Privacy policy

This policy explains what personal information [Quantod Pty Ltd] (ABN [ABN]) (“Quantod”, “we”, “us”) collects when you use Cue-Queue and this website, what we do with it, and your rights. We are based in Australia and handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and under the GDPR and UK GDPR where they apply to you.

Two roles

Your organization’s workspace. What you and your colleagues put into an organization’s workspace (its documents, lists of work and files, and everyone’s own space within it) is handled for that organization. The organization decides what is kept, who can see it and for how long, and we process it on the organization’s instructions under our data processing terms. If your question is about that content, ask your organization first. If you use Cue-Queue on your own, your workspace is your organization and you are the one who decides.

Everything else. For your account, this website, access requests, and running and securing the service, we decide how personal information is used, and this policy describes it.

What we collect

Your account. Your name, email address, profile picture if you have one, and which organizations you belong to, with your role in each. These come from our sign-in provider when you sign in. We never see or store your password.

Your content. What you and your assistants put into Cue-Queue: documents, folders, lists of work and their items, and the files you upload. It may contain personal information about other people, for example candidates in a recruitment workflow. The organization that put it there is responsible for having the right to.

Your acceptance of our terms. Which version of the terms you accepted, when, and whether you did so in the web app or while connecting an assistant. If you accepted for organizations you administer, the same is recorded on each of them. We keep it as evidence of the agreement.

Connected assistants. For each assistant you connect: its name as it reports it, when it was connected, and when it was last used, so you can see and sign out every connection.

How the service is used. Technical records of requests, such as the time, the address requested, whether it succeeded, and the IP address. We keep them to operate the service, find faults and prevent abuse.

Access requests. What you enter in the request-access form: your name, email, company, team size, the assistants you use, how you heard of us and the work you describe. With it we keep a one-way fingerprint of your IP address, to limit how many requests one network can send.

Messages. What you send us by email.

What we do with it

• Provide Cue-Queue: sign you in, store your content, and let your assistants and colleagues reach what your organization allows them to.
• Keep it secure and reliable, and prevent abuse.
• Answer your messages and access requests, and send you messages about your account and the service.
• Bill for paid plans, once they are offered.
• Meet our legal obligations.

Where the GDPR applies, our legal bases are: performing our contract with you (providing the service), our legitimate interests (security, preventing abuse, answering access requests), and legal obligation.

We do not sell personal information, show advertising, or use your content to train AI models.

Who can see your content

• The people your organization allows. Owners and admins of an organization can see all of its content, including each member’s own space within it.
• The assistants you connect, acting as you and never with more access than you have.
• Our staff, only when they need to. Cue-Queue has no console for browsing customers’ work. People who run the service can reach the database. They do so only to answer a request from you or your organization, to keep the service secure and working, or when the law requires it.

Assistants you connect

When you ask an assistant to work with Cue-Queue, it reads and writes your content on your behalf. What the assistant’s maker does with that content is governed by their own privacy policy and your settings with them, not by this one.

Who we share it with

Only with the providers that run parts of Cue-Queue for us, under agreements that restrict them to doing so. The full list, with what each holds and where, is on the subprocessors page:

We share information with authorities only when the law requires it.

Where it is kept

Your content, your account and your organization’s settings are stored in Australia, and so are access requests, which we keep in our own workspace on Cue-Queue. Your sign-in identity is also held by WorkOS in the United States. By using Cue-Queue you understand that this information is disclosed to those countries. We use contractual protections with each provider, and for personal information from the EU or UK, the transfer safeguards those laws recognise.

How long we keep it

• Your content and account: while your account or organization exists. When an organization is deleted, its content is kept 30 days so an owner can undo the deletion, and then removed. When you delete your account, it and your personal workspace are removed at once; what you kept in an organization stays with that organization. Removed data can stay in our database backups for up to 7 more days before they expire.
• Request records: up to 90 days.
• Access requests: 12 months after we were last in touch about the request, then deleted. You can withdraw a request sooner by writing to hello@cue-queue.com.
• Billing records: as long as tax law requires.

Cookies

Cue-Queue sets only the cookies it needs to keep you signed in, remember which organization you are working in, and protect your session against forged requests. There are no advertising or analytics cookies, and no third-party scripts run on this site or in the app.

Sign-in takes place on WorkOS’s pages, which set their own cookies under WorkOS’s policy. Every other page, the request-access form included, is our own.

Security

Organizations are kept apart by the database itself, connections are encrypted, data is encrypted at rest, and access by assistants is limited to what the person who connected them may do. More in Security and data.

If a breach of personal information is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. Where the GDPR applies, we will notify the relevant organization without undue delay.

Your rights

You can ask to see the personal information we hold about you and to have it corrected. Where the GDPR or UK GDPR applies, you can also ask us to delete it, restrict or object to how we use it, or give you a copy in a portable form.

You can export your content yourself at any time, and delete your account yourself from your account page. For anything else, email us. We will answer within 30 days. For content in an organization’s workspace, we will pass your request to that organization, because it decides.

If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner, or to your local data protection authority.

Children

Cue-Queue is for adults. It is not for anyone under 18, and we do not knowingly collect children’s information.

Changes

If we change this policy in a way that matters, we will tell you by email or in the product before it takes effect.

Contact

[Quantod Pty Ltd], [registered address]. hello@cue-queue.com