Privacy policy

Who we are and how to reach us

Qonnex is part of Wichita Group and operates this website and the Business Analysis from its United States headquarters in New Jersey. For personal data collected here, Qonnex is the data controller, and the business responsible under California law. You can reach our privacy team at support@qonnex.ai for any request or question described below.

The data we collect

• Business Analysis answers: the operational details you enter, used to produce your savings estimate and report
• Identity and contact data: your name and work email when you create an account, request your report, or contact us
• Messages you send us through the contact form, so we can reply
• Technical and usage data: IP address, device and browser type, and pages viewed, collected by analytics only after you consent
• We do not intentionally collect special-category data such as health, biometric, or political information; please do not enter it in free-text answers

Why we use it and our legal bases

We use personal data only for the purpose it was given: producing your estimate and report, replying to you, running and securing the site, and, with your consent, understanding how the site is used.

Under the EU and UK GDPR our lawful bases are the performance of pre-contractual steps you request (the analysis and report), our legitimate interest in answering enquiries and keeping the site secure, and your consent for analytics. Where Vietnam's PDPL applies, we rely on your consent or on the performance of a contract, as the situation requires.

Cookies and analytics

The site sets only strictly necessary storage until you choose. If you allow analytics, Google Analytics, Meta, and LinkedIn set cookies to measure usage and attribution. You can accept, refuse, or change this at any time. Full detail, including how to withdraw consent, is in the Cookie policy.

How we share data

We do not sell or rent personal data, and we do not share it for cross-context behavioral advertising. We use a small set of service providers who process data only on our instructions: Vercel for hosting and delivery, Supabase for secure storage of submissions, and Resend for transactional email. The analytics providers named above receive data only after consent. Each provider is bound by a data processing agreement.

International transfers

Our providers process data in the United States and other countries. When we handle the personal data of individuals in the EU, the UK, or Vietnam, these are cross-border transfers. For EU and UK data we rely on Standard Contractual Clauses or equivalent safeguards maintained by each provider. For data covered by Vietnam's PDPL, we complete the transfer impact assessment the law requires before the data is stored abroad.

How long we keep it

Analysis submissions that do not lead to an engagement are deleted within twelve months. Contact messages are kept while the conversation is active and for up to twelve months after. Personal data handled under a signed engagement follows the retention terms of that agreement. We delete or anonymize data once its purpose ends.

Your rights

Subject to your location and applicable law, you can request access to your data, correction, deletion, a copy in portable form, and restriction of or objection to processing, and you can withdraw consent at any time without affecting processing already carried out.

Under California law you may request the categories and specific pieces of personal information we hold, ask us to delete or correct it, and opt out of any sale or sharing. We do not sell or share personal information, and we will not discriminate against you for exercising your rights. Under Vietnam's PDPL you may give or withdraw consent, and access, correct, delete, restrict, or object to processing.

To exercise any right, email support@qonnex.ai. We verify your request and respond within the period your law allows, which is one month under the GDPR, forty-five days under California law, and the period set by Vietnam's PDPL. You may also complain to your local data protection authority.

Security and breach notification

We protect data with access scoped in writing, encryption in transit, rate limiting, and a strict content security policy. No system is perfectly secure, but if a breach is likely to affect you we will notify the relevant authority, and you where the law requires, within the deadlines that apply, including the seventy-two-hour window under the GDPR and Vietnam's PDPL.

Children

The site and the analysis are for business users and are not directed to children. We do not knowingly collect data from children. If you believe a child has provided data, contact support@qonnex.ai and we will delete it.

Changes to this policy

We may update this policy as our practices or the law change. The date above shows the current version, and we will flag material changes on this page. Continued use after an update means you have read the current version.