Privacy Notice
Operator and controller: IQaaS is a trading name; a registered legal entity, its address and any ICO registration number will be named here. Contact for privacy requests: [email protected]. Security reports (security issues only): [email protected]. Governing law is England and Wales, so UK GDPR and the Data Protection Act 2018 apply. This text is not legal advice, and we claim no compliance or certification.
What DQaaS is, in privacy terms
DQaaS profiles datasets and checks them against rules. A job loads your data into a private, locked-down working file, computes a profile and rule results, stores those results, and deletes the working file. Rows are never persisted. What is stored is metadata, and some of that metadata can contain values from your data (see below).
What we collect
| Data | Why | Source |
|---|---|---|
| GitHub numeric id, login, name, email, avatar URL | Check your invite, sign you in, show who you are, contact you about the beta | GitHub sign-in (scopes read:user user:email) |
| Display name and notification email (optional) | Show a name; send notices | You |
| Organisation, membership and role records | Keep each organisation separate | You, and us |
Sessions (cookie dqaas_session, only a SHA-256 of it is stored) and access tokens (dqat_..., only a SHA-256 stored, last-used time) |
Keep you signed in; API, CLI and MCP access | Generated |
| MCP OAuth records: registered client name and redirect URIs, grants, hashed codes and tokens | Let an MCP client connect without a pasted token | Generated |
| Terms acceptance: user, document version, time (no IP address) | Show which version you accepted | You |
| Dataset metadata: names, descriptions, owners, tags, classifications, source settings (connection details stored encrypted) | Run the catalogue | You |
| Profiles and rule results: types, counts, statistics, histograms, and, by default, top values, min/max and up to five failing example values per rule | The product itself | Generated from your data |
| Reports, assessments, lineage, glossary, stewardship tasks, schedules, job records | The product itself | You, and generated |
| Audit log: who did what and when | Security, abuse investigation, disputes | Generated |
| Usage events | Show usage; enforce limits | Generated |
| Request log: method, path, status, milliseconds. No query string, no headers, no bodies, no user or organisation ids | Operate and debug the service | Generated |
Values from your data
Rows are not stored, but profile metadata can include real values: top values, minimum and maximum, and failing examples. Storing these value samples is switched on for the beta. For columns the service detects as sensitive, sample values are not stored or are redacted. That detection is a heuristic, is labelled inferred, and can miss a column; a missed column can have real values stored. Do not upload data you would not want summarised this way. An operator setting can switch value samples off for the whole service; it is not off today.
Files you keep
If you ask for an uploaded file to be retained for re-analysis, the file is stored on the server until you delete it or its organisation is deleted. Otherwise it is removed after the job (stale temporary files are swept by the maintenance job).
On-device mode
The console can profile a file in your browser. In that mode the file does not leave your device. Only if you choose to publish the profile and rule results are they sent to us.
Cookies and trackers
One session cookie (dqaas_session, HttpOnly, 30 days maximum, 12 hours sliding) and short-lived sign-in cookies. The OAuth endpoints use no cookies. The website and console load no analytics or third-party trackers.
Payments
There are no payments and no paid plans in the beta. We hold no card or billing data.
Why we may use it (lawful basis)
To provide the service you asked for and sign you in (contract); to keep it secure, investigate abuse, keep the audit and request logs and enforce limits (legitimate interests); and to meet legal obligations. We do not use your data for advertising and do not sell it.
Data we do not want
No health data, special category data, or children’s data without a written agreement with us first. Do not upload data you have no right to use.
How long we keep it
| Record | Kept for |
|---|---|
| Profiles and assessments (the latest per dataset is always kept) | 365 days |
| Reports | 90 days |
| Audit log | 12 months |
| Usage events | 13 months |
| Run logs (the request log) | 30 days |
| Account data after closure | 30 days |
| Encrypted database backups | 14 days |
| Retained uploaded files | Until you delete them or delete the organisation |
| Invite records | Until the beta ends |
Where the software does not yet enforce a period by itself, we state it honestly. Profiles are pruned by the maintenance job against a per-organisation setting that defaults to 365 days. Reports, audit and usage are also pruned against per-organisation settings, but the built-in defaults are currently longer than the periods above (reports 365 days, audit 730 days, usage events 400 days); we are bringing them into line, and until then an organisation may hold them longer than the table says. Run logs are not rotated by the application; the operator deletes them after 30 days. A dataset can also carry its own retention in days, which expires its older profiles.
How it is protected (no guarantees)
- Every query is filtered by organisation id, so organisations are separated in the application. This is tested; it is not a guarantee.
- The database is stored on an encrypted volume, and database backups are encrypted. This is a safeguard, not a guarantee against every kind of compromise.
- Sign-in state, session and token values are stored hashed.
- We claim no certification and make no security guarantee.
Where it runs and who processes it
The API runs on a shared virtual server at a commercial hosting provider, behind a Cloudflare Tunnel. Other services run on the same server; they have no access arrangement with DQaaS data by design, but the host is shared. The website and console are static pages on Cloudflare Pages.
| Processor | Role |
|---|---|
| Cloudflare | Tunnel, traffic to the API, static site and console |
| GitHub | Sign-in; receives the sign-in request |
| Contabo (VPS host) | Servers that run the API and hold the encrypted data and backups |
Some of these providers operate outside the UK. Where personal data is sent outside the UK, we rely on the providers’ own transfer safeguards and have not made separate arrangements. We do not sell your data.
Your rights
You can ask to see, correct, export or delete your data, or object to processing, by writing to [email protected]. Target reply: 30 days. You may also complain to the Information Commissioner’s Office (ICO).
Deleting and exporting your data
DELETE /v1/me(signed-in session, typed login). It blocks sign-in, clears your name, display name, email, notification email and avatar URL, ends your sessions, revokes your tokens and removes your memberships. If you are the only owner of an organisation, you must either hand it over or choose to delete it.- The maintenance task (hourly) removes the remaining account record (your numeric GitHub id and login) 30 days after closure, together with its sessions, tokens, OAuth grants and terms records. The removal is recorded in a system audit entry that holds only an opaque user id.
DELETE /v1/orgorDELETE /v1/orgs/{id}(organisation owner) deletes the organisation and all its data, including retained files. The operator can also delete an organisation. There is a test that every table holding an organisation id is covered.GET /v1/orgs/{id}/export(admin or owner) returns your organisation’s configuration and metadata as JSON. It leaves out credentials, session data, profile bodies and value samples, and other people’s email addresses; audit and usage are summaries; each list is capped at 10,000 rows. For anything else, write to [email protected].
Limits, stated plainly:
- Deleted data stays in encrypted backups for up to 14 days.
- Audit entries about you may remain for their retention period.
- These controls are built and tested against simulated accounts, and have not yet been used by outside users.
Changes
We may change this notice and will tell invited users. No uptime promise; data may be reset with 30 days notice (see the Terms of Use).