Privacy Policy

1. Introduction

Quack, Inc. ("the Company," "we," "us," or "our") operates quackhq.org and provides a trainable AI customer-support agent for B2B SaaS teams (the "Service"). This Privacy Policy describes how the Company collects, uses, and protects information in connection with quackhq.org and direct communications with us.

The Company is based at 301 Brannan Street, Suite 500, San Francisco, CA 94107. Questions about this Policy can be directed to [email protected].

The Service is designed for business customers. When a B2B SaaS team connects Quack to their helpdesk, the Company processes support tickets, knowledge-base documents, product documentation, and end-user queries on behalf of that business. This Policy covers information the Company collects from visitors to quackhq.org and from business contacts who sign up for or inquire about the Service. Customer-side ticket and document data is processed under the applicable business agreement with that customer.

2. Information We Collect

2.1 Information You Provide

We collect information you submit directly, including:

• Contact details (name, work email, phone) when you fill out an early-access form, request a demo, or reach out through the site;
• Company information you choose to share (employer, role, helpdesk platform in use, approximate support volume);
• The content of any messages you send us.

2.2 Information Collected Automatically

When you visit quackhq.org, we automatically collect limited technical information:

• IP address and approximate location (city/region level);
• Browser type, operating system, device class;
• Pages visited, referring URLs, time on page;
• Cookie and similar identifiers (see Section 5 and our Cookie Notice).

2.3 Service Usage Data (Customers)

For teams that have connected Quack to their helpdesk environment, the Service ingests and processes customer support tickets, knowledge-base articles, product documentation files, and end-user queries in order to train the agent and generate responses. This data is processed solely to provide the service you subscribed to. The Company does not use ticket content or end-user query text to train shared models or to build advertising profiles. Retention of ingested data is governed by the applicable customer agreement; by default, ticket and document indexes are deleted within 30 days of account cancellation.

2.4 We Do Not Knowingly Collect Children's Data

quackhq.org is a business-to-business service not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it.

3. How We Use Information

We use the information we collect to:

• Evaluate early-access applications and onboard qualified B2B SaaS support teams;
• Respond to inquiries and provide requested information about the Service;
• Operate, maintain, and improve quackhq.org and the Quack agent platform;
• Send service updates and (with your consent where required) information about new features or pricing;
• Detect, investigate, and prevent fraud or abuse;
• Comply with legal obligations.

We do not sell personal information for monetary value. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see your state's section below.

4. Sharing of Information

We share personal information only with:

• Service providers acting on our behalf (including cloud infrastructure, email delivery, and analytics tools) under contractual confidentiality terms;
• Authorities, when required by law or to protect rights, safety, or property;
• A successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy.

We do not sell personal information to third parties.

5. Cookies and Tracking

We use cookies and similar technologies to operate the site, remember preferences, and measure usage. For details and choices, see our Cookie Notice.

6. Data Retention

We retain personal information only as long as needed for the purposes described here, to comply with legal or accounting obligations, and to resolve disputes. Inactive marketing-list contacts are purged after 24 months. Server access logs are retained for 90 days, then aggregated and anonymised. Customer ticket and document data is retained per the applicable customer agreement.

7. Security

We apply administrative, technical, and physical safeguards designed to protect personal information. These include TLS 1.2+ encryption in transit, AES-256 encryption at rest, role-based access controls, and least-privilege access policies. No system is perfectly secure; we cannot guarantee absolute security and are not liable for unauthorised access outside our reasonable control.

8. Your General Rights

Depending on your jurisdiction, you may have rights including access, correction, deletion, and the ability to limit certain processing. To make a request, email [email protected]. We will respond within the timeframe required by applicable law.

9. California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"), California residents have specific rights regarding personal information collected about them. This section supplements the rest of the Policy.

9.1 Categories We Collect

In the past 12 months, the Company has collected the following categories of personal information defined under Cal. Civ. Code §1798.140: identifiers (name, email, IP address); professional and employment-related information (company, role, helpdesk platform); commercial information (service inquiries, pricing discussions); internet activity (browsing on quackhq.org); and inferences drawn from the above for service-improvement purposes. For customers using the Quack agent platform, the Company also processes support ticket content and end-user query text on behalf of the subscribing business -- that processing is governed by the applicable customer agreement, not this section.

9.2 Sources, Purposes, Disclosure

We obtain this information from you directly (early-access forms, demo requests, direct email) and through automatic site instrumentation (cookies, server logs). We use it to operate and improve the Service, to evaluate and onboard early-access customers, and to meet legal obligations. We disclose it only to service providers under written contract and to legal authorities where required.

9.3 Your CCPA / CPRA Rights

• Right to Know: request the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: request deletion of personal information we collected from you, subject to legal exceptions.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: we do not sell personal information; we do not "share" it for cross-context behavioral advertising as defined under CPRA.
• Right to Limit Use of Sensitive PI: we do not use sensitive personal information for purposes beyond those permitted without authorization.
• Right to Non-Discrimination: we will not deny services, charge different prices, or provide a different level of service because you exercised a right.

9.4 How to Exercise

Submit a verifiable request by emailing [email protected] with the subject line "California Privacy Request." Include enough detail for us to verify you are the person whose information is the subject of the request. We respond within 45 days, with a possible 45-day extension for which we will notify you.

9.5 Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide proof of authorization; we may also require you to verify your identity directly.

9.6 "Shine the Light"

California Civil Code §1798.83 entitles California residents to request information regarding our disclosure of personal information to third parties for direct marketing. We do not disclose personal information for third-party direct marketing.

9.7 Do Not Track and Global Privacy Control

Under the California Online Privacy Protection Act (Cal. Bus. & Prof. Code §22575), we disclose how we respond to "Do Not Track" (DNT) browser signals. Because there is no common industry standard for interpreting DNT signals, we do not currently respond differently to them. We do not authorize third parties to collect personally identifiable information about your activity across different websites when you use the Service. We honor an opt-out preference signal sent by a platform or browser that complies with the CPRA, such as the Global Privacy Control (GPC); when we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new effective date at the top of this page and, where appropriate, a notice on the Service.

11. Contact

Questions, requests, or complaints about this Policy can be sent to: