Data Processing Agreement
You are the controller. We are the processor.
Last updated: 29 October 2026
1. What is a DPA?
A Data Processing Agreement is a contract between a data controller (you) and a data processor (us), as required by Article 28 of the GDPR and similar regulations.
2. Subject matter and duration
This DPA covers personal data that you collect, import or connect through Qintr and that is stored in your workspace, for as long as you keep an active account and until that data is deleted.
3. Nature and purpose
We process personal data only to provide Qintr to you:
- Pulse: sending and collecting surveys, polls and research, and analysing the results
- Ideas: running feature request boards, with voting, comments, a roadmap and updates
- Proof: collecting testimonials and reviews, storing their media, and showing the ones you approve in widgets and walls
- People and companies: identifying people through the in-app SDK or a signed identity, importing and syncing people and companies, and linking their answers, votes and testimonials
- Connected tools: exchanging data with the CRM, help desk, review and other tools you connect
- AI processing: if you switch AI on, sending questions and answer text to our AI sub-processor to tag, summarise and draft
- Email: sending the emails you ask us to send, and receiving replies
Processing includes collection, storage, organisation, analysis, display, export and deletion.
4. Categories
Data subjects:
- People who answer your surveys and polls
- People who submit, vote on or comment on ideas
- People who submit testimonials or reviews
- Your product's users, identified through the in-app SDK or a signed identity
- People and companies you import or sync
- People whose data comes from tools you connect, such as your CRM, help desk or review platforms
- Your team members who use Qintr
Data processed:
- Identity and contact: name, email, job title, company, headshot, optional social link
- Content: survey answers and scores, comments, ideas and votes, written or video testimonials, reviews and star ratings, consent to be featured
- Product data you send: user ID, traits and events (for example, "exported a report")
- Company and account data you import: plan, revenue, seats, renewal date and similar fields
- Data from connected tools: contacts, companies, tickets, conversations and reviews
- Technical data: IP address and browser details in logs, and cookies on public forms
5. Our obligations as processor
- Process only on your documented instructions as expressed through the product
- Staff with access are bound by confidentiality
- Appropriate security measures — see Security
- Notify you without undue delay of a personal data breach affecting your workspace
- Assist with data subject requests
- Delete or return personal data at the end of the relationship except where law requires retention. Deleting a workspace deletes its data and files, as set out in section 8 of our Privacy Policy
6. Sub-processors
We use these sub-processors to provide Qintr:
| Sub-processor | What for | Where data is processed |
|---|---|---|
| Railway Corporation | Application hosting, database and background jobs | United States |
| Cloudflare, Inc. | Storage for uploaded photos and videos (R2); DNS, content delivery and network protection | Cloudflare's global network |
| Resend | Sending email you ask us to send, and receiving replies | United States |
| Anthropic, PBC | AI features, only if you switch AI on. Receives questions and answer text, not the names, emails or companies we hold | United States |
| Functional Software, Inc. (Sentry) | Error monitoring. Form answers, cookies, names, emails and IP addresses are removed first | United States |
| Google LLC | Sign in with Google, for your team members who choose it | United States and other countries |
| Paddle.com Market Limited | Reseller and Merchant of Record for self-serve plans. Receives your billing contact and payment details only, not your customers' data | United Kingdom and other countries |
Tools you connect to your workspace (for example a CRM, help desk or review platform) are chosen by you and are not our sub-processors.
We'll notify customers of material changes with reasonable advance notice.
7. Your rights as controller
Access, export, or delete your workspace's data from the dashboard. Otherwise email privacy@qintr.com.
8. International transfers
Qintr is operated from India, and our sub-processors process data in the places listed in section 6. Where required, we rely on Standard Contractual Clauses and other safeguards.
9. Contact
privacy@qintr.com. For a signed negotiated DPA, email hello@qintr.com.