Privacy Policy

1. Introduction#

Quill Technologies, Inc. (“Quill,” “Company,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy describes the types of personal information we collect and how we use, disclose, retain, and protect it in connection with our website at https://www.tryquill.com (the “Website”), our products and services (the “Services”), and our other interactions with you.

This Privacy Policy applies to information we collect: (a) on the Website; (b) in email, chat, telephone, or other electronic or written communications between you and Quill; (c) through marketing, sales, support, recruiting, and other business interactions; and (d) when you interact with our advertising on third-party websites or services that include a link to this Privacy Policy. It does not apply to information collected by any third party (including any third-party application or content that may link to or be accessible from the Website) or by us outside the scope described above.

Customer Content vs. Website Personal Information. Many of our customers are organizations that subscribe to our Services and submit data on behalf of their personnel and end users (“Customer Content”). When we process Customer Content on behalf of a customer organization, we act as a service provider, processor, or sub-processor (as applicable) under that organization’s instructions, and our handling of Customer Content is governed by the agreement between Quill and that customer, including any Data Processing Addendum (“DPA”). If you have questions about Customer Content that has been submitted to the Services by an organization on whose behalf you act, please direct those questions to that organization in the first instance.

Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use the Website or the Services. By accessing or using the Website or the Services, you agree to this Privacy Policy. We may update this Privacy Policy from time to time; the date of the most recent revision is set forth above. Your continued use following any update constitutes acceptance of the changes.

2. Children’s Privacy#

The Website and Services are intended for business users and are not directed to children. We do not knowingly collect personal information from any individual under the age of sixteen (16). If you believe a child under the age of sixteen (16) has provided personal information to us, please contact us at privacy@tryquill.com and we will promptly delete that information. This threshold is consistent with our Terms of Service and reflects the requirements of the GDPR, CCPA/CPRA, and other applicable privacy laws governing the collection of children’s personal data.

3. Definitions#

The following terms have the meanings set out below.

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. Personal Information includes information such as your name, postal address, email address, telephone number, employer, job title, account credentials, IP address, and other identifiers by which you may be contacted online or offline.

“Sensitive Personal Information” has the meaning given to it under applicable privacy law, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”) and, where applicable, the EU General Data Protection Regulation (“GDPR”) and equivalent regimes. Sensitive Personal Information includes government-issued identifiers, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, the contents of certain communications, genetic and biometric data, health information, and information concerning sex life or sexual orientation.

“Customer Content” means data, documents, prompts, ticket content, system telemetry, configurations, and other materials submitted to the Services by or on behalf of a Quill customer, including data we process as a service provider or processor.

As described in Section 6 (Information We Do Not Collect), Quill does not collect or store Sensitive Personal Information in the ordinary course of providing the Website and Services. Customers are contractually required not to submit Sensitive Personal Information to the Services without our prior written consent.

4. Information We Collect#

4.1 Information You Provide Directly

We collect information you submit to us, including when you:

• register for an account or subscribe to the Services (e.g., name, business email, employer, job title, password);
• place an order, complete a billing transaction, or set up payment terms (billing contact, payment instrument metadata; full payment-card data is collected by our PCI-compliant payment processors and is not stored by Quill);
• configure the Services, including provisioning integrations, designating which Customer Systems the Services may access, and setting up users;
• contact us by email, chat, ticket, telephone, or web form (including any information you choose to share with us, and any attachments);
• register for, attend, or interact with our events, webinars, or marketing campaigns;
• respond to surveys, requests for feedback, or product research; or
• apply for a job with Quill (where information is governed by our recruiting and applicant privacy notice).

4.2 Information We Collect Automatically

When you visit the Website or use the Services, we automatically collect:

• device and connection information (IP address, browser type and version, operating system, device identifiers, time zone, language);
• usage information (pages visited, features used, time stamps, click-stream data, referring URLs);
• cookie, web beacon, and similar tracking-technology data as described in Section 5; and
• Service telemetry and security logs (e.g., authentication events, error logs, configuration changes, audit-trail events) used to operate, secure, and improve the Services.

4.3 Information From Third-Party Sources

We may receive Personal Information about you from third parties, including: enrichment, analytics, and lead-generation providers; marketing or business partners; identity, single sign-on, and authentication providers you use to access the Services; social networks; publicly available sources (such as public registries and news articles); and customers that authorize us to associate your information with their account (for example, when an administrator invites you to their workspace).

4.4 Information We Collect Through the Services (Customer Content)

When you use the Services as an end user on behalf of a Quill customer, the Services may process Customer Content that includes Personal Information about you (e.g., the body of a ticket, a conversation with an Agent, an action log). That processing is performed on behalf of, and under the instructions of, the customer organization that subscribed to the Services. Quill processes such Personal Information only as necessary to provide the Services, in accordance with the agreement with that customer organization and applicable law.

5. Cookies and Tracking Technologies#

We and our service providers use cookies and similar technologies (such as pixels, tags, SDKs, and local storage) to operate the Website and Services, remember your preferences, secure your sessions, measure usage, and (where you have consented or as otherwise permitted by law) deliver and measure marketing communications.

The categories of cookies we use are:

Strictly necessary. Required to provide core functionality such as authentication, load balancing, and security. These cannot be disabled.

Functional. Remember your preferences and settings (for example, your language, region, or interface choices).

Analytics. Help us understand how visitors interact with the Website so we can improve it. We use providers such as those listed in our subprocessor list.

Marketing. Used (where you have consented or as otherwise permitted by law) to deliver and measure marketing and advertising about our products and services.

You can manage cookies through your browser settings. If you disable strictly necessary cookies, parts of the Website or Services may not function correctly. We honor the Global Privacy Control (“GPC”) signal where required by applicable law and will treat a GPC signal received from your browser as a request to opt out of the “sale” or “sharing” of Personal Information for cross-context behavioral advertising. We do not currently respond to other browser-based “Do Not Track” signals.

6. Information We Do Not Collect#

Quill does not knowingly collect or store Sensitive Personal Information in the ordinary course of providing the Website and Services, including information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for uniquely identifying an individual, data concerning health, or data concerning an individual’s sex life or sexual orientation. Customers are contractually required not to submit Sensitive Personal Information to the Services without our prior written consent. If you believe Sensitive Personal Information has been submitted to the Services in error, please contact privacy@tryquill.com and we will work with you to address the situation.

7. How We Use Personal Information#

We use Personal Information for the purposes set out below, subject to applicable law and to the legal bases described in Section 13 (Information for Individuals in the European Economic Area, United Kingdom, and Switzerland):

• to operate, provide, support, and improve the Website and Services, including authenticating users, provisioning subscriptions, configuring integrations, processing transactions, and providing customer support;
• to communicate with you about your account, the Services, security and privacy matters, billing, and changes to our terms or policies;
• to send you marketing communications about Quill’s products and services where you have consented or where we are otherwise permitted by law (you can opt out at any time);
• to personalize, develop, and analyze the Website and Services, including by computing aggregated, statistical, and de-identified data;
• to detect, prevent, investigate, and respond to fraud, abuse, security incidents, technical issues, and violations of our terms or applicable law;
• to comply with legal obligations, respond to lawful requests from public authorities, and establish, exercise, or defend legal claims; and
• for any other purpose disclosed to you at the time we collect the information or with your consent.

8. AI Processing#

The Services include AI-enabled features, automated workflows, and agents. Quill will not use Customer Content (including Inputs, Outputs, or other customer-identifiable data) to train foundation models or other general-purpose machine learning models without the relevant customer’s prior consent. This restriction applies regardless of whether such Customer Content constitutes Personal Information, and is consistent with Quill’s Terms of Service. Quill may, however, compute aggregated, statistical, or de-identified data derived from usage of the Services (“Usage Data”) to operate, improve, develop, secure, and analyze the Services, provided that such Usage Data cannot reasonably be used to identify you, your organization, your users, or your end customers. The Services may use third-party AI model providers as subprocessors to process Customer Content and to generate Output. A current list of these and other subprocessors is available at https://trust.tryquill.com. Output generated by the Services may be inaccurate, incomplete, or biased; customers are solely responsible for reviewing and validating Output, including any recommended or automated actions, before relying on it in production or other material contexts. Any action taken by an AI agent within a customer’s environment is taken at the customer’s direction and on the customer’s behalf.

9. How We Disclose Personal Information#

We may disclose Personal Information in the following circumstances:

Affiliates. With our subsidiaries and affiliates for the purposes described in this Privacy Policy.

Service providers and subprocessors. With contractors, service providers, and other third parties that perform services on our behalf (such as hosting, infrastructure, payment processing, analytics, identity, customer support, security, and AI model providers). We require these recipients to keep Personal Information confidential and to use it only to provide services to us and consistent with our instructions.

Customers. For Personal Information that constitutes Customer Content, with the customer organization on whose behalf the data is processed.

Corporate transactions. With a buyer or other successor in connection with a merger, acquisition, divestiture, restructuring, reorganization, financing, dissolution, or other sale or transfer of some or all of Quill’s assets (including in connection with bankruptcy or similar proceedings).

Legal and safety. To comply with applicable law, regulation, court order, subpoena, or other legal process; to respond to lawful requests from public or governmental authorities (including for national security or law enforcement); to enforce our terms or other agreements; to protect our rights, property, or safety, or the rights, property, or safety of our customers, users, or others; and for fraud prevention and credit-risk reduction. Where legally permitted, we will provide affected customers with notice of legally compelled disclosures of Customer Content so the customer can seek protective measures.

With your consent or at your direction. When you direct us to share information, or with your consent for any other purpose.

Aggregated or de-identified information. We may share aggregated or de-identified information that cannot reasonably be used to identify you for any lawful business purpose.

We do not “sell” Personal Information for money, and we do not “share” Personal Information for cross-context behavioral advertising, in each case as those terms are defined under applicable U.S. state privacy laws, including the CCPA/CPRA. See Section 12 (U.S. State Privacy Rights) and our Privacy Notice for California Residents at https://www.tryquill.com/legal/Quill_Privacy_Policy_for_California_Residents.pdf for more detail.

10. International Data Transfers#

Quill is headquartered in the United States and may use service providers and subprocessors located in countries other than your country of residence, including the United States. When Personal Information is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country that has not been deemed to provide an adequate level of data protection, we rely on appropriate safeguards permitted under applicable law, including the European Commission’s Standard Contractual Clauses (with the UK Addendum or the Swiss equivalent, as applicable), or another approved transfer mechanism. A copy of the relevant safeguards is available on request to privacy@tryquill.com.

11. Data Retention#

We retain Personal Information for as long as necessary to provide the Website and Services, fulfill the purposes outlined in this Privacy Policy, comply with our legal and contractual obligations, resolve disputes, and enforce our agreements. The table below describes our standard retention periods. Actual retention may vary based on customer-specific configurations, contractual commitments (including any Data Processing Addendum), or legal holds.

We delete or de-identify Personal Information when retention is no longer necessary for the purposes for which it was collected or as required by applicable law. Where Personal Information is processed as part of Customer Content, retention is governed by the agreement with the relevant customer (including any DPA) and customer instructions, subject to our legal obligations. Aggregated, statistical, or de-identified Usage Data derived from the Services that cannot reasonably be used to identify you, your organization, your users, or your end customers is not subject to the retention periods in the table above and may be retained by Quill for as long as necessary to operate, improve, and analyze the Services.

12. U.S. State Privacy Rights#

Depending on your state of residence, U.S. state consumer privacy laws (including the CCPA/CPRA, Virginia CDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, and other state laws as enacted) may provide you with one or more of the following rights, subject to certain exceptions:

• the right to confirm whether we process your Personal Information and to access that Personal Information;
• the right to delete certain Personal Information we have collected from you;
• the right to correct inaccurate Personal Information;
• the right to data portability (i.e., to receive a copy of your Personal Information in a usable format);
• the right to opt out of the “sale” or “sharing” of Personal Information for cross-context behavioral advertising or targeted advertising;
• the right to limit the use or disclosure of Sensitive Personal Information;
• the right to opt out of profiling that produces legal or similarly significant effects; and
• the right not to be discriminated against for exercising these rights.

You can exercise these rights by contacting us at privacy@tryquill.com or by using the request mechanisms on the Website. We will verify your identity (and, if applicable, the authority of any agent acting on your behalf) before responding. We will respond within the timeframes required by applicable law (generally 45 days, with one permitted extension where reasonably necessary). To appeal a decision regarding your request, please email privacy@tryquill.com and include your original request reference. California residents should also refer to our Privacy Notice for California Residents at https://www.tryquill.com/legal/Quill_Privacy_Policy_for_California_Residents.pdf for additional disclosures required by the CCPA/CPRA.

Personal Information that we process as a service provider or processor on behalf of a Quill customer is subject to that customer’s privacy notice and policies. If you wish to exercise privacy rights with respect to Customer Content, please contact the relevant customer organization in the first instance; we will support that organization in responding to your request as required by our agreement and applicable law.

13. Information for Individuals in the European Economic Area, United Kingdom, and Switzerland#

If you are located in the European Economic Area, the United Kingdom, or Switzerland (“Europe”), this Section provides additional information about how we process your Personal Information.

Roles. For most processing of Customer Content, Quill acts as a processor on behalf of the customer organization that subscribed to the Services. For Website operations, marketing, sales, recruiting, and similar activities, Quill acts as a controller of the Personal Information described in this Privacy Policy.

Legal bases. When acting as a controller, we rely on one or more of the following legal bases to process Personal Information: (a) performance of a contract with you (e.g., to provide the Website and Services you request); (b) compliance with a legal obligation; (c) our legitimate interests (e.g., to secure our systems, prevent fraud, develop and improve our products, and conduct B2B marketing), provided that these are not overridden by your interests, rights, and freedoms; and (d) your consent, where required (e.g., for certain marketing communications).

Your rights. Subject to applicable law, you have the right to access, correct, delete, restrict, or object to our processing of your Personal Information; the right to data portability; the right to withdraw any consent you have provided (without affecting the lawfulness of prior processing); and the right to lodge a complaint with your local data protection authority. To exercise these rights, please contact us at privacy@tryquill.com.

Automated decision-making. In accordance with Article 22 of the GDPR, Quill does not subject individuals to decisions based solely on automated processing—including profiling—that produce legal or similarly significant effects, without human review. Where the Services use AI-enabled features to generate recommendations, summaries, or workflow actions, those outputs are provided as tools to assist human decision-makers and are not intended to constitute automated decisions within the meaning of Article 22. The safeguards Quill makes available, or requires customers to implement, include: (a) human-in-the-loop review and approval workflows before acting on AI-generated outputs; (b) configuration controls that customers may use to limit or disable automated actions; and (c) audit logs that enable customers to review and, where necessary, override AI-generated actions. Customers are responsible for ensuring that their configuration and use of AI-enabled features complies with applicable law, including any requirements to inform individuals about automated processing and to provide mechanisms for human review.

14. Confidentiality and Personnel#

Access to Personal Information is restricted to authorized employees, contractors, and agents who require such access for the purposes outlined in this Privacy Policy. All personnel with access to Personal Information are bound by written confidentiality obligations or are otherwise subject to equivalent obligations of confidentiality under their employment, contractor, or professional agreements. Such personnel are expected to complete privacy and security training appropriate to their role and are required to comply with our data protection policies and procedures. Unauthorized access, use, or disclosure of Personal Information is prohibited and subject to disciplinary, contractual, and legal consequences.

15. Data Security#

We maintain administrative, physical, and technical safeguards designed to protect Personal Information against unauthorized or unlawful access, use, alteration, disclosure, loss, or destruction. These safeguards include, where appropriate, encryption of data in transit and at rest, identity and access management with least-privilege controls, role-based access, multi-factor authentication for administrative access, network segmentation, vulnerability management, secure software development practices, logging and monitoring, regular security testing, vendor security review, and an incident response program. Information about our security program, including any third-party attestations or reports (such as SOC 2 or ISO 27001) as they become available, can be found at https://trust.tryquill.com or requested via privacy@tryquill.com.

No security measure is perfect. The transmission of information via the Internet is not completely secure, and we cannot guarantee the absolute security of Personal Information. In the event of a confirmed personal data breach affecting Customer Content, we will notify affected customers without undue delay and, where practicable, within seventy-two (72) hours of becoming aware of the breach. Where a specific notification timeline is set out in an agreed Data Processing Addendum, that timeline will apply. Notifications will include, to the extent known at the time: a description of the nature of the breach, the categories and approximate number of individuals and records affected, the likely consequences, and the measures taken or proposed to address the breach, with further updates provided as additional information becomes available.

16. Your Choices#

You have choices regarding the Personal Information you provide to us:

Marketing communications. You may opt out of receiving marketing emails from us by following the unsubscribe instructions in the email or by emailing privacy@tryquill.com. We may still send you transactional or service-related communications (e.g., about your account, security, billing, or important policy changes).

Cookies. You can manage cookies through your browser or device settings as described in Section 5. We honor the Global Privacy Control signal where required by applicable law.

Access, correction, and deletion. You may submit a request to access, correct, or delete Personal Information by emailing privacy@tryquill.com. We may not be able to delete Personal Information that we are required to retain for legal, regulatory, security, or contractual reasons.

17. Data Subject Requests#

To submit a request to exercise rights described in this Privacy Policy, email privacy@tryquill.com or use the request form on the Website. Please provide enough detail to allow us to verify your identity and locate the relevant Personal Information. Only you, or someone legally authorized to act on your behalf, may make a request. We will not discriminate against you for exercising any of your rights under applicable law.

18. Service Providers and Subprocessors#

We use service providers and subprocessors to help us operate the Website and Services, including hosting and infrastructure providers, identity providers, analytics providers, customer support tools, email and marketing platforms, payment processors, and AI model providers. A current list of subprocessors used in connection with the Services is maintained at https://trust.tryquill.com. We will provide customers with at least ten (10) days’ advance notice of the addition of any new subprocessor or any material change to an existing subprocessor by updating the subprocessor list and notifying the relevant account contact by email (or, where a Customer Agreement provides for a different notification mechanism, via that mechanism). Notwithstanding the foregoing, Quill may add or replace a subprocessor with less than ten (10) days’ notice where required to address an emergency security, availability, or legal compliance issue, in which case Quill will provide notice as promptly as practicable and in any event within five (5) business days after the change takes effect. Customers who have entered into a Data Processing Addendum may object to a new subprocessor in accordance with the procedure set out in that DPA. We require each service provider and subprocessor to commit, in writing, to data protection obligations that are at least as protective as those in this Privacy Policy and any applicable DPA, and we remain responsible for their performance.

19. Third-Party Links and Integrations#

The Website and the Services may contain links to, or integrations with, third-party websites, applications, or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy notices of any third party before providing it with Personal Information.

20. Changes to This Privacy Policy#

We may update this Privacy Policy from time to time. The date of the most recent revision is set out above. We will notify you of material changes by posting a notice on the Website, by emailing the address associated with your account, or by other reasonable means. Your continued use of the Website or Services following the effective date of any update constitutes your acceptance of the revised Privacy Policy. You are responsible for keeping your contact information current and for periodically reviewing this Privacy Policy.

21. Contact#

If you have questions about this Privacy Policy or our privacy practices, or to exercise your privacy rights, please contact us at privacy@tryquill.com, or by mail at: Quill Technologies, Inc., 244 Fifth Avenue, Suite #1861, New York, NY 10001, Attn: Privacy. Quill has assessed its obligations under applicable data protection law regarding the appointment of a Data Protection Officer (“DPO”). If Quill is required to appoint a DPO under applicable law, or if Quill elects to appoint one voluntarily, the contact details of such DPO will be published at https://trust.tryquill.com and made available upon request to privacy@tryquill.com. If you are located in Europe and would like to contact our designated representative under Article 27 of the GDPR (where applicable), please contact privacy@tryquill.com and we will provide the relevant representative’s contact details.