Privacy policy

1. Who is responsible

The controller is quebi GmbH, Geitau 22, 83735 Bayrischzell, Germany. You can reach us at hi@quebi.de. Further company details are in the imprint.

2. What we process and why

• Account data — your name, email address and a hash of your password, plus second-factor data if you set it up (authenticator secret, recovery codes). Used to create and secure your account. Legal basis: performance of the contract, Art. 6(1)(b) GDPR.
• Sign-up confirmation — when you sign up, we email a link to the address you gave and keep your name and a hash of your password with a hash of that link until it is opened or expires after 24 hours; the account is created only when it is opened. Expired links are deleted with the next sign-up. Legal basis: Art. 6(1)(b) GDPR.
• Content — the files and photos you upload, their names, folders, albums, tags and edits, and metadata read from them (such as capture date, dimensions and location, if a photo contains it). Used to store it and show it back to you and to the people you share it with. Legal basis: Art. 6(1)(b) GDPR.
• Sessions and security log — when you sign in we store a session record with your browser's user-agent string, which ends after 30 days or when you sign out. We also log security-relevant events on your account — signing in and out, confirming your identity again, changing or resetting your password, changing your email address, turning the authenticator app on or off, new or used recovery codes, passkeys added, app passwords, backup tokens and API tokens created or revoked, each app you allow to connect to your account, each backup run, and a sign-in paused or stopped after too many wrong passwords or two-factor codes — with their time and user-agent string, but no IP address, so that you can see them under Settings › Security. The cookies this needs are listed in section 4. Legal basis: Art. 6(1)(b) GDPR.
• Connection data — to deliver a page, our hosting provider necessarily processes your IP address and the request. We do not store IP addresses in our database. To limit how often an account can be created from one network, we keep a keyed hash of the address (for IPv6, of its /64 network) and a count of sign-up attempts for the current hour, and likewise a keyed hash of each email address the sign-up form sends to and a count of those emails, so that the form cannot be used to flood someone's inbox, and — to limit password and two-factor guessing — a keyed hash of the network, of the email address signed in with and of the account's identifier, with a count of wrong passwords and wrong two-factor codes for the current hour; the first attempt after that hour discards them, and backups age out on the schedule below. The same kind of hash and hourly count limits guesses at the password of a share link or a published site and posts to public forms (booking a slot, answering an invitation, signing a PDF, reporting a site, writing through the contact form). The address cannot be recovered from the hash. Legal basis: our legitimate interest in operating a secure service, Art. 6(1)(f) GDPR.
• Billing data — if you pay for storage: the name and address you give us, a VAT ID if you provide one, the invoices we issue, and the details of the bank transfers you send (payer name, IBAN, amount, reference), which our bank receives. Used to invoice you and to match your payments. Kept for ten years under German tax and commercial law. Legal basis: Art. 6(1)(b) and (c) GDPR. If we check a VAT ID, we have it confirmed, together with the name and address you gave, by the German Federal Central Tax Office (Bundeszentralamt für Steuern, BZSt) as § 18e of the German VAT Act provides; the BZSt asks the tax authority of the member state concerned through the EU's VAT Information Exchange System (VIES). They receive the VAT ID, the name and the address, and nothing else. We keep their answer as our proof of the check.
• Email we send you — the link that confirms your address when you sign up, a link to reset your password when you ask for one, a link to confirm a new address when you change it and a notice of the change to the old one, invitations to an organisation, notification emails about what you have not read in the app, and, if you pay for storage, a notice of each invoice, a reminder before it falls due, a notice if your account is locked for an unpaid invoice and when it is unlocked, and the confirmations of your order, a cancellation or a withdrawal. A mail provider delivers them and processes the address and the message for that purpose. An invoice email carries the amount, the date and how to pay, never the invoice itself, which stays in your account. A notification email names who did what and the title of what it concerns, never a comment's text. It comes as one summary a day unless you choose otherwise; change it or switch it off under Settings, Notifications, or with the link in every such email. Legal basis: Art. 6(1)(b) GDPR. The invitations we email to the guests of your calendar events who have no account are described in section 3.
• Correspondence — if you write to us, we use your message to answer it. A message sent through the contact form is kept with the name, address and topic you give and the language the form was in, read by the people who answer for quebi, and deleted a year after it was answered (or a year after it arrived, if it needed no answer). Legal basis: Art. 6(1)(b) or (f) GDPR, and Art. 6(1)(c) GDPR with Art. 11 and 12 DSA for a message to our point of contact under that Act.
• Support and administration — the people who run quebi have an administration console. In it they see your account's details: your name and email address, when you signed up and whether the address is confirmed, whether you pay and the state of your invoices, how much you store in each app (totals only, never the names or content of your files), the organisations you belong to and your role in them, your active sessions and your security log, whether two-factor authentication is on, and the names of your app passwords and tokens. They use it to answer you, to keep the service secure and to enforce our terms: they can suspend an account or an organisation, sign an account out everywhere, reset its two-factor authentication or require a new password, confirm its email address, start an erasure you asked us for, and transfer an organisation's ownership or add or remove a member at its request. Each such action is recorded with who did it and why, and an action on your account appears in its security log. Legal basis: Art. 6(1)(b) GDPR, and our legitimate interest in operating a secure service, Art. 6(1)(f) GDPR.

We use no analytics, no tracking, no advertising and no third-party cookies, we do not sell data, and we make no automated decisions about you within the meaning of Art. 22 GDPR.

3. If someone else gave us your details

People who use quebi cloud can bring in people who have no account with us. What we then hold about you came from them (Art. 14 GDPR). For content they keep with us — their calendar, their documents, their organisation — they are the controller and we process it on their behalf; ask them first. This is what is held:

• Invited to an organisation — your email address, the role you were offered and who invited you. We email you the invitation, through the mail provider in section 6. It can be accepted for 14 days (an invitation link the organisation shares itself: up to 30) and is deleted when you accept or decline it, when it is withdrawn, with the organisation, or 7 days after it expired unanswered. The organisation's audit log records that it was sent to your address (section 7).
• Invited to a board, document, calendar or other item — your email address, the role and who invited you. We send no email; the person who invited you tells you. Kept until you accept or decline, the invitation is withdrawn or the item is deleted, and for at most 90 days.
• Booking a slot on someone's booking page — the name, email address and note you enter. They go into the owner's calendar as an event with you as a guest, and the owner is notified. We send you no email. Cancelling marks the booking as cancelled and you as declined. The booking is kept until the owner deletes the booking page or their account, and the calendar event with your details until the owner deletes it.
• Guest of a calendar event — the email address and name the organiser enters, and the answer and comment you give through your reply link. If the organiser added you in quebi's own event form, we email you the invitation, an update when the event changes and a notice if it is cancelled or you are taken off it, through the mail provider in section 6: the event's title, time and place, the organiser's name and address, and your reply link — never the event's description or the other guests' addresses. We email at most 50 guests per event and send at most 200 such emails a day for one organiser. Guests added by an import or a calendar app get no email from us. Kept until the organiser removes you, the event is deleted (and its 30 days in the bin have passed), or their account is deleted.
• Signing or filling in a PDF, using a share link or a published site — what you type there: the name you sign with or a reason for declining, a name or note left on a shared gallery, the fields of a site's form, a contact address on a report about a site. Kept with the PDF, the link or the site, and a site's form entries for the period in section 7.
• Adding files through a folder link — the files you send, which become the folder owner's files, stored and counted as theirs; the name and email address you may give (both optional), or your account if you are signed in; and when you sent each file. The owner sees all of it and is told files arrived. The record of who sent what is kept with the link and deleted with it; the files stay until their owner deletes them. To see whether a link lets you in, quebi reads your session if you are signed in — only to match the link's rules.

Our legal basis for holding these details is the inviting person's legitimate interest, and ours, in reaching you and in their invitation working (Art. 6(1)(f) GDPR). You can object (section 8), and you have the other rights in section 8 towards us and towards them.

4. Cookies and storage on your device

We set only our own cookies, each needed for something you asked for or holding a choice you made, so none needs your consent (§ 25(2) no. 2 TDDDG). None tracks you, and none belongs to anyone else:

__quebi_session

Keeps you signed in. Holds an opaque session identifier that points at a session record; removed when you sign out. Lifetime: 30 days. Sent to: quebi cloud.

__quebi_mfa

Remembers, between the password and the second-factor step, that the password was correct. Grants nothing on its own. Lifetime: 10 minutes. Sent to: quebi cloud.

__quebi_sudo

Remembers that you just confirmed your identity again, so a change to your account's security does not ask twice. Removed when you sign out. Lifetime: 10 minutes. Sent to: quebi cloud.

__quebi_share

Remembers which password-protected share links you opened in this browser, by their ids. Lifetime: 2 hours. Sent to: share links (/s/) only.

__quebi_site

Remembers which password-protected published sites, or parts of them, you opened in this browser. Lifetime: 12 hours. Sent to: the published site's own domain only.

__quebi_demo

Remembers that you entered the shared password of a demo deployment. Set only where such a gate is switched on. Lifetime: 7 days. Sent to: quebi cloud.

quebi_dbi

Makes sure the pages you open in the seconds after you save a change show that change. Holds no information about you or the change. Lifetime: 10 seconds. Sent to: quebi cloud.

quebi_lang

Remembers the language you chose for the interface. Holds a language code such as “de” and nothing else. Lifetime: 1 year. Sent to: quebi cloud.

The app also keeps data in your browser, never sent to anyone but us, so that it works quickly and without a connection (legal basis: Art. 6(1)(b) GDPR and § 25(2) no. 2 TDDDG):

• An offline store (IndexedDB), one per account, of at most 50 MB: copies of documents you opened recently or chose to keep offline, the state of documents you edit together with others, unsaved work such as drawings and query history, and changes waiting to be sent while you are offline.
• A service worker and its caches: the app's own code and the empty pages it opens offline. Never your pages or files.
• Local storage: which account the offline store belongs to; unsaved drafts of code files, with their contents, and which code files you had open; and display preferences in Drive, Docs and Slides and your upload settings.
• Session storage, which the browser empties when the tab closes: a photo look you copied, and the link to a presentation's remote control.

When you sign out or delete your account, the app deletes the offline store, the caches and the service worker itself, and asks the browser to clear everything else quebi cloud stored on the device (the Clear-Site-Data header). Browsers that do not follow that header — Safari before version 17 among them — keep the local storage above, code drafts included, until you clear the site's data in the browser. If you never sign out and your session simply expires, all of it stays on the device until you next sign out or clear it there. On a computer others use, sign out.

5. Who can read your content

Your content is encrypted in transit, but it is not end-to-end encrypted: our systems can read it, because they must in order to show thumbnails, search and sort. We access it only where it is needed to run the service, to fix a fault you report, or where the law obliges us to.

Our administration console does not open your content: it shows the account details listed in section 2, and has no way to see your account as you see it.

6. Who receives data

These providers process data on our behalf under a data processing agreement (Art. 28 GDPR) — the same list as the annex of our data processing agreement:

• Bunny Magic Containers and Edge Scripting — BunnyWay d.o.o., Slovenia. The application itself.
• Bunny CDN — BunnyWay d.o.o., Slovenia. Delivery.
• Bunny Magic Containers — BunnyWay d.o.o., Slovenia. Editing together, live.
• Bunny Database — BunnyWay d.o.o., Slovenia. Account records, folders, photo metadata.
• Bunny Storage, EU regions — BunnyWay d.o.o., Slovenia. Your files and photos.
• Bunny Storage — BunnyWay d.o.o., Slovenia. JavaScript, stylesheets and the typeface.
• Lettermint — Lettermint B.V., Netherlands. Transactional email.

quebi cloud runs on infrastructure of BunnyWay d.o.o., Slovenia: every request, every record and every file. Lettermint B.V., Netherlands, delivers the emails we send, such as the link that confirms your address when you sign up or a notification you have not read; it receives the recipient address and the message, and nothing else from your account.

Payments you make arrive at our bank, Olinda SAS (Qonto), France. The bank is not a processor: it handles the transfer as a controller in its own right, under its own banking and anti-money-laundering obligations, and sees the payer, the amount and the reference — nothing else from your account. When the owner of a published site connects a domain of their own, we look up one DNS record of that domain through the public DNS4EU resolver of Whalebone s.r.o., Czech Republic, to check that the domain is theirs; it receives the domain name and nothing else, as with any other DNS lookup.

Data is stored in the European Union and is not transferred to countries outside the EU/EEA. Anyone you share a link with can see what the link shares. We disclose data to authorities only where we are legally required to.

7. How long we keep it

We keep your data for as long as you have an account. Files you move to the trash stay there until you empty it or delete them from it. When you delete your account (Settings › Delete this account), your data is removed from the live service. Copies in our backups are not removed early, because backups are kept on storage locked against deletion so that no attacker, and no mistake, can destroy the last good copy. They expire on their own schedule, at the latest:

Live database and storage

Deleted when you delete the account.

Daily backups

Kept until the backup expires, at most 30 days.

Monthly backups

Kept until the backup expires, at most 12 months.

Backups taken before a software update

Kept until 24 further updates have been deployed.

Backup copies of files and photos

Kept until the copy expires, at most 12 months after the file left the live storage.

Some records about what happened in your account are kept for a set time, or for as long as the thing they belong to:

Security log

90 days; all of it is deleted with the account.

Notifications

Read ones for 90 days, unread ones for a year.

Versions of documents, spreadsheets, slides, PDFs, code, drawings, notes and wiki pages

Every saved version for 24 hours, then one a day for 30 days, then one a week, at most 100. Versions you named are kept until you delete them. A spreadsheet's per-cell history: 90 days.

Activity on Tasks cards and calendar events

As long as the card or event exists.

Chat messages

Until their author deletes them, or the room ends with its last member.

Organisation and wiki audit logs

Append-only, as long as the organisation or wiki space exists. They name who did what, including the addresses invitations went to.

Bin

Calendar: 30 days. Drive and the apps whose items live in it: until you empty the bin.

Entries sent through a published site's form

30, 90, 180 or 365 days, as the site's owner chose — 180 unless they changed it.

Record of what our support did to an account or organisation

Three years, also after the account is deleted: it is the evidence of how the account was treated. It names the account's address, what was done and why.

When you delete your account, what you contributed to other people's work stays with them: comments and replies on their documents, spreadsheets, slides, PDFs, notes, code, drawings and wiki pages, the versions and edit history of those items, and cards you created on a shared board stay, without your name. Chat messages you sent are emptied — the others see that a message was there, not what it said. The audit logs of organisations and of wiki spaces are append-only and keep your name as it was written, with what you did, until the organisation or space is deleted: they are the record its other members rely on, which Art. 17(3) GDPR allows us to keep. The deletion screen says this before you confirm.

Backups are only used to recover from a loss, never to restore a deleted account, and nothing new is written to them for an account that no longer exists. Where the law requires us to keep records for longer (for example invoices, under German tax law), we keep only those records, for the required period.

8. Your rights

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15);
• have it corrected (Art. 16) or deleted (Art. 17);
• restrict its processing (Art. 18);
• receive it in a portable format (Art. 20);

Right to object (Art. 21 GDPR). Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR) — the abuse limits in section 2 and the information about invited people in section 3 — you have the right to object at any time, on grounds relating to your particular situation. We then stop, unless we can show compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. Write to hi@quebi.de.

You can download your files and delete your account yourself in the product. For anything else, including an access request while an account is suspended for non-payment, write to hi@quebi.de. You also have the right to lodge a complaint with a supervisory authority, for example the one responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

9. Do you have to provide data?

A name, an email address and a password are needed to create an account; without them we cannot provide the service. Everything else is up to you.

10. Changes

We update this policy when what we do with data changes, and the date at the top says when that last happened. If a change affects you materially, we will tell you before it takes effect.