Privacy Policy

Last updated: 24 August 2026

This notice explains what personal data Qualify Innovation (“Qi”, “we”) collects when you use the web application or the Microsoft Teams app, why we collect it, how long we keep it and what rights you have. It covers both the enterprise and the free tier, and both the browser and the Teams tab.

A separate document, Privacy and Confidentiality, sets out the mutual confidentiality obligations between us and our customers. It is a contractual clause, not this privacy notice.

1. Who is responsible for your data

The controller within the meaning of Art. 4(7) GDPR is:

• five i's innovation tools GmbH
• Radetzkystrasse 29, 6850 Dornbirn, Austria
• Company register number: FN 553834 m, Landesgericht Feldkirch
• VAT number: ATU76777418
• Privacy contact: privacy@go4qi.com

We have not appointed a data protection officer, as we are not required to under Art. 37 GDPR. Responsibility for data protection rests with Peter Fürst and Máté Magy, who are reachable at the contact address above.

2. What we collect

2.1 Account data

When an account is created — by you registering, or by your organisation’s administrator creating one for you — we process your name, email address, company name, job position and, if supplied, telephone number. If you use a password, we store it only as a one-way hash; we never store the password itself and cannot recover it.

2.2 Sign-in inside Microsoft Teams

When you open the app as a tab in Microsoft Teams, Teams asks Microsoft Entra ID for a token on your behalf. We verify that token cryptographically and read from it your email address and your organisation’s tenant ID. We use the email address to match you to an existing account, and the tenant ID to check that your organisation is permitted to use the app. We do not receive your Microsoft password, and we do not read your mail, files, calendar or Teams messages.

2.3 Content you create in the app

Ideas, projects, evaluations, scores, comments, deadlines, the project members you assign, and any files or photos you upload. In the Teams project-profiling flow this also includes the criteria you select, the evaluators you invite (their email addresses) and the scores each evaluator submits.

2.4 Technical data

Server access logs (IP address, time, requested address, browser identification) kept for security and troubleshooting, and application logs recording authorisation decisions.

2.5 Cookies

We use cookies that are strictly necessary to operate the service — there are no advertising or analytics cookies, and no tracking across other websites. They hold your session identifiers, the email address you signed in with, and small interface preferences such as which page you came from. Session cookies are cleared when you sign out. Because they are strictly necessary, no consent banner is required under § 165(3) TKG 2021 / Art. 5(3) ePrivacy.

3. Why we use it, and on what legal basis

Where your employer bought the enterprise tier, they decide what happens in their workspace and we act as their processor under Art. 28 GDPR. For the free tier we are the controller ourselves.

We do not sell personal data, we do not share it for advertising, and we do not use it to train machine-learning models. No decision with legal or similarly significant effect is made about you by automated means.

4. Who else processes it

We use the following processors, each under a data processing agreement:

Beyond these, we disclose personal data only where the law requires it.

5. Where your data is stored

Application data, the database and uploaded files are hosted on Microsoft Azure in Germany West Central (European Union). Data stays within the European Union; we do not transfer it to third countries. Connections to the service are encrypted with TLS, and the storage underlying the servers is encrypted at rest.

6. How long we keep it

• Active accounts and their content: for as long as the account is active. Project content — profiling scores, comments and uploaded files — is kept for the life of your organisation’s contract and deleted within 90 days of its end. Invoicing and accounting records are kept for seven years, because Austrian tax and commercial law requires it.
• Disabled accounts: name and email address are automatically masked 90 days after the account is disabled, by a job that runs daily.
• Backups: nightly copies are kept on encrypted storage in the same EU region — the database for 30 days and uploaded files for 14 — and are then deleted automatically. We do not edit backups to remove single records, because doing so would compromise their integrity as a recovery point. A deletion request takes effect on the live system immediately, and the remaining copies fall out of the backup cycle within 30 days.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict how we process it (Art. 18);
• receive your data in a portable, machine-readable form (Art. 20);
• object to processing based on our legitimate interest (Art. 21).

To ask for a copy of your data: write to the privacy address below from the address your account uses. We confirm it is you, then send back your account details and project content in a machine-readable format, with any files you uploaded as you uploaded them. This is free of charge. To ask for deletion: write to the same address. Once we have confirmed it is you, we disable the account straight away and then erase the account record, your uploaded files and your profile photo, and remove your address from any evaluator list it appears on. Records we are legally required to keep — invoices, for example — are kept for the statutory period and used for nothing else. Copies held in routine backups are not edited; they fall out of the backup cycle within 30 days. We answer within 30 days. If your account was created by your employer, we may need to refer your request to them, and we will tell you if we do.

You may also complain to a supervisory authority. Ours is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.

8. How we protect it

Access to your account requires authentication, and every request is checked against your role and your membership of the project concerned. Passwords are stored as one-way hashes. Traffic is encrypted in transit. Administrative access to the servers is restricted to named accounts using key-based authentication. We keep an incident response procedure and, in the event of a personal data breach that is likely to result in a risk to you, we notify the supervisory authority within 72 hours as required by Art. 33 GDPR, and notify you directly where Art. 34 requires it.

9. Children

The service is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.

10. Changes to this notice

We update this notice when the service changes. The date at the top always reflects the current version, and we notify account holders of material changes by email before they take effect.

11. Contact

Questions about this notice or about your data: privacy@go4qi.com, or contact support.