Privacy Policy

1. Who we are (data controller)

Qmunitas (UK) is a UK business (UK Registered VAT number 477213972).

Qmunitas is the data controller of:

• personal data you send us by email (including the brochure-site contact form, which opens a mailbox draft);
• limited hosting logs generated to operate this website;
• consented App Feedback that reaches our UK operations host; and
• for Imagine, the limited fact of routing a user-consented description to the named provider you choose.

Qmunitas is not the recipient of your Quantॐ vault by default. Vault contents (I / Me / My / Mine, Soul, photos, wellbeing, organisation records) stay on your device unless a separate, withdrawable grant sends a defined payload (App Feedback or an Imagine description).

No Data Protection Officer is appointed for this notice. Privacy contact: inquiry@qmunitas.org only.

2. What this notice covers

This notice explains how we handle personal data when you visit the Qmunitas brochure website, email us, use the contact form, or install or use Quantॐ (a personal on-device product for adults).

The Promise states our principles; this notice sets out the practical detail required under the UK GDPR and the Data Protection Act 2018.

Quantॐ is not a banking, payments, or password-wallet product. We do not collect bank logins, payment-card data, transaction histories, or government identification numbers through the site or the app.

3. Data we collect and sources

Brochure website

This website does not store contact-form fields on a server. The form opens a draft email on your device addressed to us. We only receive what you choose to send from your own mailbox.

Depending on how you interact with us, we may process:

• Identity and contact data — name, email address, and any organisation details you include in an email to us. Source: you, via your mailbox.
• Enquiry data — the content of your message and the service area you mention. Source: you.
• Technical data — limited server and security logs that may include IP address, browser type, date/time, and pages requested. Source: your browser / hosting platform.

We do not deliberately collect special category data through this site. Please do not send sensitive personal information in an enquiry unless it is necessary and you are content for us to process it to respond.

This brochure site does not offer visitor accounts or public sign-in. We do not invite Google, X, or any other identity provider. Any leftover technical route from the publishing platform redirects home and is not indexed. If an account is created in error, email us and we will delete any data we hold.

Typefaces are self-hosted on this domain; we do not load fonts from Google or other third-party font CDNs.

Quantॐ — on-device vault (not sent to Qmunitas by default)

You may store, on your device: I / Me / My / Mine records, Soul material, imported photos, wellbeing entries, and organisation / customer-number / date records in Mine. Mine is not a password vault. We do not collect bank credentials.

Source: you, on the device. Qmunitas does not receive vault contents by default. Bundled catalog Soul avatars are synthetic / example assets in the app binary, not your photos.

Photos you import go into the on-device vault. They are not sold, not used for tracking, and are not sent to Qmunitas. Imagine does not send portrait bytes. A granted Imagine request is description-only.

This local vault is you storing your own information on your own device. It is not a Qmunitas collection.

App Feedback (optional)

Only after an App Feedback grant (withdrawable; no sticky silent re-grant). Testers submit suggestions via App Feedback, not the Us tab.

Nothing is sent to ops without that grant. The verified path is a consented POST to /v1/feedback that fails closed if the wrap cannot be applied.

Payload (not anonymous): idea / suggestion text; a device install key (not a hardware identifier, and not Soul / I / Me / My / Mine) so ideas can be rate-limited and found again; optionally a catalog Soul example path only. No vault portraits. No Imagine prompts on this channel.

Source: you, after grant. Destination: https://ops.qmunitas.co.uk (Civo UK). App Store / TestFlight builds use that host after consent. Internal development and simulator builds used by Qmunitas refuse the production ops host.

Imagine (optional)

A description only is sent to a named host you consent to. You pick the provider in the consent UI. You use your own API key. We do not operate a Grok (or other) account for you, and we do not use a phantom signed-in session.

Named Imagine hosts in this notice:

• xAI — api.x.ai
• OpenAI — api.openai.com
• Gemini — generativelanguage.googleapis.com

Anthropic does not generate Imagine pictures and is not a silent Grok remap. It is not listed as an Imagine host.

Portrait bytes are not sent. Catalog / bundled assets are not sendable portraits.

Source: the description you type, after grant. Recipient: the provider you named, under that provider's terms. Qmunitas does not keep a server copy of the prompt.

4. How we use personal data

• Reply to enquiries and arrange conversations.
• Operate and secure the brochure site.
• Meet legal / tax / accounting duties if we work together.
• Operate consented App Feedback (receive ideas, rate-limit, find the same install's ideas again).
• Route a consented Imagine description to the named provider you chose — we do not use that description to run our own models.
• Honour rights requests and keep the platform technically working (strictly necessary hosting cookies / similar storage).

We do not use enquiry content, vault content, or App Feedback to train public AI models. An Imagine provider may process the consented description under that provider's terms, including any training or retention those terms allow. That is the provider's processing, not ours.

5. UK GDPR lawful bases

You may withdraw consent at any time (in-app where a grant exists, and/or by emailing us). Withdrawal does not affect processing already lawfully carried out.

6. How we share

We do not sell, rent, or trade personal data. We do not share personal data with third parties for their marketing or profiling.

"Never share for their own purposes" does not mean we operate without infrastructure. Providers act as processors on our instructions — they are not free to use your data as their own product.

Processor categories actually used. Named processors on request via inquiry@qmunitas.org:

• website hosting and application delivery;
• email and mailbox services;
• domain and DNS;
• Civo UK — consented App Feedback at ops.qmunitas.co.uk (Civo is processor; Qmunitas remains controller);
• the Imagine provider you chose (under that provider's terms for the description you send with your key).

A small platform credit on the brochure site may contact the hosting platform to check whether remixing is available. That request does not include enquiry content.

Imagine is you sending a consented description to a named third party. We do not send portrait bytes, vault contents, or App Feedback payloads to Imagine providers.

We do not use unnamed advertising networks, analytics suites, crash reporters, or financial-account aggregators.

7. Retention

• Enquiry emails — kept only as long as needed to respond and follow up, then deleted or anonymised, unless we enter a longer relationship. As a default, routine enquiry correspondence is reviewed for deletion within 24 months if no ongoing work has begun. The website contact form itself does not create a stored submission.
• Server and security logs — typically days to a few months, unless needed to investigate an incident.
• On-device vault — until you delete it, uninstall, or reset. We do not hold a cloud copy.
• App Feedback on ops — kept only as long as needed to handle the suggestion, then delete or anonymise.
• Imagine — retained by the chosen provider under that provider's policy. We do not keep a server copy of the prompt.
• We do not keep personal data "just in case".

8. Protection

• Vault at rest: AES-256-GCM with a device-bound key. The app, the vault, Soul avatars, and Imagine prompts are not quantum-safe and are not PQC-protected at rest.
• App Feedback in transit: TLS to https://ops.qmunitas.co.uk, with an ML-KEM-768 envelope and AES-256-GCM payload before data leaves the device. That PQC wrap applies to App Feedback leaving the device — not to vault storage. The POST fails closed if the wrap cannot be applied.
• Brochure site: served over HTTPS.
• Reset / erase: you can wipe the on-device vault. Imagine grants are withdrawn on reset. Copies already sent to an Imagine provider cannot be recalled from that provider.

We do not claim ISO, SOC, or similar certifications in this notice.

9. International transfers

• App Feedback at ops.qmunitas.co.uk (Civo UK): UK processing.
• Brochure-site infrastructure: some providers may process data outside the UK. Where that happens, we rely on appropriate safeguards recognised under UK data protection law (for example the UK International Data Transfer Agreement / Addendum, or an adequacy decision), or we will explain the basis if you ask.
• Imagine: xAI, OpenAI, and Gemini may process in the United States or other third countries. That is an international transfer you consent to by choosing that host. Check the provider's own notice. Ask inquiry@qmunitas.org if you need the current UK transfer basis we rely on.

10. Your rights and the ICO

Under UK GDPR you may have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase data (in certain circumstances)
• Restrict or object to processing
• Data portability (where applicable)
• Withdraw consent at any time
• Lodge a complaint with the UK Information Commissioner's Office (ICO): https://ico.org.uk/

On-device vault: use in-app delete / reset / uninstall. We cannot access or export a cloud copy we do not hold.

Imagine: we cannot require a third-party provider to erase a description already sent; use that provider's own rights process as well.

To exercise any right against Qmunitas, email inquiry@qmunitas.org. We will respond without undue delay and within one month, subject to identity verification where appropriate.

11. Children

The brochure site is aimed at organisations and professionals.

Quantॐ is a personal on-device product for adults. It is not directed at children.

We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it promptly. If a child used the app, wipe or uninstall on the device as well.

12. Cookies and similar technologies

This marketing site is designed to be light. Typefaces are self-hosted; we do not load fonts from Google or other third-party font CDNs, and we do not run third-party advertising trackers. Hosting and delivery infrastructure may set strictly necessary technical cookies or similar storage for security, load balancing, or session integrity.

A small platform credit on the site may contact the hosting platform to check whether remixing is available. That request does not include the content of any enquiry you write.

If we introduce non-essential cookies (for example analytics), we will update this notice and provide a clear choice before any non-essential cookies are set.

Quantॐ does not use third-party advertising trackers. We do not declare tracking or selling to Apple. Nutrition labels must match this notice: vault data on-device; photos not sold or tracked and not treated as collected-for-Apple-nutrition as sent off-device; Imagine is an optional consented description to a named third party; App Feedback is optional consented processing on UK ops.

13. Court orders and government demands

We will not volunteer your data for fishing expeditions. In the unlikely event that we are ever compelled by a valid court order, we will disclose only what the law strictly requires, seek to narrow the demand, and notify you unless legally prohibited. That is a legal duty, not a marketing guarantee.

14. Changes to this notice

We may update this page to reflect legal or operational changes. The date at the top of this notice shows the latest revision. Material changes will be reflected here; continued use of the site after updates constitutes notice of the revised text for website visitors. App users can always review this page at https://qmunitas.org/privacy. Ongoing clients will be informed of material changes that affect them where required.

15. How to contact us

Privacy enquiries: inquiry@qmunitas.org

Qmunitas — Human First. Private means never shared for others' purposes. Ever.

In the true Spirit of solidarity. Mixing Quantum + Communitas at the intersection of Science · Technology · Economics · Philosophy · Psychology · Ecology.

Summary table

By-product table