Privacy policy

Version: 2026-10-draft

The French version of this policy is the reference version. This English version is a translation provided for convenience.

This policy explains which personal data Quorumind Cloud (app.quorumind.com) and the quorumind.com website process, why, with whom, for how long, and how to exercise your rights.

1. Controller

QUORUMIND, 23 rue des Frères Bonie, 33000 Bordeaux, France, SIRET 821 041 431 00023. Contact: hello@quorumind.com.

We have not appointed a data protection officer; write to the address above with any question.

Special case: if you use the service for professional purposes and put personal data of other people into it (customers, employees, partners), you are the controller of that data and we act on your behalf, as a processor. The data processing agreement then applies.

2. Data we process

We do not ask for any sensitive data. Do not put into your debates personal data you do not need.

3. Why, and on what legal basis

We do no advertising, no profiling and sell no data. No decision with legal effects on you is made by fully automated means. We send no newsletter; if that changes, we will ask for your consent.

4. Who sees your data

4.1 At Quorumind

Only the publisher has access to the back-office. It shows accounts, workspaces, payments and the costs of debates; it does not show the content of debates, except those their author shared with a link. Every action on an account is written to an audit log with its reason.

4.2 Members of your workspaces

Members of a workspace see the name, e-mail and role of the other members. They also see the debates started in the workspace (title, content, author's name and e-mail), except those their author marked private. Admins and owners can change or delete the workspace's shared debates.

4.3 People you share with

If you share a debate with a link, you choose what the link shows: the client deliverable alone (recommendation, options, risks, roadmap, open questions and the note for the client, without the transcript, the requirements sheet, the budget or the documents added), or the full debate (requirements sheet, debate and verdict, without the costs or the documents added). A link expires after 7 or 30 days, or never if you choose so, and can be protected by a password. If you publish a debate in the gallery, everyone can read it. You can stop sharing at any time.

4.3a Agencies' clients

An agency can send its client a questionnaire through a link that needs no account. The link expires after 7 or 30 days and can be protected by a password. The client's answers and comments are stored with the session and deleted with it. For these data, the agency is the controller and Quorumind acts as a processor (see the data processing agreement). To limit abuse, the IP address of the person answering is used in memory, without being stored.

4.3b Third-party documents you have reviewed

In Audit mode, you submit a document received from a provider (quote, statement of work, architecture document). It may contain that provider's personal and commercial data. It is handled like other attached documents: sent to the AI model providers for the review, kept with the session and deleted with it. Make sure you are allowed to share it. A "client deliverable" share link shows the findings with short excerpts quoted from the document.

4.4 Our processors

For some processing (fraud prevention, regulatory obligations), Stripe acts as a separate controller, under its own privacy policy. Likewise, Google and GitHub process your sign-in on their side under their own policies.

We may also pass data to the authorities when the law requires it.

4.4a Services your workspace connects

If an owner or admin of your workspace connects a Slack or Microsoft Teams channel, Quorumind posts to it when a debate that is not private waits for answers, finishes or fails: the project name (or the first 80 characters of the idea), the debate's status and a link that requires signing in. These services are chosen by the customer, under its own agreement with Slack or Microsoft, and may process these data outside the European Union. Private debates are never posted. The channel address is kept until it is removed or the workspace is deleted.

Review reminders for a decision e-mail the author and the approver the session title, the note and the review condition; they are also posted to the workspace's channel, except for a private debate. An approval request is e-mailed to the session's author.

The Jira, Linear and GitHub exports are plain files you download. GitHub issues are created by your own gh tool, on your machine: Quorumind sends nothing to these services and keeps no credential for them.

4.5 Tools hosted by the publisher itself

Two tools are run by the publisher on its own servers, at OVH in France. They are not third-party processors:

• Umami (insights.russeblanc.com), cookie-free audience measure: page views, referring site, browser, country derived from the IP address. The IP address is not stored. No cookies, no cross-site tracking, no profile.
• Sentry (observe.russeblanc.com), error monitoring for the app: technical data about the error (stack trace, browser, page, request path). No account identifier, IP address or request body is sent.

5. Transfers outside the European Union

The service and its data are hosted in France. Debate content is sent to the AI model providers, in the United States; payments go through Stripe, which may transfer data to the United States; signing in with Google or GitHub involves these US companies.

"European models only" mode: a debate (or a whole workspace, if its admins decide so) can be limited to models from Mistral AI, a French company, called through their endpoint in Europe, or to local models. Requests then go through OpenRouter, a US company: through its usual address, they may pass through servers outside the European Union before reaching Mistral AI; through its European regional address, when it is used, debate content is processed in Europe, but account and billing metadata may remain stored in the United States. Each report says which path was used. The workspace setting keeps who changed it and when.

These transfers rely on the adequacy decision of 10 July 2023 (EU-US Data Privacy Framework) for certified companies, and otherwise on the European Commission's Standard Contractual Clauses (decision 2021/914). [To be confirmed for each provider.] You can ask us for a copy of these safeguards.

6. What is sent to the AI providers

1. What is sent: for each role of the debate, the content the model needs: Quorumind's instructions, your project description, your answers, the requirements sheet, the workspace's organisation profile (unless you set it aside for this debate), the documents or texts you added, and the proposals and critiques of earlier steps. The profile's day rates are commercial information: they are used to compute costs, which Quorumind does itself. When the recommendation is updated (revision), the new elements (the client's answers, facts added by the agency) are sent too, so the arbiter can rule again. Earlier recommendations stay in the session.
2. What is not sent: your e-mail address, your name, your account identifier and your payment data, unless you write them yourself into the debate content. Web research: for Standard and Deep debates, Quorumind checks on the web the facts the debate depends on (prices, versions, rules). Only short, generic queries are sent to the search engine (16 words at most, without the project's or organisation's name, without personal data); never your documents, answers or profile. "European models only" debates do no research.
3. You choose the models for each role when you start, and therefore which providers receive the content.
4. Personal data masking: this option, off by default, is ticked when starting a debate. It replaces e-mail addresses, phone numbers, card numbers, IBANs, IP addresses and secret keys before anything is sent to the models. It does not detect names, postal addresses or other details that can identify a person: avoid writing them.
5. Providers' terms: Quorumind uses its own business API accounts with each provider. According to the policies these providers publish for their APIs, data sent to them is not used by default to train their models, and may be kept for a limited time, in particular to detect abuse. [To be confirmed for each provider, with the applicable retention period.]
6. Quorumind does not use the content of your debates to train models.

7. Retention periods

8. Your rights

You have the following rights over your data:

• access: get a copy of your data;
• rectification: correct your name on the Account page; for the e-mail address, write to us;
• erasure: delete a debate, or your whole account from the Account page;
• portability: the "Export my data" button on the Account page downloads a JSON file with your account, your sign-in methods, your acceptances of the terms, your workspaces, the billing history of the workspaces you manage, and all your debates;
• objection to processing based on our legitimate interest;
• restriction of processing;
• instructions on what happens to your data after your death.

To exercise a right, write to hello@quorumind.com. We answer within one month. We may ask you to confirm your identity, for example by writing from your account's address.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (the French data protection authority): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

9. Security

• The service is hosted in France, at OVH, and is only reachable over HTTPS.
• The session cookie cannot be read by scripts, is HTTPS-only and is protected against being sent from other sites. Its identifier changes every 15 minutes of activity and at every sign-in.
• Sign-in links and session identifiers are stored only as a hash. A sign-in link works only once.
• Signing in with Google or GitHub uses the OAuth 2 protocol with PKCE and "state" protections.
• Requests coming from other sites are refused; the number of sign-in attempts is limited.
• API keys and secrets are stored separately, outside the code and the databases.
• Access to the back-office is restricted to the publisher, logged, and does not show the content of debates.

In the event of a data breach that puts you at risk, we notify the CNIL within 72 hours of becoming aware of it and, if the risk is high, we tell you.

10. Minors

The service is for adults and professionals. It is not intended for people under 18. If we learn that an account belongs to a minor, we delete it.

11. Changes

We may change this policy. For a significant change, we tell you by e-mail and in the app before it takes effect.

12. Contact

hello@quorumind.com — QUORUMIND, 23 rue des Frères Bonie, 33000 Bordeaux, France.