GDPR
Last updated: May 18, 2026
Qubold is committed to compliance with the EU General Data Protection Regulation (GDPR). This page explains how we meet GDPR requirements and how you can exercise your rights as a data subject.
Your rights under GDPR
You can request a copy of all personal data we hold about you at any time.
You can ask us to correct inaccurate personal data or complete incomplete data.
You can request deletion of your personal data ('right to be forgotten') subject to our legal obligations.
You can ask us to pause processing of your data while a dispute is resolved.
You can receive a machine-readable export of your personal data.
You can object to processing of your data for direct marketing or legitimate interests.
Who is the data controller?
Qubold is the data controller for personal data collected through the Qubold platform. Contact: info@qubold.com.
What data we process
We process: account information (name, email, password hash); billing information (payment method details, processed by Razorpay — we do not store raw card numbers); content you upload (photos, files); usage data (events, clients, storage metrics); and technical data (IP address, browser type, session tokens).
Legal basis for processing
We process your personal data on the following legal bases: • Contract: to provide the Qubold service you have subscribed to. • Legitimate interest: to prevent fraud, ensure security, and improve the service. • Legal obligation: to comply with applicable laws. • Consent: where you have explicitly opted in (e.g., marketing emails).
International data transfers
Qubold uses infrastructure providers that may process data outside the EU/EEA (including Cloudflare R2, Vercel, and Resend). Where we transfer data, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent safeguards.
Sub-processors
We use the following key sub-processors: • Cloudflare R2 — photo and file storage • Vercel — application hosting • Resend — transactional email delivery • Razorpay — payment processing • Neon / Supabase — database hosting
Data retention
Active account data is retained while your account is open. On account closure, personal data is deleted within 90 days. Anonymised aggregate data may be retained indefinitely.
How to exercise your rights
Email info@qubold.com with the subject "GDPR Request". We will respond within 30 days. We may request identity verification before fulfilling your request.
Right to lodge a complaint
If you believe we are processing your data unlawfully, you have the right to lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, or your EU member state's DPA).