Privacy Policy

1. Introduction

Qimsi ("we," "us," or "our") is operated by Twenty6 Red, Inc. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at qimsi.com and app.qimsi.com (the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

2. Information We Collect

Account Information

When you register, we collect your name, email address, company name, and password. If you sign in via Google or Microsoft, we receive your name and email from those providers.

Integration Data

When you connect third-party services (Jira, Tempo, Confluence, Slack, Salesforce, Google Workspace, QuickBooks, Office 365, Google Sheets, Microsoft Teams), we access and cache data from those services on your behalf. This includes:

• Project and issue data from Jira
• Time tracking entries from Tempo
• Page titles, metadata and the first part of each page's text from Confluence spaces an administrator grants
• Channel and message metadata from Slack
• Account and opportunity data from Salesforce
• Email metrics, calendar events, and file metadata from Google Workspace
• Transaction data from QuickBooks
• Meeting and email metrics from Office 365
• Spreadsheet metadata from Google Sheets

We only access data necessary to provide the Service. From email we sync counts and other metrics, not message subjects or bodies. Two features read content when you use them:

• When you ask the assistant about a client, it can search the connected Gmail account for messages with that client's contacts and read those messages to answer you. They are not stored.
• To match a sales rep's writing style in outreach drafts, we may read a sample of that rep's emails logged in Salesforce, with your permission. Only a short style guide is kept. The emails are not stored.

Bank and Card Data (TidySubs)

If you choose to connect a personal card or bank account to TidySubs, the Service's recurring-spend feature, we use Plaid Inc. ("Plaid") to read it. You sign in to your financial institution in Plaid's window; we never receive your bank username or password. Through Plaid we receive the account's name and last four digits and its transactions: date, amount, description, merchant name and category. Access is read-only; the Service cannot move money.

• We use this data only to find recurring charges and subscriptions and show them to you.
• It is visible only to the user who connected the account, not to other users in your organization, administrators included.
• It is never sold, never shared with other customers or third parties, and never sent to an AI provider.
• The access token Plaid issues for the connection is stored encrypted.
• When you disconnect an account, we ask Plaid to revoke the connection and delete its transactions from the Service.

Plaid's handling of your data is described in the Plaid End User Privacy Policy.

Usage Data

We collect information about how you interact with the Service, including pages visited, features used, and actions taken. This data is used to improve the Service.

AI-Generated Data

AI models from Anthropic (Claude) process your connected data to generate insights, drafts, predictions, and workflow outputs. An administrator can choose Google (Gemini) or OpenAI instead for some features. These outputs are stored within your organization's account and are not shared with other customers.

3. How We Use Your Information

• To provide, maintain, and improve the Service
• To generate AI-powered insights and recommendations
• To send you operational notifications (digests, alerts, briefings) that you configure
• To provide customer support
• To detect and prevent security incidents
• To comply with legal obligations

4. Data Sharing and Disclosure

We do not sell your personal information. We may share data with:

• AI Providers: We send AI providers the data a feature needs to do its job. That can include names, company and deal details, and, for the features described above, message text. We use Anthropic (Claude) by default, and Google (Gemini) or OpenAI where an administrator selects them. Each provider processes this data under its own terms and privacy policy.
• Infrastructure Providers: We use AWS (hosting), Neon (database), and Resend (email delivery) to operate the Service.
• Plaid: If you connect a bank or card account, Plaid connects to your financial institution on our behalf, as described above. Bank and card data is not sent to AI providers.
• Legal Requirements: We may disclose information if required by law, subpoena, or legal process.

5. Data Security

We implement industry-standard security measures including:

• Encryption in transit (TLS/HTTPS) and at rest
• Multi-tenant data isolation — each organization's data is logically separated
• Audit logging of data access and changes
• OAuth 2.0 for third-party integrations (no passwords stored for connected services)
• bcrypt password hashing for credential-based authentication
• API key authentication with SHA-256 hashing

6. Data Retention

We retain your account data and cached integration data for as long as your account is active. Cached data from third-party integrations is refreshed on each sync and may be deleted when you disconnect an integration. You may request deletion of your account and all associated data at any time by contacting us.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Data portability — receive your data in a structured format
• Withdraw consent at any time

To exercise these rights, contact us at privacy@qimsi.com or rick.enrico@slidegenius.com.

8. Third-Party Services

The Service integrates with third-party platforms. When you connect these services, their respective privacy policies also apply. We encourage you to review the privacy policies of Atlassian, Slack, Salesforce, Google, Microsoft, Intuit (QuickBooks), Tempo, and Plaid before connecting.

9. Cookies

We use essential cookies for authentication (session tokens). We do not use advertising or tracking cookies. No third-party analytics scripts are loaded.

10. Children's Privacy

The Service is not intended for individuals under 16 years of age. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date.

12. Contact Us

If you have questions about this Privacy Policy, contact us at: