Privacy Policy

This Privacy Policy explains how Qwestyon ("we", "us", "our") collects, uses, stores, and shares personal data when you use www.qwestyon.com (the "Site"), our forms, and selected free tools.

This policy is written to support UK GDPR, the Data Protection Act 2018, and related ePrivacy rules. It is intended to be clear and practical, but it is not legal advice.

1. Data Controller

Qwestyon (trading name) is the data controller for personal data processed through the Site, except where otherwise stated.

Contact: hello@qwestyon.com

2. Data We Collect

Depending on how you interact with the Site, we may collect:

• Contact and identity data: name, work email, company, and other details submitted through contact forms, audit requests, and newsletter/tool forms.
• Business and project data: website URLs, ad account identifiers, ad spend ranges, campaign challenges, and additional context you submit for audits or enquiries.
• Tool input/output data: URLs and optional email addresses submitted to tools such as the AI Visibility Checker, Landing Page Grader, and Schema Checker, plus generated report metadata.
• Technical and usage data: IP-derived security signals, user agent, referrer, page path, page URL, timestamps, and campaign attribution parameters (for example UTM values and click IDs).
• Cookie and tracking data where consent is granted: analytics and marketing identifiers.

3. How We Use Your Data

We use personal data to:

• Respond to enquiries and provide requested services, audits, reports, and follow-ups.
• Operate and improve Site functionality, UX, and content quality.
• Protect the Site, users, and systems from abuse, fraud, and security threats.
• Measure performance of pages and campaigns where consent is provided.
• Send relevant communications where requested or otherwise permitted by law.
• Comply with legal, regulatory, and contractual obligations.

We do not sell personal data.

4. Legal Bases

Our primary legal bases are:

• Legitimate interests: operating the Site, handling business enquiries, improving services, and preventing misuse, where balanced against your rights.
• Contract steps or contract performance: when processing is necessary to take steps at your request before entering a contract, or to provide agreed services.
• Consent: for non-essential cookies/tracking and certain communications where consent is required.
• Legal obligation: where processing is necessary for legal or regulatory compliance.

5. Cookies and Tracking

We use a consent-based cookie model with the following categories:

• Strictly necessary cookies: always on for core functionality and security.
• Analytics cookies: enabled only where you opt in.
• Marketing cookies: enabled only where you opt in.

Where enabled, tracking tools may include:

• Google Tag Manager (GTM)
• Google Analytics 4 (GA4)
• Meta Pixel

You can accept, reject non-essential cookies, or manage preferences through the cookie controls available on the Site. You can reopen cookie settings at any time.

6. Data Sharing and Processors

We share personal data only where needed to operate the Site and deliver requested services. This may include processors and infrastructure providers such as hosting, form handling, email delivery, analytics, storage, and AI processing providers.

Examples include service categories such as:

• Hosting and infrastructure providers
• Managed form endpoint providers
• Email delivery providers
• Cloud database/storage providers
• Analytics and marketing measurement providers (where consent applies)
• AI service providers used for selected tool outputs (if configured)

We require service providers to process data under appropriate contractual and security safeguards.

7. International Transfers

Some providers may process data outside the UK. Where international transfers occur, we use appropriate safeguards under applicable law, such as adequacy decisions or approved contractual clauses.

8. Data Retention

We keep personal data only as long as needed for stated purposes, including:

• Lead and enquiry form data: up to 24 months from last meaningful interaction.
• Operational logs and technical metadata: typically up to 12 months.
• Tool report records: retained according to operational and service settings, then deleted or anonymised.
• Longer retention where required for legal, regulatory, dispute, or audit reasons.

9. Your Rights

Subject to applicable law, you may have rights to:

• Request access to your personal data.
• Request correction of inaccurate data.
• Request erasure in specific circumstances.
• Object to or restrict certain processing.
• Request portability of data you provided to us.
• Withdraw consent where processing is consent-based.

To exercise rights, contact hello@qwestyon.com.

10. Complaints

If you have concerns about how we handle personal data, contact us first and we will do our best to resolve them.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.

11. Security

We use reasonable technical and organisational measures to protect personal data. No internet-based transmission or storage system is completely secure, but we take security controls, abuse prevention, and access restrictions seriously.

12. Children

The Site and services are intended for business users aged 18 or over and are not directed to children. If you believe a child has provided personal data to us, contact us and we will investigate and remove data where appropriate.

13. Policy Updates

We may update this Privacy Policy from time to time to reflect legal, technical, or operational changes. The updated version will be posted on this page with a revised date.

14. Contact

Privacy queries and rights requests: hello@qwestyon.com

Site terms are available in our Terms of Use.