Privacy Policy
Effective date: 1 June 2026 Last updated: 1 June 2026
This Privacy Policy explains how Quill ("we", "us", "Quill", "the Service") collects and uses Personal Data when you use our knowledge-agent platform.
Drafted to comply with the Egyptian Personal Data Protection Law (PDPL) Law 151/2020 and its Executive Regulations.
1. Who we are
| Field | Value |
|---|---|
| Controller | Quill |
| Contact | hello@quill.ai |
| Mailing address | — |
2. What Quill is
Quill is a software platform that lets organisations build AI agents grounded in their own knowledge bases (SOPs, manuals, FAQs, policies). Tenants upload documents; their users chat or talk with an agent that retrieves and quotes from those documents.
We are the processor of Personal Data you submit to your tenant. Your tenant's organisation is the controller for that data and is responsible for its lawful collection and use.
For data we collect directly from you to run the platform itself (your Quill account, billing, support tickets), we are the controller — and this policy covers that data.
3. What we collect
3.1 Account data
- Name, email, hashed password
- Phone (optional)
- 2FA device identifiers
3.2 Conversation data
- Text of messages with AI agents
- Voice audio (transcribed in real time, raw audio discarded at session end)
- Files you upload to a knowledge base
- Citation metadata
3.3 Operational
- IP address (truncated to /24 for analytics; full only in security events)
- Browser user-agent, locale
- Pages visited, errors, performance traces
- Cost events per OpenAI request (token counts, no request body)
3.4 Not collected
- Precise geolocation
- Biometric data
- Third-party advertising IDs
4. Lawful basis
| Purpose | Basis |
|---|---|
| Deliver the platform | Contract |
| Improve the platform | Legitimate interest |
| Transactional email | Contract |
| Fraud / abuse detection | Legitimate interest |
| Marketing (opt-in only) | Consent |
| Legal compliance | Legal obligation |
We do not sell Personal Data.
5. Sub-processors
| Vendor | Purpose | Region |
|---|---|---|
| OpenAI | LLM, STT, embeddings | USA |
| ElevenLabs | TTS | USA |
| LiveKit | Real-time audio rooms | Global edge |
| Cloudflare | DNS, CDN, Turnstile | Global edge |
| AWS | Backup storage | EU / Egypt region preferred |
| GoDaddy | SMTP transactional email | USA |
Live list maintained at https://quill.geddo.online/legal/sub-processors.
Cross-border transfers rely on the data subject's explicit consent and/or contractual safeguards as required by Egyptian PDPL Article 14.
6. Retention
| Data | Period |
|---|---|
| Account record | Active + 30 days post-deletion |
| Conversation transcripts | 12 months → anonymised |
| Uploaded files | Until you delete OR 12 months post-account-deletion |
| Voice audio | Discarded at session end |
| Auth logs | 13 months |
| Billing records | 5 years (Egyptian commercial code) |
| Backups | 14 days rolling |
7. Your PDPL rights
You can: be informed, access, correct, request erasure, withdraw consent, restrict processing, port your data, and complain to the Egyptian Personal Data Protection Center (PDPC).
Email hello@quill.ai or use the in-app delete flow. We respond within 30 days.
8. Security
- TLS 1.2+ in transit, AES-256 at rest
- Tenant data isolation at the query layer (EF global filters)
- PBKDF2 password hashing (ASP.NET Identity v3)
- 2FA available, mandatory for admins
- Daily encrypted backups, 14-day retention
- Breach notification to you + Egyptian PDPC within 72 hours when high risk
9. Cookies
Strictly necessary + first-party analytics only. No third-party trackers. Full list: Cookie Notice.
10. Children
Not directed to children under 13. If you become aware of a child's account, contact us and we will delete it.
11. Changes
Material changes will be emailed and shown in-app 30 days before the new "Effective date".
12. Contact
hello@quill.ai · Complaints to the Egyptian Personal Data Protection Center (PDPC) at mcit.gov.eg.