outlook.com or Microsoft 365 mailbox instead of from our sending domain. It is a separate step from signing in with Microsoft; signing in never asks for it. Connecting Outlook also lets QFUtool read limited message details in your mailbox, solely to detect bounces and replies to its own follow-ups, as set out below.

What we access: The permission to send email as your mailbox (the Microsoft Graph permission Mail.Send), the address of that mailbox (the openid and email scopes), offline_access so QFUtool can keep working without asking you each time, and Mail.ReadBasic. Mail.ReadBasic lets QFUtool read message metadata and headers (sender, recipients, subject, dates and the technical message headers) of the mail in your Inbox, Junk Email and Sent Items. It never lets QFUtool read the text of a message or open an attachment, and QFUtool cannot change or delete anything in your mailbox. If you connected Outlook before Mail.ReadBasic was requested, or you did not grant it, your connection is send-only: QFUtool reads nothing in your mailbox until you reconnect and accept it.
Why: To send, from your own address, the follow-up emails you asked QFUtool to send. With Mail.ReadBasic, and solely for that purpose, to detect that one of those follow-ups bounced or was answered, so that QFUtool stops following up with a customer who has replied or whose address does not exist. Art. 6(1)(b) GDPR.
What we keep: The mailbox address, the type of account (work or personal) and a refresh token. The token is stored encrypted at rest, with a key that is not kept in the database, and is used only to obtain short-lived access tokens. Microsoft issues a new refresh token each time, and we store the newest one. Access tokens exist in memory only and are never stored or logged. From the mail we read we keep only data about matches: for each follow-up found in your Sent Items, the message and conversation identifiers Microsoft gave it; for each bounce notice or reply to one of our follow-ups, that it happened, when, the subject line and, for a reply, the sender address. Everything else in your Inbox, Junk Email and Sent Items is looked at in memory only to check whether it matches one of our follow-ups, and is then discarded: its sender, recipients and subject are not stored or logged. We also store opaque position markers that Microsoft gives us so that the next check starts where the last one ended, and the time of the last check.
How long, and deletion: Until you disconnect. When you disconnect, when the person who connected the mailbox is removed from the team, or when the account is deleted, QFUtool deletes the token and the position markers immediately. The identifiers and the records of matches belong to your follow-up records and are deleted with your account. Microsoft offers no way for us to revoke the token from our side, so you can also remove QFUtool’s access at any time at myaccount.microsoft.com (work or school account) or account.live.com/consent/Manage (personal account).

We use this data only to send the email you asked QFUtool to send and to detect bounces and replies to those emails. We do not use it for advertising, we do not transfer or sell it to anyone, no person at QFUtool reads it except where you ask for support or the law requires it, and it is never used to develop, improve or train any machine learning or AI model.

Feedback and ideas

The Feedback button, the short questions we sometimes ask in the app and the ideas board are optional. Nothing in QFUtool requires you to use them.

What we keep: The message you write, the mood word or 0–10 score if you give one, the page you sent it from, and who sent it (your name, email address and company), so that we can answer you and see how the product is doing. Art. 6(1)(f) GDPR, our legitimate interest in hearing from the people who use QFUtool and in replying to them. Messages are kept for as long as the account exists and are deleted with it.
Screenshots: If you add a screenshot or attach the page you are looking at, it may show customer details from your account. It is stored privately with our database provider (see Subprocessors), can be opened only by the QFUtool team and is shown to no one else. It is deleted automatically 90 days after you send it, or sooner when the account is deleted. Please do not attach anything you would not want the team to see.
Ideas: An idea you suggest is read by us before it is published. A published idea appears on the board for other users without your name, your company or anything else about you, and votes are counted without showing who cast them. If the account is deleted, ideas that were never published are deleted; an idea already on the board stays there, with nothing linking it to you.
Emails about your feedback: When an idea you suggested or voted for is finished, we send you one email to say so. If we reply to a message of yours, or thank you with extra follow-ups for a trial, that email goes to the address you sign in with. Every email about ideas carries a “Stop these emails” link that switches them off for you; it does not affect the other emails you get from QFUtool about your account. Art. 6(1)(f) GDPR.

How long we keep it

Account and company data: For as long as the account exists. When the account is deleted, the company data and every member’s login are deleted immediately in the product; backups and provider logs then roll off within the provider’s own retention period.
Uploaded quotes and messages: Until you delete them, or until the account is deleted, when they are deleted immediately in the product. Backups and provider logs roll off within the provider’s own retention period.
Column names of imports: These records are deleted with your account.
Suppression list: Kept indefinitely for as long as the account exists, on purpose. It is the record of every address that unsubscribed, bounced or complained. Deleting it while the account is in use would let a future import email those people again, which is exactly what it exists to prevent. It holds nothing but the address and the reason. It is deleted together with the account when the account is deleted.
Invoices and accounting records: Seven years, as §132 of the Federal Fiscal Code (BAO) requires. Our accounting keeps the invoices for that period even after the account is deleted; Stripe also retains invoices and payment records as its own records under tax-retention law.
Server logs: Days, not months. Retained by our hosting provider under their own schedule.

Your rights

Under the GDPR you may ask us for a copy of your data (Art. 15), to correct it (Art. 16), to delete it (Art. 17), to restrict what we do with it (Art. 18), to receive it in a portable format (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing rests on consent, you may withdraw it at any time without affecting what was lawful before.

Write to office@sns-austria.com. We answer within one month.

If you think we have handled your data unlawfully you may complain to the supervisory authority. In Austria that is the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria — dsb@dsb.gv.at.

If you were emailed by someone using QFUtool

You received that email because a business you asked for a quote from uses QFUtool to follow up. That business decides who is emailed and what is said; we only deliver it. Every message carries a one-click unsubscribe link that works without an account and takes effect immediately — it cancels every message still queued for you, not just the next one. Every message also shows the name and postal address of the company that is sending it.

For access to or deletion of your data, contact the business that emailed you: they hold it and they decide. If you cannot reach them, write to us and we will pass it on and help them act.

Security

Traffic is encrypted with TLS and data is encrypted at rest. Access between customers is separated in the database itself by row-level security, so a request can only ever return rows belonging to the requester’s own company — the boundary does not depend on application code remembering to check. The elevated database key is used only by the background sender and the inbound webhooks, never by anything a browser can reach. Sign-in is by one-time link, so there is no password to leak.

Changes

When this policy changes materially, we tell account holders by email before the change takes effect. The date at the top of this page is always the date of the current version.