Privacy Policy

1. Who this policy is about

This Privacy Policy explains how QubitPilot ("QubitPilot", "we", "us", "our") collects, uses, stores and shares information when a law firm, chartered-accountancy practice or other professional services firm ("you", "your firm", "the workspace") and its team members use the QubitPilot application, website and related services (together, the "Service"). It applies to every workspace on QubitPilot, regardless of subscription plan.

You can contact QubitPilot at 5th Floor, Gordhan Sky Mall, Office 507, Khatipura Road, Jhotwara, Jaipur, Rajasthan 302012, India. If any term in this policy conflicts with the Terms & Conditions, the Terms & Conditions govern the relationship and this policy governs how data is handled.

Two roles are worth separating. For the account and usage information in Section 2, QubitPilot decides why and how it is processed. For the client and matter records your firm puts into its workspace, your firm decides what is collected and why, and QubitPilot processes those records on your firm's behalf to provide the Service — in the terms of the Digital Personal Data Protection Act, 2023, your firm is the Data Fiduciary for that data and QubitPilot its Data Processor. That is why requests about a firm's client data go to the firm first (Section 11).

2. Information we collect

We collect information in three broad categories:

• Account information — the name, email address, phone number and profession (advocate or chartered accountant) of each person who signs up, and the firm/workspace details provided at onboarding (firm name, address, GSTIN, PAN and similar identifiers).
• Practice data you put into the Service — client records, matters/cases, hearing and compliance dates, tasks, notes, documents you upload, WhatsApp conversations you route through the Service, time entries, invoices and payment records, and any other record your firm creates while using QubitPilot.
• Usage and device information — log data, IP address, browser/device type, pages and features used, and diagnostic information generated automatically as you use the Service, together with the small number of cookies described in Section 13.
• Client portal sign-in information — when your firm invites one of its clients to the client portal, the email address and name your firm enters for them, the times they sign in, and the IP address and browser of each sign-in. See "The client portal" in Section 4.

3. How we use your information

We use the information above to: provide and operate the Service, including the features your plan includes; authenticate you and secure your account; send hearing, task, compliance and billing reminders you have not turned off; process payments and manage your subscription; respond to support requests; detect and prevent abuse, fraud and security incidents; and improve the reliability and usability of the Service. We do not sell your information, and your firm's data is not used to train AI models.

4. Storage of your documents

Documents you upload are stored in one of two places, depending on how your workspace is configured:

• QubitPilot's own file storage — the default. Files are stored on infrastructure we operate or contract with, encrypted at rest, and accessible only to your workspace.
• Your own cloud storage bucket — on plans that offer it, a workspace owner or admin may connect their own Amazon S3, Cloudflare R2 or S3-compatible bucket from Settings. When this is configured, newly uploaded documents are written directly to that bucket instead of QubitPilot's own storage. Your storage credentials are encrypted before we store them and are never shown back to you, or to anyone else, once saved.

Choosing your own storage changes where the file itself sits. It does not change what happens to the file's content once you ask QubitPilot to do something with it — that is covered in the next section, and applies identically whether your documents live in QubitPilot's storage or in a bucket you connected yourself.

The client portal

A firm can invite one of its clients to the client portal, a separate sign-in at /portal where that client sees the documents the firm has filed under their client record and can send documents back. A client is not a member of the firm's workspace and cannot see anything else in it.

• Who decides. The firm chooses whom to invite and which documents are filed under a client. An invited client can see every document filed under their own client record; they cannot see another client's documents or the firm's other files. As set out in Section 1, the firm is the Data Fiduciary for this information and QubitPilot processes it on the firm's behalf.
• Signing in. There is no password. Each sign-in uses a one-time code sent to the invited email address, which expires after 10 minutes and works once. We keep only a scrambled form of the code and of the sign-in session, not the values themselves. A sign-in lasts up to 30 days on that browser and uses one cookie to keep the client signed in.
• Documents a client sends. A document a client uploads through the portal goes to the firm and is stored with the firm's other documents, as described above. The client can rename or delete only the documents they uploaded themselves.
• Emails. We email the invited address to deliver the invitation and each sign-in code, and to say that new documents have been added. These emails do not list or attach the documents.
• Record of use. Sign-ins and the opening, uploading, renaming and deleting of documents through the portal are recorded in the firm's activity log (Section 9), which the firm can see.
• Ending access. The firm can remove a client's access at any time. Access also ends at once if the firm deletes or deactivates the client record, or if the firm's workspace is suspended or closed. Ending access does not delete the documents, which remain the firm's records.

If you are a client using a firm's portal, the firm that invited you decides what is held about you and for how long. Requests to see, correct or delete that information should go to the firm first, as described in Section 11.

5. How AI and search use your information

QubitPilot helps you find information in your workspace, understand documents, draft content and manage everyday work. To make these features work, we may read the text in uploaded documents and prepare searchable copies of their content. When you ask a question or use an AI feature, we use relevant information from your workspace to help answer it or complete the task.

This may include document text, client and matter records, and the questions or instructions you enter. The information needed for a feature is processed by AI and shared with the AI services that power it, as explained in Section 10. This also applies when your files are stored in your own connected cloud storage. Your storage passwords and access keys are never shared with these AI services.

What QubitPilot itself keeps. We save your assistant conversations, details remembered for your workspace, information prepared from your documents for search, records created or changed through an approved action, and usage and cost records. These are stored in QubitPilot's database with the same access controls as your other workspace data. Step-by-step logs of assistant and automation runs are kept for 90 days, and the detailed inputs of approval requests are removed 7 days after the request is resolved. None of this is used to train AI models.

You and your team control approvals. By default, the assistant asks someone in your workspace to approve actions such as changing records or sending messages. Your owner or admin can change these settings or allow a specific automation to run without approval. The WhatsApp assistant only responds to phone numbers your workspace already knows, and client numbers receive read-only answers.

Your professional obligations. Only add client information that you are allowed to store and process in this way. Your firm is responsible for deciding whether AI processing is appropriate for a client or matter and obtaining any consent required by your professional duties and applicable law.

You can choose whether to ask the assistant for help. However, uploaded documents may also be processed to make them searchable. If you do not want a document processed as described here, do not upload it. This applies whether you use QubitPilot's storage or your own connected storage.

6. Third parties we share information with

We do not sell personal information. We share information with the following categories of service providers, each acting on our instructions and only to the extent needed to provide the Service:

• Payments — Our payment processor handles subscription payments and recurring auto-debit mandates and receives billing contact details and payment instrument information directly; QubitPilot does not store your card or bank details.
• AI services — the AI that powers the assistant, automations, drafting, search, and document, image and voice understanding receives the content a task needs at the moment that task runs, as described in Section 10.
• Search results — where enabled, your search question and relevant passages from your documents are shared with an AI service to help show the most useful results first.
• Web search — when you ask the assistant to search the web or read a web page, the search query or page address is sent to our web search service.
• WhatsApp messaging — if you use the WhatsApp assistant, messages are sent and received through Meta's WhatsApp Business Platform, directly or through an approved WhatsApp business solution provider.
• Calendar sync — if you connect Google Calendar, hearing and task dates are synced both ways with your Google Calendar under the permissions you grant, as described in Section 7.
• GST, PAN and company verification — GSTIN, PAN and company or director look-ups you ask for are verified through our verification data providers.
• Court data — for firms using court tracking, publicly available case, hearing and order information is retrieved from the eCourts system and other public court data sources.
• Your own cloud storage provider — if you connect your own bucket (Section 4), your document files are stored with that provider (for example Amazon Web Services or Cloudflare) under your own account and their own terms and privacy practices, which we do not control.
• Infrastructure and hosting — the servers, database and email-delivery infrastructure that run the Service.

We may also disclose information where required by law, to enforce our agreements, or to protect the rights, property or safety of QubitPilot, our customers or others.

7. Google user data

This section applies when someone in your workspace connects a Google account to QubitPilot for Google Calendar sync. It sets out what we access from Google, why, and what we never do with it. Where it is more specific than the rest of this policy, this section governs Google user data.

What we access. Connecting Google Calendar grants QubitPilot two permissions: to see and edit events on your Google Calendar (calendar.events) and to see the email address of the connected Google account (userinfo.email). With them we read the events on your primary calendar — each event's title, description, location, start and end times, time zone, reminders and status — and the connected account's email address. We do not read event attendees, organisers or creators, and we do not access Gmail, Google Drive, Google Photos, your contacts or any other Google service.

How we use it. We use Google user data only to provide the calendar features you turn on: adding your hearing and task dates to your Google Calendar and keeping them up to date; bringing changes you make in Google Calendar back into QubitPilot; adding calendar events that match one of your cases (or, if you set a default case for imports, other events too) as hearings in your workspace, and holding the rest for your review; showing which Google account is connected; and answering questions about your schedule when you ask the QubitPilot assistant.

AI processing of Google user data. Once a calendar event is in your workspace it is a hearing record like any other. When you, or an automation your workspace has set up, use an AI feature that needs your schedule — for example, asking the assistant in the app or on WhatsApp about upcoming hearings — the relevant entries, including details that came from Google Calendar, and the connected account's email address where the task needs it, are sent at that moment to the AI services that power the feature, only to produce that answer or complete that task. Every such request requires zero data retention and refuses data collection, so the AI service does not store the data after responding and does not use it to train or improve any model, as described in Section 10. Google user data is not processed by AI for any other purpose.

No AI or machine-learning training. We do not use Google user data — raw, aggregated, anonymised or derived — to create, train or improve any foundational or generalised artificial intelligence or machine-learning model, whether our own or anyone else's, and we do not transfer it to any third party that would use it for that purpose.

Limited Use. QubitPilot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. In particular:

• we use Google user data only to provide or improve the user-facing calendar features described above;
• we transfer Google user data to others only as needed to provide or improve those features (including the AI processing described above), to comply with applicable law, or as part of a merger, acquisition or sale of assets after notice to you;
• we do not use or transfer Google user data for serving advertisements, including retargeting, personalised or interest-based advertising;
• we do not sell Google user data, and we do not use it to determine credit-worthiness or for lending purposes;
• no one at QubitPilot reads Google user data unless you have given your affirmative agreement for specific events, it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or the data has been aggregated and anonymised and is used only for internal operations.

Storage, retention and disconnecting. Google access tokens are encrypted before they are stored. Events brought in from Google Calendar are stored in your workspace with the same access controls as your other records. You can disconnect Google Calendar at any time from your workspace settings: this stops further access from that workspace and, unless the same Google account is still connected in another of your QubitPilot workspaces, revokes QubitPilot's access with Google. You can also remove QubitPilot's access at any time from your Google Account at myaccount.google.com/permissions. Hearings created from calendar events stay in your workspace as your records until your firm deletes them, and are otherwise kept and deleted as described in Section 9.

8. Where your information is processed

QubitPilot is built for Indian practices and its primary infrastructure is operated with that in mind. Some of the third parties listed in Section 6 — including the AI services that power the Service and, if you connect one, your own cloud storage provider — may process or store information on servers located outside India. Where that happens, we require the provider to maintain appropriate safeguards for that information.

9. How long we keep information

We keep your firm's data for as long as your workspace remains active. If a workspace is archived or a subscription lapses, its records are retained in an inactive state for a period to allow reactivation or export, after which they may be permanently deleted in line with our data retention schedule. Logs of AI assistant and automation runs, and the inputs of approval requests, are kept only for the shorter periods set out in Section 5, and the activity log of changes made in your workspace is kept for 12 months. Documents stored in your own connected bucket remain under your control and your provider's own retention settings even after your QubitPilot subscription ends.

10. Data and security

QubitPilot is an AI-assisted service. AI helps run your firm's workflow: the assistant in the app and on WhatsApp, automations your workspace sets up, drafting and summarising, search, reading documents and the voice notes or images sent to the WhatsApp assistant, preparing records for your review, and checking incoming messages for misuse. To do this, your data is processed by AI and shared with the AI services that power these features — only the records a task needs, such as client and matter details, hearing and compliance dates, tasks, notes, invoices, document text and the messages you send, and only at the moment that task runs. Every request we send to these AI services requires zero data retention and refuses data collection: the service processes the content only to return a result, does not keep it afterwards and does not use it to train or improve any model. A request that cannot be served on those terms fails; it is never sent to a service that would retain or train on your data. We have also switched off, at the account level, every setting that would allow prompts or responses to be logged or used for model training. QubitPilot does not train or fine-tune AI models on your data.

How we protect your data. We restrict access to your firm's data to your own workspace using role-based permissions your firm controls, encrypt storage credentials and sensitive tokens at rest, encrypt traffic to the Service in transit, and keep an activity log of changes made within your workspace. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach affects your workspace, we will inform the workspace owner, and the authorities, as applicable law requires.

11. Your rights

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you may request access to, correction of, or erasure of your personal information, and you may withdraw consent for a specific processing activity where consent is the basis for it. Because most information in the Service is entered and controlled by your firm — as the party that decides what client and matter data to add — requests relating to your firm's own workspace data should first be directed to your workspace owner or admin. To exercise these rights with QubitPilot directly, contact us using the details in Section 15; we will respond within the time required by law. Where the law provides for it, you may also nominate another person to exercise these rights on your behalf in the event of your death or incapacity, and, if you are not satisfied with how we have handled a grievance, you may complain to the Data Protection Board of India.

12. Children's data

QubitPilot is a professional practice-management tool and is not directed at, or knowingly used by, children. We do not knowingly collect personal information from anyone under 18.

13. Cookies and similar technologies

We use cookies and similar technologies, such as your browser's local storage, to keep you signed in, protect your account and remember your preferences. On our public website we also use analytics cookies to understand how visitors use the site, so that we can improve it. We do not use cookies for advertising within the application. You can manage or delete cookies in your browser settings; blocking essential cookies may stop parts of the Service from working.

14. Changes to this policy

We may update this policy from time to time. If we make a material change, we will notify workspace owners by email or by an in-app notice before the change takes effect. Continued use of the Service after a change takes effect means you accept the updated policy.

15. Contact

Questions about this policy or your data can be sent to support@qubitpilot.in, or by post to QubitPilot, 5th Floor, Gordhan Sky Mall, Office 507, Khatipura Road, Jhotwara, Jaipur, Rajasthan 302012, India.