Privacy Policy
Effective date: October 1, 2025
Kaizen Labs Inc. d/b/a Quinn ("Quinn") is committed to protect the privacy of our customers. Please read this Privacy Policy to learn how we treat your personal data. By using or accessing our Services in any manner, you acknowledge that you accept the practices and policies outlined below, and you hereby consent that we will collect, use and share your information as described in this Privacy Policy.
In the ordinary course of providing Quinn's products and services, we may process personal data about individuals—including our customers' employees—at the direction of our customers. We are not the controllers of such data and our processing of such data is governed by the written agreement executed by us and the applicable customer. The terms in place between you and the relevant customer, and not this Privacy Policy, apply to such processing.
How Quinn handles Customer Data
For data Quinn processes on behalf of a Customer in connection with that Customer's use of the Services ("Customer Data"), Quinn applies the following commitments, which take precedence over anything else in this Privacy Policy in the event of conflict:
No Cross-Customer Use; No Foundation Model Training. Quinn does not use one Customer's Customer Data to deliver Services to any other Customer, and does not use Customer Data to train, fine-tune, or improve any general-purpose or foundation machine learning model.
Customer-Scoped Personalization. To deliver Services tailored to a Customer, Quinn may incorporate that Customer's Customer Data into Customer-specific context (such as organization-level facts, knowledge base content, and retrieval indices) that is used solely to generate outputs for that Customer.
Third-Party Model Providers. Quinn uses third-party machine learning model providers to deliver the Services. Quinn submits Customer Data to these providers only under agreements or product configurations that prohibit those providers from using Customer Data to train or improve their models.
Service Operation, Evaluation, and Improvement. Quinn uses operational telemetry — including request and response traces, user feedback signals, error logs, and aggregated usage metrics — to operate, secure, debug, evaluate, and improve the Services. This telemetry necessarily includes Customer Data passing through the Services, and is processed by Quinn and a limited number of observability and evaluation sub-processors. Quinn does not use this telemetry to train general-purpose machine learning models, and does not share it for any purpose other than operating and improving the Services.
No Sale; No Advertising. Quinn does not sell, rent, or license Customer Data to any third party. Quinn does not use Customer Data for advertising, including interest-based or behavioral advertising, and does not share Customer Data with advertising or marketing partners.
No Other Sharing. Quinn discloses Customer Data only (a) to sub-processors as necessary to provide and improve the Services as described above; (b) as required by law or valid legal process; or (c) with Customer's prior written consent.
Limited Internal Access. Quinn personnel access Customer Data only as needed to provide, secure, troubleshoot, maintain, evaluate, or improve the Services, and only under written confidentiality obligations.
Customer Ownership. Customer retains all right, title, and interest in Customer Data.
Aggregated, De-identified Data. Quinn may generate and use aggregated, de-identified data that does not identify any Customer or individual, solely to operate, secure, and improve the Services.
Deletion on Request. Upon Customer's written request following termination or expiration of Customer's subscription, Quinn will delete or return Customer Data within thirty (30) days of receiving the request, except for (a) backup copies retained in the ordinary course of business and deleted on a rolling basis, and (b) any data Quinn is required to retain by applicable law.
The remainder of this Privacy Policy addresses Personal Data Quinn collects directly in connection with marketing, the public-facing website, support inquiries, and similar purposes — it does not modify the Customer Data commitments above.
Google User Data
This section describes how Quinn accesses, uses, stores, shares, and retains data from Google services — specifically Google Drive — when you connect them to Quinn through the Quinn File Storage integration. The commitments in "How Quinn handles Customer Data" above apply to this data; the disclosures below are Google-specific.
Access. With your authorization, Quinn File Storage requests read-only access to Google Drive (the drive.readonly OAuth scope). Quinn accesses only the folders and files you explicitly select to connect — it does not access any other content in your Google account.
Use. Quinn uses this data solely to read the contents of the folders and files you select and sync them into your Quinn Knowledge Base, so your team can search those documents and ask questions about their contents through Quinn's AI assistant. Quinn does not use Google user data for advertising, and does not use it to train, fine-tune, or improve any general-purpose or foundation machine learning model.
Storage. Synced content is stored as Customer Data within your organization's Quinn Knowledge Base and is handled under the Customer Data commitments above, including customer-scoped use only and the safeguards described in "Data Security."
Sharing. Quinn never modifies, deletes, or shares your Google Drive files. Quinn does not sell Google user data and does not disclose it except to the limited sub-processors necessary to provide the Services, as required by law, or with your consent — consistent with "How We Disclose Your Personal Data."
Retention and deletion. You can revoke Quinn's access to your Google Drive at any time through your Google Account's third-party access settings. Synced content is retained while the connection is active and as needed to provide the Services; on disconnection or upon written request, Quinn deletes the associated synced content in accordance with the "Data Retention" and "Deletion on Request" provisions above.
Quinn File Storage's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Categories of Personal Data We Collect
This chart details the categories of Personal Data that we collect:
| Category of Personal Data | Examples | Shared With |
|---|---|---|
| Profile or Contact Data | First and last name; Email; Username | Service Providers, Analytics Partners, Parties You Authorize, Access or Authenticate |
| Device/IP Data | IP address; Device ID; Type of device/operating system/browser | Service Providers, Analytics Partners |
| Web Analytics | Web page interactions; Referring webpage; Statistics associated with interactions | Service Providers, Analytics Partners |
| Productivity Platform Data | Information generated when the Services are accessed via a third-party (such as Slack, Microsoft Teams, Google SSO) | Service Providers, Parties You Authorize, Access or Authenticate |
| Geolocation Data | IP-address-based location information | Service Providers, Parties You Authorize, Access or Authenticate |
| Inferences Drawn from Other Personal Data Collected | Inferences reflecting user behavior | Service Providers, Analytics Providers |
| Other Identifying Information that You Voluntarily Choose to Provide | Identifying information in emails, letters, texts, or other communication you send us | Service Providers, Parties You Authorize, Access or Authenticate |
Categories of Sources of Personal Data
From You: When you provide information directly, voluntarily provide information in free-form text, create an account, send us an email, or use the Services. Through cookies. If you use a location-enabled browser.
From Vendors: Analytics providers that help us understand how you interact with the Services; customer support providers; vendors that help us deliver the Services to you.
From Productivity Platforms: If you sign in through Slack, Microsoft Teams, Google SSO, or similar, some content and/or information in those accounts may be transmitted to us.
Our Commercial or Business Purposes for Collecting or Disclosing Personal Data
Providing, Customizing, and Improving the Services: Providing you with the products, services or information you request; providing support; improving the Services through testing, research, internal analytics and product development; personalizing the Services and communications based on your preferences; fraud protection, security, and debugging; carrying out other business purposes stated when collecting your Personal Data.
Marketing Quinn (limited to non-Customer-Data communications): Marketing and selling the Services. Quinn does not use Customer Data for advertising, and does not serve interest-based or behavioral advertising using Customer Data.
Corresponding with You: Responding to correspondence, contacting you when necessary or requested, and sending you information about Quinn or the Services.
Meeting Legal Requirements and Enforcing Legal Terms: Fulfilling our legal obligations; protecting the rights, property or safety of you, Quinn or another party; enforcing agreements; responding to claims; resolving disputes.
How We Disclose Your Personal Data
Service Providers
These parties help us provide the Services or perform business functions on our behalf, including hosting providers, security and fraud prevention consultants, and support and customer service vendors.
Analytics Partners
These parties provide analytics on web traffic or usage of the Services, including companies that track how users found or were referred to the Services and how users interact with the Services. Quinn limits analytics partners to aggregated, non-Customer-Data signals where feasible.
Parties You Authorize, Access or Authenticate
Third parties you access through the Services; other parties you authorize, access, or authenticate.
Legal Obligations
We may share any Personal Data that we collect with third parties as needed to meet legal obligations.
Business Transfers
Personal Data we collect may be transferred in connection with a merger, acquisition, or sale of substantially all of our assets, subject to reasonable efforts to notify you.
Data that is Not Personal Data
We may create aggregated, de-identified or anonymized data from the Personal Data we collect, including by removing information that makes the data personally identifiable. We may use and share such aggregated, de-identified or anonymized data for our lawful business purposes, provided that we will not share such data in a manner that could identify you.
Tracking Tools, Advertising, and Opt-Out
The Services use cookies and similar technologies (collectively, "Cookies") to enable our servers to recognize your web browser, tell us how and when you visit and use our Services, analyze trends, learn about our user base, and operate and improve our Services.
We use the following types of Cookies:
- Essential Cookies. Required for providing features or services you have requested, including logging in.
- Functional Cookies. Used to record your choices and settings, maintain your preferences over time, and recognize you when you return.
- Performance/Analytical Cookies. Allow us to understand how visitors use our Services, including the number of visitors and which pages they view.
You can decide whether or not to accept Cookies through your internet browser's settings. To explore Cookie settings or modify your preferences, you can access your Cookie management settings on the Quinn website.
Data Security
We seek to protect your Personal Data from unauthorized access, use and disclosure using appropriate physical, technical, organizational and administrative security measures based on the type of Personal Data and how we are processing that data.
Data Retention
We retain Personal Data about you for as long as necessary to provide you with our Services or to perform our business or commercial purposes for collecting your Personal Data, and as required by law. For Customer Data processed on behalf of a Customer, retention is governed by the applicable Customer Agreement and the "How Quinn handles Customer Data" section above.
Personal Data of Children
Quinn's Services are intended for business use by individuals who are at least 18 years old. We do not knowingly collect or solicit Personal Data from anyone under 18. If we learn we have collected Personal Data from someone under 18, we will delete that information as quickly as possible. If you believe a person under 18 has provided Personal Data to us, please contact us at legal@meetquinn.ai.
State Law Privacy Rights
California Resident Rights
California residents may contact us at legal@meetquinn.ai to exercise applicable rights under California law. Our Services do not currently support Do Not Track signals.
Nevada Resident Rights
Nevada residents may contact us at legal@meetquinn.ai with the subject line "Nevada Do Not Sell Request." Quinn does not currently sell Personal Data as defined in Nevada Revised Statutes Chapter 603A.
European Union and United Kingdom Data Subject Rights
EU and UK Residents
If you are a resident of the European Union ("EU"), United Kingdom ("UK"), Lichtenstein, Norway or Iceland, you may have additional rights under the EU or UK General Data Protection Regulation (the "GDPR") with respect to your Personal Data, as outlined below.
For this section, we use the terms "Personal Data" and "processing" as they are defined in the GDPR, but "Personal Data" generally means information that can be used to individually identify a person, and "processing" generally covers actions that can be performed in connection with data such as collection, use, storage and disclosure. Quinn will be the controller of your Personal Data processed in connection with the Services.
If there are any conflicts between this section and any other provision of this Privacy Policy, the policy or portion that is more protective of Personal Data shall control to the extent of such conflict. If you have any questions about this section or whether any of the following applies to you, please contact us at legal@meetquinn.ai. Note that we may also process Personal Data of our customers' end users or employees in connection with our provision of certain services to customers, in which case we are the processor of Personal Data. If we are the processor of your Personal Data (i.e., not the controller), please contact the controller party in the first instance to address your rights with respect to such data.
Personal Data We Collect
The "Categories of Personal Data We Collect" section above details the Personal Data that we collect from you.
Personal Data Use and Processing Grounds
The "Our Commercial or Business Purposes for Collecting or Disclosing Personal Data" section above explains how we use your Personal Data.
We will only process your Personal Data if we have a lawful basis for doing so. Lawful bases for processing include consent, contractual necessity and our "legitimate interests" or the legitimate interest of others, as further described below.
- Contractual Necessity: We process the following categories of Personal Data as a matter of "contractual necessity", meaning that we need to process the data to perform under our Terms of Service with you, which enables us to provide you with the Services. When we process data due to contractual necessity, failure to provide such Personal Data will result in your inability to use some or all portions of the Services that require such data.
- Legitimate Interest: We process the following categories of Personal Data when we believe it furthers the legitimate interest of us or third parties:
- Profile or Contact Data
- Device/IP Data
- Web Analytics
- Productivity Platform Data
- Geolocation Data
- Inferences Drawn from Other Personal Data Collected
- Other Identifying Information that You Voluntarily Choose to Provide
We may also de-identify or anonymize Personal Data to further our legitimate interests.
Examples of these legitimate interests include (as described in more detail above):
Providing, customizing and improving the Services.
Marketing the Services.
Corresponding with you.
Meeting legal requirements and enforcing legal terms.
Completing corporate transactions.
Consent: In some cases, we process Personal Data based on the consent you expressly grant to us at the time we collect such data. When we process Personal Data based on your consent, it will be expressly indicated to you at the point and time of collection.
Other Processing Grounds: From time to time we may also need to process Personal Data to comply with a legal obligation, if it is necessary to protect the vital interests of you or other data subjects, or if it is necessary for a task carried out in the public interest.
Sharing Personal Data
The "How We Disclose Your Personal Data" section above details how we share your Personal Data with third parties.
EU Data Subject Rights
You have certain rights with respect to your Personal Data, including those set forth below. For more information about these rights, or to submit a request, please email us at legal@meetquinn.ai. Please note that in some circumstances, we may not be able to fully comply with your request, such as if it is frivolous or extremely impractical, if it jeopardizes the rights of others, or if it is not required by law, but in those circumstances, we will still respond to notify you of such a decision. In some cases, we may also need you to provide us with additional information, which may include Personal Data, if necessary to verify your identity and the nature of your request.
- Access: You can request more information about the Personal Data we hold about you and request a copy of such Personal Data.
- Rectification: If you believe that any Personal Data we are holding about you is incorrect or incomplete, you can request that we correct or supplement such data.
- Erasure: You can request that we erase some or all of your Personal Data from our systems.
- Withdrawal of Consent: If we are processing your Personal Data based on your consent (as indicated at the time of collection of such data), you have the right to withdraw your consent at any time. Please note, however, that if you exercise this right, you may have to then provide express consent on a case-by-case basis for the use or disclosure of certain of your Personal Data, if such use or disclosure is necessary to enable you to utilize some or all of our Services.
- Portability: You can ask for a copy of your Personal Data in a machine-readable format. You can also request that we transmit the data to another controller where technically feasible.
- Objection: You can contact us to let us know that you object to the further use or disclosure of your Personal Data for certain purposes, such as for direct marketing purposes.
- Restriction of Processing: You can ask us to restrict further processing of your Personal Data.
- Right to File Complaint: You have the right to lodge a complaint about Quinn's practices with respect to your Personal Data with the supervisory authority of your country or EU Member State. A list of Supervisory Authorities is available here: https://edpb.europa.eu/about-edpb/board/members_en.
Transfers of Personal Data
The Services are hosted and operated in the United States ("U.S.") through Quinn and its service providers, and if you do not reside in the U.S., laws in the U.S. may differ from the laws where you reside. By using the Services, you acknowledge that any Personal Data about you, regardless of whether provided by you or obtained from a third party, is being provided to Quinn in the U.S. and will be hosted on U.S. servers, and you authorize Quinn to transfer, store and process your information to and in the U.S., and possibly other countries. In some circumstances, your Personal Data may be transferred to the U.S. pursuant to a data processing agreement incorporating standard data protection clauses.
Contact Information
If you have any questions or comments about this Privacy Policy, please contact us at: legal@meetquinn.ai, or Kaizen Labs Inc., 345 7th Avenue, 6th Floor, New York, NY 10001.
If you are located in the EU or UK, you may use the following information to contact our EU or UK-Based Member Representative:
UK Member Representative
GDPR Local Ltd. — Adam Brogden
contact@gdprlocal.com | Tel +44 1772 217800
1st Floor Front Suite, 27-29 North Street, Brighton England BN1 1EB
EU Member Representative
Instant EU GDPR Representative Ltd. — Adam Brogden
contact@gdprlocal.com | Tel +35315549700
INSTANT EU GDPR REPRESENTATIVE LTD, Office 2, 12A Lower Main Street, Lucan Co. Dublin, K78 X5P8, Ireland