Privacy Policy

1. Who we are and what this policy covers

Qaltron Inc. (“Qaltron,” “we,” “us,” “our”) is a corporation registered in Delaware, United States, currently operating from Lahore, Pakistan, and serving clients globally. This Privacy Policy applies to the Qaltron CaaP™ platform at caap.qaltron.com and any Qaltron-owned page that expressly links to this policy for CaaP-related use (together, “the Platform” or “Our Site”) — covering public marketing and content pages, account registration and sign-in, your dashboard, and (where you have access) assessment, results, provenance, analytics, and benchmarking features — except where a specific service, order form, contract, or notice states otherwise.

The Platform may link to other Qaltron web properties and to third-party sites. We do not control those sites and are not responsible for their privacy practices.

2. Definitions

Personal Data means any information relating to an identified or identifiable natural person — for example your name, contact details, or an online identifier.

Sensitive Data means special categories of personal data (such as health or race). We do not intentionally collect sensitive personal data or data about children through the Platform.

Data Controller/Processor: for account, registration, and platform-usage data, Qaltron is the data controller. For public analytics events, our analytics service provider acts as our data processor under our instructions; for error and security monitoring, our error and security monitoring service provider acts as our data processor under our instructions; for assessment processing, our automated-analysis, AI-assisted processing, and public-source research service providers act as our data processors under our instructions, strictly to generate the results you request (Section 6).

Cookie / Browser Storage means a small piece of data placed on your device by a website. We use both cookies and other browser storage (localStorage/sessionStorage) as described in our Cookie Notice, which lists the exact names, purposes, and durations in use today.

3. Personal data we collect

What we collect depends on how you use the Platform:

Account & Identity Data — name, email address, and password (stored as a salted hash, never in plain text), provided when you register.
Business Data — company name and role, where you provide it as part of registration, an access request, or an assessment.
Assessment Inputs — information, evidence, organization details, URLs, structured selections, and other materials you (or someone acting on your behalf) provide through the Platform or in connection with an assessment, used to generate your results.
Public-Source Research Data — where you request an assessment, we may also gather publicly available information about the organization being assessed from public sources on the open web (for example, news coverage, press releases, and publicly available reports), used solely to inform and enrich your assessment results. See Section 6.
Platform Usage Data — the assessments, results, benchmarking, and provenance data you create or view while signed in, needed to operate your account and deliver the service you requested.
Technical & Security Data — standard web-server and hosting logs (such as request timestamps and, at the infrastructure level, IP address) kept for security and abuse prevention. This is separate from our public analytics, which may include coarse, non-precise geography and timezone signals but never your raw IP address or an exact location (see Section 4).
Public Analytics Data — on public marketing/content pages only, and only if you accept optional analytics, a small set of governed, pseudonymous usage events (see Section 4). We do not use advertising-network analytics or cross-context behavioral advertising on the Platform.
Error & Diagnostic Data — limited technical metadata about application errors (see Section 5).
Billing & Payment Data — where paid Platform access or a paid feature is enabled for your account, payment details are collected and processed directly by our payment provider under its own privacy and security practices; Qaltron does not store your full card number. Qaltron may receive transaction, invoice, and payment-status information needed to administer the Platform.

We do not knowingly collect sensitive personal data (health, race, and similar categories) or data about children through the Platform.

4. Public analytics

On public marketing and content pages, and only after you accept optional analytics in our cookie banner, we use an analytics service provider to understand aggregate visitor behavior and campaign attribution. This never runs on your dashboard, on login/registration, or on any assessment, results, provenance, or admin page.

we limit optional analytics to approved public-site engagement and attribution information, such as public page views, product/content interest, demo interaction, calls to action, social-profile clicks, coarse geography, timezone, and campaign/source information;
we do not use these analytics to create an identified account profile, and we do not use advertising-network analytics or cross-context behavioral advertising;
we do not send your raw IP address, exact coordinates, postal code, street-level address, email address, credentials, raw web address, query string, or assessment content as part of optional public analytics.

See our Cookie Notice for the cookie and browser-storage categories this creates, and how to opt out at any time.

5. Error and security monitoring

We use security, reliability, and error-monitoring services to detect, diagnose, and fix technical and security issues across the Platform. These run on our servers only and do not set any cookie or browser storage. We apply controls intended to limit the diagnostic information these services receive to the technical information necessary to detect, investigate, and resolve errors and security issues, and to prevent assessment content, credentials, or sensitive business inputs from being intentionally included.

6. Assessment processing: automated and AI-assisted analysis

When you request an assessment, we process the Assessment Inputs you provide together with, where relevant, Public-Source Research Data about the organization being assessed, in order to generate your results.

Source — what you submit through the assessment intake, plus, where applicable, publicly available material we gather from the open web (such as news coverage, press releases, and publicly available reports) about the organization being assessed.
Purpose — to analyze, contextualize, and generate the assessment results and benchmarking you requested.
How it is processed — this analysis uses automated tools, including AI-assisted processing, operated by us and by service providers acting on our instructions. It is not used to build an advertising profile of you, and public-source research is limited to organization-level, publicly available information reasonably relevant to your assessment. Qaltron does not use Assessment Inputs to train its own general-purpose products. Where service providers process Assessment Inputs for us, they do so for the purpose of providing the requested service to Qaltron and the Platform, subject to the applicable service terms, data-processing terms, or other contractual controls available for that processing.
Legal basis — performance of our contract with you (delivering the assessment you requested) and our legitimate interest in producing an accurate, well-informed result; where the assessed organization is not you personally, our legitimate interest also covers using publicly available information about that organization for this limited purpose.
Your rights — the rights described in Section 11 apply to personal data processed this way. If publicly available information about you personally has been incorporated into an assessment and you believe it is inaccurate or wish to object, contact us using Section 14 and we will review your request.

7. How and why we use your data, and our legal basis

We rely on different legal bases depending on the activity, not a single blanket “consent to everything”:

Performance of a contract with you — creating and operating your account, delivering the assessment, results, benchmarking, and reporting features you request.
Legitimate interests — keeping the Platform secure (session and authentication cookies, server logs, error/security monitoring), preventing fraud and abuse, and improving the Platform through aggregate, privacy-hardened analytics once you have accepted it.
Consent — optional public analytics and the marketing-attribution value described in Section 4, and any marketing communications you opt into. You can withdraw this consent at any time (Section 11 and our Cookie Notice) without affecting processing that already occurred.
Legal obligation — responding to lawful requests from courts, regulators, or law enforcement, and meeting applicable record-keeping requirements.

We do not make decisions about you based solely on automated processing that would have legal or similarly significant effects on you.

We do not sell or rent your personal data. We share data only as needed to operate the Platform:

Service providers — our hosting provider, our analytics service provider (public pages only, after consent), our error and security monitoring service provider, and the service providers who support automated analysis, AI-assisted processing, and public-source research used to generate your assessment results, each bound to process data only as we instruct and only for the purposes described here.
Payment provider — where you use paid Platform access or a paid feature, a payment service provider processes your payment details directly, under its own privacy and security practices. Qaltron may receive transaction, invoice, and payment-status information needed to administer the Platform.
Legal & regulatory — where required to comply with law or respond to a lawful request from a court, regulator, or law enforcement authority.
Business transfers — if Qaltron is acquired or merged, your data may transfer to the new owner, who will be bound by this Privacy Policy or an equivalent standard.

We do not share your personal data with third parties for their own advertising, and we do not use cross-context behavioral advertising on the Platform.

9. Data retention

We keep personal data only as long as necessary for the purpose it was collected. How long that is depends on: your account status, the service you have requested or are receiving, applicable legal, security, or dispute-resolution needs, and any specific retention period set out in an applicable contract or order.

Account data — retained while your account is active; after closure, retained only as long as needed to meet legal, security, or dispute-resolution obligations, or as set out in an applicable contract.
Assessment Inputs & Public-Source Research Data — retained while needed to provide the assessment, results, provenance, and benchmarking features you requested, and afterward only as long as your account status, an applicable contract, or legal, security, or dispute-resolution needs require; retained data is deleted or de-identified once none of those grounds continue to apply. Evidence provenance and integrity controls preserve the connection between evidence and an assessment record while that record is retained; they do not override these retention, deletion, legal, or rights-request obligations.
Public analytics events — retained by our analytics provider under that provider's own retention settings for our account; because these events are pseudonymous and identity-disabled by design, they are not linked back to an individual account.
Error/diagnostic data — retained by our error-monitoring provider only as long as needed for troubleshooting, under that provider's own retention settings for our account.
Server/security logs — retained only as long as needed for security investigation purposes, based on applicable security and operational requirements.

10. Data storage, security, and transfers

We use administrative, technical, and physical safeguards appropriate to the data involved, including encrypted transport (HTTPS), hashed passwords, HttpOnly/Secure/SameSite-protected authentication cookies, and request-forgery (CSRF) protection on state-changing forms. Where applicable data-protection law requires safeguards for an international transfer of personal data (for example, to our hosting provider or to our analytics, error-monitoring, or assessment-processing service providers), Qaltron uses recognized transfer mechanisms, contractual safeguards, adequacy arrangements, or other lawful mechanisms as applicable to the relevant processing. If a data breach affecting your personal data occurs, we will take prompt action to contain it and notify you and regulators as required by applicable law.

11. Your rights

Depending on where you are located, you may have rights including:

Right to be informed — this policy and our Cookie Notice explain our data uses.
Right of access — request a copy of the personal data we hold about you.
Right to rectification — correct inaccurate or incomplete data.
Right to erasure — request deletion where we have no lawful reason to keep it.
Right to restrict or object to processing — including objecting to processing based on legitimate interests.
Right to withdraw consent — for optional analytics or marketing, at any time, without affecting prior processing.
Right to data portability — a structured, machine-readable copy of data you provided under consent or contract.

These rights reflect UK/EU GDPR and are offered, where applicable to you, consistent with US state privacy laws (such as the CCPA/CPRA) and comparable frameworks elsewhere. To exercise any of these rights, or to change your cookie choice, use the Cookie Preferences control in the site footer for cookies, or contact us using the details in Section 14 for any other request. We will verify your identity before responding and aim to respond within one month (extendable by up to two further months for complex requests, as permitted by applicable law). There is normally no charge; if a request is manifestly unfounded or excessive we may charge a reasonable fee or decline it, as permitted by law. If you are not satisfied with our response, you may lodge a complaint with your local supervisory authority (for example, the UK Information Commissioner's Office).

12. Children's data

The Platform is intended for business use and is not directed at children. We do not knowingly collect personal data from children under 18. If you believe a child's data has reached us, please contact us so we can delete it.

13. Updates to this policy

We may update this Privacy Policy from time to time, for example to reflect changes in the law or in how the Platform works. We will post the revised policy here with an updated effective date. Material changes affecting optional analytics or cookies will also be reflected in our Cookie Notice and, where appropriate, will re-trigger the cookie choice.

14. Contact us

For privacy questions or to exercise your rights, contact:
Qaltron Inc. — Privacy
Email: info@qaltron.com