Privacy Policy - QVI

1. About QVI

QVI (Quality Virtual Instruments) builds intelligent audio software — including QV1 and Neyora — and free browser tools that process files on your device. When you create an account you can save your waitlist place and manage it from any device.

This notice describes the data the current website collects and the parties that process it: accounts, profiles, and waitlists in the application; the contact form; hosting; and Google AdSense. The AdSense script loads on every page. Where display ads appear is controlled in AdSense.

2. Data we collect

We collect personal data when you create an account, sign in, join a product waitlist, or send a message. Some technical data is read automatically to run those features.

Data you provide

• Sign-up form: full name, country, email, password, and password confirmation. We do not ask for gender, date of birth, or phone number.
• A required checkbox confirming you are at least 13 years old. We store that confirmation as age_confirmed on your profile and in authentication metadata. We do not collect a date of birth.
• Required consent to this Privacy Policy and the Terms of Use, and an optional marketing checkbox (off by default) to receive updates and offers about QVI services by email.
• Sign-in form: email and password only.
• Account page: you may correct your name and country. Gender, date of birth, and phone are not shown or edited there. If an older account already stored those values, they stay in the database until you ask us to delete them.
• Product waitlist: email address and product name (QV1 or Neyora), plus your account id if you are signed in.
• Contact form: name, email, and message. Submitting sends the message to our support inbox via email (Resend). We do not store contact messages in the site database.

Data collected automatically

• A country code from the hosting request (Cloudflare request.cf.country, or the x-vercel-ip-country, cf-ipcountry, or x-country-code header) via /api/geo, used only to pre-fill the country field on sign-up. We do not store IP addresses in the profiles or waitlist_signups tables.
• Browser language (navigator.language) to choose Arabic or English and to suggest a default country (Egypt when the interface is Arabic).
• Authentication session cookies after you sign in, issued through Supabase Auth.
• On-device local storage: interface language (qvi-locale), theme (qvi-theme), recent color-picker swatches (qvi-recent-colors), and the last Neyora demo prompt (qvi-neyora-last-prompt). A waitlist email is stored only after the server accepts it.

What we do not collect through free tools

Images, audio, video, PDFs, and text you process in the free tools stay in the browser. There is no upload API for those files. We do not use GPS or precise location. The current application dependencies do not include product-analytics or messaging SDKs such as Google Analytics, Mixpanel, Sentry, or OneSignal. Measurement of display ads, when those ads are shown, is done by Google AdSense as described below, not by a separate analytics package in this application.

3. How we use your data and why

• Create and secure your account, and sign you in.
• Save your profile and waitlist place so you can manage them from any device.
• Record your confirmation that you are at least 13 years old. We do not collect a date of birth for this check.
• Send the account confirmation email through the authentication provider.
• Reply if you contact us.
• If you ticked the marketing box: send updates and offers about QVI services by email.
• Operate and protect the service (session handling and basic abuse prevention needed for the site to work).
• Load the Google AdSense script on every page, to help cover hosting. Where display ads appear is controlled in AdSense. This site also requests a display unit on free tools pages. Those units are not placed on product-page hero sections or purchase calls to action.

4. Legal bases (Egyptian Law No. 151 of 2020)

We process personal data in line with the Egyptian Personal Data Protection Law (Law No. 151 of 2020), on the following bases:

• Consent: the required age confirmation (13 or older), the required privacy/terms checkbox, and the separate optional marketing checkbox.
• Performance of a service (contract): creating the account, storing the profile, and letting you save and manage your waitlist place from any device.
• Legitimate interest: keeping authentication secure, pre-filling country so the form is usable, and operating hosting for the website. That interest is limited to what the code actually does.
• Legitimate interest: funding the free tools with Google AdSense display ads. Google may personalize those ads only where its policies and applicable law allow. You can limit personalization in Google Ad Settings, linked in the Cookies section.

5. Sharing data

We share data only with the processors this site uses. We do not sell personal data.

• Supabase: email/password authentication and the PostgreSQL tables public.profiles and public.waitlist_signups, plus auth user metadata. Row Level Security lets an authenticated user read and update only their own profile. Waitlist emails cannot be read with the public anon key.
• Hosting platform: serves the site and supplies the country code used by /api/geo (Cloudflare request.cf.country on Workers, x-vercel-ip-country on Vercel). Like any web host, it may retain technical request logs (such as IP and user agent) under its own operations. Those logs are not written into our application tables.
• unpkg.com: when you use in-browser audio conversion or trimming, the page downloads the FFmpeg engine (JavaScript/WASM) from unpkg. Your media files are not uploaded to unpkg or to our servers.
• Google AdSense (publisher ID ca-pub-9019451998006609): the site loads Google’s ads script on every page. Where display ads appear is controlled in Google AdSense. This site also requests a fixed display unit on free tools pages. Those units are not placed on product hero sections or purchase calls to action. We do not send your account profile — name, email, country, or similar account fields — to Google. When the script or an ad loads, your browser contacts Google, which may receive technical data such as IP address, browser type, the page URL, and cookie or advertising identifiers. Google uses that data to deliver ads, measure them, and personalize them where permitted.

We do not sell personal data. We do not integrate product-analytics or crash-reporting services such as Google Analytics, Mixpanel, Sentry, or OneSignal. Advertising on this site is Google AdSense. The ads script loads on every page, and where ads are shown is controlled in AdSense, as described above. We do not use the contents of files you process in the browser to build advertising profiles.

6. How long we keep data

• Account, profile, and authentication records: for as long as the account exists. The site does not currently include an in-app delete-account button; you may request deletion by emailing the privacy address below.
• Waitlist rows: until you ask us to remove them or we no longer need them for the product waitlist.
• Browser local storage: until you clear site data in your browser.
• Hosting logs: not given a separate retention period in our code; they follow the hosting provider’s operations.

7. Your rights

Subject to Egyptian Law No. 151 of 2020, you may exercise the following:

• Access: the account page displays your profile after you sign in.
• Rectification: you can edit your name and country on the account page. To correct or delete older gender, date of birth, or phone values that may still be stored, email the privacy address.
• Erasure: request deletion of your account, profile, and waitlist email via the privacy address. We will action that request because the product has no self-serve delete flow yet.
• Withdraw marketing consent: email the same address. Marketing consent is stored as marketing_consent on your profile; the account page does not yet include a later toggle.
• Withdraw the privacy/terms consent: that consent is required to create an account, so withdrawing it means we should close the account upon request.

8. Data security

• Passwords are sent to Supabase Auth and are not stored in plaintext in public.profiles. The authentication provider stores them hashed.
• The production site and API calls use HTTPS.
• The sign-up form requires a password of at least 6 characters.
• Database access for profiles is limited by Row Level Security (select/insert/update of the user’s own row only).

9. Cookies

We use cookies and similar storage as described below. Supabase Auth sets essential session cookies after you sign in. When the Google AdSense script loads, or an ad is shown, Google may set or read third-party advertising cookies and similar identifiers.

• Essential session cookies from Supabase Auth after sign-in, so the site can recognize you on later visits.
• localStorage keys on this device: qvi-locale, qvi-theme, qvi-recent-colors, qvi-neyora-last-prompt, qvi-tempo-pitch-preset, and qvi-waitlist-* as described above. These stay in your browser and are not sent to our database except when you submit a waitlist email to the server.
• Google AdSense cookies and similar identifiers, used for ad delivery, measurement, and personalization where permitted. The ads script loads on every page. Google sets these in your browser. They are not written into our profiles or waitlist tables.

These Google pages explain advertising cookies and how to limit personalized ads:

• Google Privacy Policy
• How Google uses cookies in advertising
• How Google uses information from sites or apps that use its services
• Google Ad Settings

10. Children’s privacy

You must be at least 13 years old to create an account. Sign-up requires you to confirm that with a checkbox, which we store as age_confirmed. We do not collect a date of birth, and we do not knowingly allow accounts for children under 13.

11. Marketing consent

• The marketing checkbox on sign-up is optional and off by default. Its label asks whether you would like to receive updates and offers about QVI services by email.
• If you tick it, we store marketing_consent = true in your profile and in authentication metadata, and we may email you about QVI services.
• If you leave it unticked, we store marketing_consent = false and do not use that flag to send marketing email.
• You can withdraw this consent later by writing to the privacy address. Withdrawing marketing consent does not delete your account.

12. Changes to this policy

We may update this policy when the product changes. The effective date at the top of this page is the date of this revision and does not change on each visit. Material changes will be reflected in this text; continued use after an update means you accept the revised policy for further use of the site.

13. QV1 desktop app

QV1 Evaluation is a Windows desktop application. Audio you open in QV1 is processed locally on your computer and is never uploaded to QVI.

The app goes online only to download models from a GitHub Release and to check for updates.

Crash logs stay in %LOCALAPPDATA%\QV1\logs unless you choose to email them.

When you are signed in and download the QV1 installer, we store the version, the time, and your browser’s user agent on your account so the account page can show your download history.

Privacy questions about the desktop app: privacy@getqvi.com

14. Contact us

For privacy requests (access, correction, deletion, or withdrawing marketing consent), email privacy@getqvi.com. Contact.