Privacy Policy

Last updated: 26 July 2026

This Privacy Policy explains how MazeWorks SLU collects, uses, stores, shares and protects personal data when individuals access or use the Qualma website, web application, mobile applications and related services.

In this Privacy Policy, "MazeWorks", "Qualma", "we", "us" and "our" refer to MazeWorks SLU. The "Service" means the Qualma website, applications, AI-powered features, communications and related products and services.

Qualma helps dog owners monitor, understand and manage separation anxiety and other behavioural challenges. Although much of the information entered into Qualma relates to a dog, that information may also constitute personal data when it is connected to an identifiable user, household, routine or account.

This Privacy Policy provides information about how we process personal data. Where processing requires consent, we request that consent separately. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

1. Data Controller

The data controller responsible for the processing of personal data through Qualma is:

MazeWorks SLU
Calle Francisco Campos 20
28002 Madrid
Spain

Website: qualma.tech

Privacy contact: legal@qualma.tech

Questions about this Privacy Policy or requests concerning personal data may be sent to legal@qualma.tech.

2. Scope of This Privacy Policy

This Privacy Policy applies to:

Visitors to the Qualma website.
Individuals who create or use a Qualma account.
Trial and paid subscribers.
Individuals who contact us through email, forms or customer support.
Newsletter and marketing subscribers.
Individuals whose technical or usage information is processed through permitted analytics technologies.

This Privacy Policy does not apply to websites, applications or services independently operated by third parties, even where Qualma links to them.

3. Age Requirements

Qualma is intended only for individuals who are at least 18 years old.

We do not knowingly permit children to create Qualma accounts or knowingly collect personal data directly from children. If we learn that a person under 18 has created an account or provided personal data, we will take reasonable steps to close the account and delete the information, unless retention is required by law.

A parent or legal guardian who believes that a child has provided information to Qualma should contact legal@qualma.tech.

4. How We Collect Personal Data

We collect personal data from the following sources:

Directly from you when you create an account, complete a dog profile, record a training session, write a journal entry, use an AI feature, purchase a subscription, subscribe to communications or contact us.
Automatically when you access or use the Service.
From Google when you choose Google Sign-In.
From Stripe when you purchase or manage a subscription.
From service providers that help us deliver, secure, measure and maintain the Service.

5. Personal Data We Collect

5.1 Account and Identity Information

When you register for or use Qualma, we may collect:

Your name.
Your email address.
Your account identifier.
Authentication identifiers.
Login and authentication records.
Account creation date.
Account status.
Subscription status.
Language and communication preferences.
Profile information you choose to provide.

Qualma may use passwordless authentication, email one-time codes, Google Sign-In or other secure authentication methods.

5.2 Google Sign-In Information

When you choose to register or sign in using Google, Google may provide Qualma with information that you authorise, such as:

Your name.
Your email address.
Your Google account identifier.
Your profile photograph, where available and authorised.

The information received depends on the permissions displayed during the Google authentication process.

Qualma does not receive or store your Google password.

5.3 Dog Profile Information

You may voluntarily provide information about your dog, including:

Name.
Photograph.
Breed or breed combination.
Age or date of birth.
Sex.
Weight.
Adoption or background information.
Behavioural history.
Separation-anxiety history.
Training history.
Training goals.
Environmental information.
Information concerning the dog's health or veterinary history.
Other notes you choose to add.

Information about an animal is not, by itself, personal data under the General Data Protection Regulation. However, it may become personal data when connected to an identifiable owner, household, routine, address, account or other personal information.

5.4 Training, Journal and Behavioural Information

When you record a training session, absence or behavioural observation, we may process:

The date and time of the session.
The duration of an absence or training exercise.
Training objectives.
Behavioural observations.
Separation-anxiety symptoms.
Departure and return observations.
Environmental conditions.
Location categories or zones selected by you.
Food, enrichment items, toys or equipment used.
Camera observations entered by you.
Your notes and journal entries.
Speech-to-text transcripts.
Progress measurements.
Ratings and outcome information.
Photographs or other content uploaded by you, where supported.

You control the information entered into Qualma. You should not include unnecessary personal information about another identifiable person.

5.5 AI Inputs and Outputs

When you use an AI-powered feature, we may process information that is relevant to the request, including:

Dog profile information.
Behavioural history.
Training records.
Journal entries.
Progress information.
Questions or instructions submitted to the AI feature.
Previous AI responses where conversational context is required.
Your feedback about an AI-generated response.

We use data-minimisation measures and seek to transmit only the information reasonably necessary to provide the requested AI functionality.

AI-generated responses may be stored within your Qualma account so that you can review your history and so that related features can operate correctly.

5.6 Payment and Subscription Information

Payments and subscriptions are processed through Stripe.

Stripe may collect information directly from you, including:

Payment-card or other payment-method information.
Billing name.
Billing address.
Email address.
Tax-related information.
Transaction information.
Device and fraud-prevention information.

MazeWorks does not receive or store complete payment-card numbers.

We may receive and retain limited payment and subscription information, including:

Stripe customer identifiers.
Stripe subscription identifiers.
Transaction identifiers.
Subscription plan.
Subscription status.
Payment status.
Subscription start, renewal and cancellation dates.
Payment-method type or card brand.
The final digits of a payment card.
Billing country.
Invoice, refund and payment-dispute information.

Where a subscription is purchased through an application store or another authorised platform, that platform may process payment information under its own privacy terms.

5.7 Communications and Customer Support

When you contact us, submit feedback or request support, we may collect:

Your name.
Your email address.
The content of your communication.
Support history.
Attachments you provide.
Technical information relevant to your request.
Information needed to investigate and resolve the matter.
Product feedback or satisfaction information.

5.8 Marketing Information

When you subscribe to a newsletter or consent to receive marketing communications, we may process:

Your email address.
Your name, where provided.
Your language preference.
The date, time and source of consent.
Communication preferences.
Delivery status.
Email opening and link-interaction information where tracking is enabled and legally permitted.
Unsubscribe and suppression records.

5.9 Technical, Security and Usage Information

When you access or use the Service, we may automatically collect:

IP address.
Device type.
Browser type and version.
Operating system.
Language and regional settings.
Referring website or campaign.
Pages and application areas visited.
Dates and times of access.
Session duration.
Login and authentication events.
Error, diagnostic and crash information.
Security events.
Cookie and similar-technology identifiers.
Approximate location inferred from an IP address.
Interactions such as clicks, scrolling and navigation paths, where analytics consent has been provided.

We do not intentionally collect precise geolocation unless a feature clearly requests access to it and you expressly authorise that access.

5.10 Sensitive Personal Data

Qualma is not designed to collect special categories of personal data about humans, such as information concerning:

Human health or medical conditions.
Racial or ethnic origin.
Religious or philosophical beliefs.
Political opinions.
Trade-union membership.
Genetic or biometric identification.
Sexual orientation or sex life.

Information about a dog's health is not human health data. However, free-text fields may allow users to enter information about themselves or other people. You should avoid submitting sensitive personal information that is not necessary to use Qualma.

If a future Qualma feature intentionally requires special-category personal data, we will provide additional information and identify an appropriate legal basis before beginning that processing.

6. Why We Process Personal Data and Our Legal Bases

We process personal data only where we have a valid legal basis.

6.1 Providing and Managing the Service

We process account, dog-profile, training, journal and technical information to:

Create and maintain your account.
Authenticate you.
Provide requested features.
Store and display dog profiles.
Store and display training and journal history.
Track progress.
Synchronise information between devices.
Manage trials and subscriptions.
Provide customer support.
Maintain the availability and functionality of the Service.

The legal basis is the performance of our contract with you or taking steps at your request before entering into a contract.

6.2 Providing AI-Powered Features

We process relevant profile, journal, behavioural and training information to generate summaries, observations, educational explanations and personalised guidance requested by you.

The legal basis is the performance of our contract with you because the processing is necessary to provide the AI-powered feature that you have chosen to use.

Where an AI feature is optional and not necessary for the core Service, we may rely on your consent.

6.3 Processing Payments and Subscriptions

We process subscription, billing and transaction information to:

Process purchases.
Activate subscriptions.
Manage renewals and cancellations.
Issue invoices.
Process refunds.
Address payment disputes.
Maintain accounting records.
Prevent payment fraud.
Comply with tax, accounting and commercial requirements.

The legal bases are the performance of our contract with you and compliance with legal obligations.

6.4 Sending Essential Service Communications

We use your contact information to send necessary communications, including:

Authentication codes.
Account-security alerts.
Subscription confirmations.
Payment and renewal notices.
Service availability notices.
Responses to support requests.
Material legal or privacy updates.

The legal bases are the performance of our contract, compliance with legal obligations and our legitimate interest in operating and protecting the Service.

These communications are not marketing communications and may continue even where you have unsubscribed from promotional emails.

6.5 Security, Fraud Prevention and Abuse Detection

We process authentication, technical and usage information to:

Protect user accounts.
Prevent unauthorised access.
Detect fraud, misuse and abuse.
Investigate security incidents.
Enforce our agreements.
Maintain security records and backups.
Protect users, MazeWorks and third parties.

The legal bases are our legitimate interests in protecting and operating the Service and, where applicable, compliance with legal obligations.

6.6 Product Improvement and Quality Assurance

We may analyse limited usage data, aggregated information or irreversibly anonymised information to:

Identify errors.
Improve usability and accessibility.
Understand feature performance.
Develop new functionality.
Evaluate the quality and safety of AI-generated responses.
Produce internal business statistics.

Where personal data is involved, the legal basis is our legitimate interest in maintaining and improving the Service, balanced against the rights and interests of users.

This legal basis does not authorise optional analytics cookies or session-recording technologies. Those technologies are used only with consent.

6.7 Analytics and Website Interaction Measurement

With your consent, we use analytics technologies to:

Measure website and application usage.
Understand navigation patterns.
Identify usability and technical problems.
Evaluate the effectiveness of content.
Generate heatmaps and aggregate interaction reports.
Review privacy-protected session recordings on permitted public pages.

The legal basis is consent.

Refusing or withdrawing analytics consent does not prevent you from accessing the core Service.

6.8 Marketing Communications

We send newsletters, product announcements and promotional communications only where you have provided consent or where another legal basis is expressly permitted by applicable law.

You may withdraw your consent at any time by using the unsubscribe link in the communication or contacting legal@qualma.tech.

6.9 Legal Compliance and Legal Claims

We may process and retain information where necessary to:

Comply with tax, accounting, consumer-protection and regulatory requirements.
Respond to valid requests from courts, regulators or public authorities.
Establish, exercise or defend legal claims.
Enforce our agreements.
Cooperate with lawful investigations.

The legal bases are compliance with legal obligations and our legitimate interest in protecting our legal rights.

7. Information Required to Provide the Service

Certain information is required to create and operate a Qualma account, including an email address and authentication information.

Payment information is required when purchasing a paid subscription.

Dog-profile fields, journal information and training records may be optional. Providing less information may limit the functionality, personalisation or usefulness of certain features.

Marketing consent and analytics consent are optional. Refusing them does not prevent you from using Qualma's essential functionality.

8. AI Processing and Google Gemini

Qualma uses the Google Gemini API to provide certain AI-powered features.

When you request an AI analysis or response, Qualma transmits the information necessary to process that request to Google. Depending on the feature, this may include:

Dog profile information.
Behavioural observations.
Training-session records.
Journal entries.
Progress information.
Your question or instructions.
Relevant previous conversational context.

Qualma does not intentionally send account passwords, complete payment-card details or unrelated personal information to Gemini.

Qualma uses Gemini through a billing-enabled paid API service. Under the terms applicable to paid Gemini services, Google does not use Qualma's prompts or generated responses to train or improve its general-purpose products or machine-learning models.

Google may temporarily retain prompts, contextual information and generated responses for safety, security, abuse detection and legal compliance. Under Google's current Gemini API policies, this information may be retained for up to 55 days. Content flagged by safety or abuse-detection systems may be reviewed by authorised Google personnel solely for policy enforcement, security and abuse-prevention purposes.

Qualma does not create or voluntarily share Gemini datasets with Google for model training or general product improvement.

AI-generated information:

Is produced automatically.
May contain errors, omissions or inappropriate assumptions.
Is provided for educational and informational purposes.
Does not constitute veterinary diagnosis or veterinary treatment.
Does not replace advice from a qualified veterinarian, veterinary behaviourist or other appropriately qualified professional.
May not be suitable for every dog or situation.
Should be evaluated in light of your knowledge of your dog and individual circumstances.

Qualma's recommendations are intended to support positive, confidence-building and evidence-informed approaches. They should not be used to justify punishment, intimidation, fear-based methods or aversive training techniques.

Qualma does not use AI to make decisions that produce legal effects or similarly significant effects concerning users.

We may use aggregated or irreversibly anonymised information to evaluate the performance of Qualma's AI features and improve the Service. We do not use identifiable account information to train third-party general-purpose AI models.

9. Cookies and Similar Technologies

Qualma uses cookies and similar technologies.

9.1 Strictly Necessary Technologies

Strictly necessary technologies may be used without optional consent where they are required to:

Authenticate users.
Maintain sessions.
Protect account security.
Remember privacy preferences.
Process subscriptions.
Prevent fraud.
Provide functionality expressly requested by the user.

Blocking these technologies may prevent parts of the Service from functioning correctly.

9.2 Optional Analytics Technologies

With your consent, we may use:

Google Analytics.
Google Tag Manager.
Hotjar.
Similar measurement technologies identified in our Cookie Policy.

These technologies may process:

Online identifiers.
IP-derived information.
Device and browser information.
Pages visited.
Dates and times of access.
Session duration.
Clicks.
Scrolling.
Navigation paths.
Other website-interaction events.

Optional analytics technologies are not activated before you provide the relevant consent.

9.3 Google Analytics

Google Analytics helps us understand how visitors use the website and Service.

Google Analytics is activated only after analytics consent has been provided. Depending on our configuration and your device settings, Google may process online identifiers, device information, approximate location and information about your interactions with the Service.

Google Analytics user-level and event-level data is retained for no longer than 14 months under our configured retention settings.

9.4 Google Tag Manager

Google Tag Manager helps us manage website technologies and consent-dependent tags.

Google Tag Manager is configured so that analytics and other non-essential technologies are not activated until the user has provided the relevant consent.

Google Tag Manager is not used by Qualma as an independent profiling or advertising system.

9.5 Hotjar

Hotjar helps us understand how visitors interact with public areas of the Qualma website through analytics, heatmaps and privacy-protected session recordings.

Hotjar is activated only after analytics consent has been provided.

Qualma configures Hotjar to suppress user-entered information and excludes authenticated or private pages containing:

Account information.
Dog profiles.
Journal entries.
Training records.
AI conversations or results.
Support communications.
Payment or subscription information.

We do not intentionally use Hotjar to capture passwords, complete payment details, private journal content or confidential form information.

Hotjar heatmap and recording information may be retained for up to 365 days from the date of collection, depending on the applicable Hotjar plan and deletion settings.

9.6 Managing Cookie Consent

You may:

Accept optional cookies.
Reject optional cookies.
Select permitted cookie categories.
Change or withdraw your preferences through the Cookie Settings control.

The options to accept and reject optional cookies are presented at the same level and with comparable visibility.

Withdrawing consent does not affect processing that lawfully occurred before withdrawal.

More information about individual cookies, providers, purposes and durations is available in the Qualma Cookie Policy.

10. Service Providers and Other Recipients

We use selected service providers to operate and support Qualma. They may process personal data only for the relevant purposes and subject to applicable contractual and legal safeguards.

10.1 Supabase

Supabase provides:

Database infrastructure.
Authentication infrastructure.
File storage.
Backend services.
Security and technical infrastructure.

Depending on the feature, Supabase may process:

Account information.
Authentication identifiers.
Dog profiles.
Journal entries.
Training records.
Uploaded content.
Technical and security data.

Supabase generally processes Qualma customer data as a processor acting on MazeWorks' instructions. Supabase may process limited service-usage information as an independent controller for purposes identified in its own privacy documentation.

Qualma data is stored and primarily processed in the geographical region selected for the Supabase project. Limited processing or access may occur in other locations through Supabase operations and authorised subprocessors.

10.2 Stripe

Stripe provides payment, billing and subscription services.

Stripe may act:

As a processor acting on MazeWorks' instructions for certain payment services.
As an independent controller for activities such as fraud prevention, security, regulatory compliance, payment-network requirements and improvement of Stripe's services.

Stripe processes payment information under its own privacy documentation and contractual obligations.

10.3 Resend

Resend provides email-delivery infrastructure for communications such as:

Authentication emails.
Account notifications.
Subscription communications.
Customer-support messages.
Newsletters and marketing communications where authorised.

Resend may process:

Recipient email addresses.
Sender and recipient metadata.
Email content.
Delivery status.
Bounce and complaint information.
Opening and link-interaction information where tracking is enabled.
Technical and security information associated with email delivery.

Resend processes this information as a service provider acting on MazeWorks' instructions, subject to its applicable data-processing terms.

10.4 Google

We use Google services for:

Google Sign-In.
Google Analytics.
Google Tag Manager.
Google Gemini AI processing.
Related infrastructure, security and technical services.

The information processed depends on the Google service being used, the permissions granted and the user's consent choices.

10.5 Hotjar

Hotjar provides consent-based analytics, heatmaps and privacy-protected session-recording functionality for permitted public areas of the website.

Hotjar may process online identifiers, device information, approximate location and permitted website-interaction information.

10.6 Professional Advisers

We may disclose personal data to accountants, lawyers, auditors, insurers and other professional advisers where reasonably necessary and subject to confidentiality obligations.

10.7 Courts and Public Authorities

We may disclose information to courts, regulators, law-enforcement authorities or other public bodies where:

Required by law.
Required by a valid legal process.
Necessary to protect rights or safety.
Necessary to investigate fraud, abuse or security incidents.

10.8 Corporate Transactions

If MazeWorks is involved in a merger, acquisition, financing, restructuring, sale of assets or similar corporate transaction, relevant personal data may be disclosed to advisers and potential transaction parties under appropriate confidentiality and data-protection safeguards.

We do not sell or rent personal data.

We do not share personal data with third parties for their independent behavioural advertising purposes.

11. International Data Transfers

MazeWorks is established in Spain. Some service providers or their subprocessors may process personal data outside Spain or outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, we rely on an appropriate legal transfer mechanism, which may include:

An adequacy decision adopted by the European Commission.
The EU–US Data Privacy Framework where the recipient is validly certified.
European Commission Standard Contractual Clauses.
Supplementary contractual, organisational and technical safeguards.
Another lawful transfer mechanism recognised under applicable data-protection law.

The use of a provider with operations outside the European Economic Area does not necessarily mean that all Qualma data is stored outside the European Economic Area. Storage and processing locations depend on the provider, service configuration and subprocessors involved.

You may request further information about applicable transfer safeguards by contacting legal@qualma.tech.

12. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, including providing the Service, complying with legal obligations, resolving disputes, preventing fraud and protecting legal rights.

12.1 Account, Dog Profile, Journal and Training Information

Account information and user-created content are generally retained while your account remains active.

When an account is deleted, we delete or irreversibly anonymise personal data that is no longer required from our active systems, except where retention is necessary for legal, accounting, security, fraud-prevention or dispute-resolution purposes.

Residual encrypted copies may remain in backups until those backups are securely overwritten or deleted through the ordinary backup lifecycle. Backup copies are not used for ordinary business purposes.

12.2 AI Inputs and Outputs

AI inputs and outputs stored within your Qualma account are retained for the same period as the associated account, journal or training information.

Google may retain Gemini API prompts, contextual information and responses for up to 55 days for abuse prevention, safety, security and legal compliance.

Qualma does not save Gemini logs into datasets shared with Google for model training.

12.3 Payment and Accounting Records

Invoices, transactions, refunds and related accounting documentation may be retained for at least six years from the relevant accounting entry, or for a longer period where required by Spanish tax, commercial or accounting law.

Complete payment-card information is retained by Stripe according to Stripe's legal and operational requirements and is not stored by MazeWorks.

12.4 Customer-Support Communications

Support communications are retained for as long as necessary to resolve the request and for any additional period reasonably required to:

Document the resolution.
Protect legal rights.
Investigate a security issue.
Comply with applicable limitation periods or legal requirements.

12.5 Security and Technical Information

Security, access and technical logs are retained for the period necessary to:

Maintain the security of the Service.
Detect fraud and abuse.
Investigate incidents.
Resolve technical problems.
Establish or defend legal claims.

Information no longer required for these purposes is deleted or aggregated.

12.6 Analytics Information

Where analytics consent has been provided:

Google Analytics user-level and event-level data is retained for no longer than 14 months.
Hotjar recordings and heatmap information may be retained for up to 365 days from collection.
Aggregated reports that no longer identify an individual may be retained for longer.

12.7 Marketing Information

Marketing contact information is retained until you withdraw consent or unsubscribe.

After an unsubscribe request, we may retain a minimal suppression record, such as your email address and the date of withdrawal, to ensure that further marketing is not sent and to demonstrate compliance.

12.8 Consent and Compliance Records

Records concerning consent, withdrawal, privacy requests and compliance actions may be retained for as long as necessary to demonstrate compliance and address potential legal claims.

12.9 Anonymised Information

Information that has been irreversibly anonymised so that no individual can reasonably be identified may be retained indefinitely and used for:

Statistics.
Research.
Product improvement.
Feature evaluation.
Development of Qualma functionality.

We will not attempt to reidentify irreversibly anonymised information.

13. Account Deletion

You may request account deletion through available account settings or by contacting legal@qualma.tech.

When account deletion is completed, we delete or irreversibly anonymise information that is no longer necessary, including, where applicable:

Your name.
Your email address.
Authentication identifiers.
Dog profile photographs.
Dog profiles.
Training-session records.
Journal entries.
AI conversation history.
Other directly identifying account content.

We may retain limited information where required for:

Tax and accounting obligations.
Payment disputes.
Fraud and security investigations.
Establishing, exercising or defending legal claims.
Maintaining an unsubscribe or suppression record.
Responding to a privacy request.
Compliance with another legal obligation.

Deletion from active systems may not immediately remove encrypted backup copies. Those copies are removed or overwritten through the applicable secure backup lifecycle.

Deleting a Qualma account does not automatically delete information independently retained by Stripe, Google or another provider where that provider acts as an independent controller. Requests concerning information independently controlled by a third party may need to be submitted directly to that provider.

14. Security

We maintain technical and organisational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure, misuse or unauthorised access.

Depending on the system and processing involved, these measures may include:

Encryption during transmission.
Encryption at rest where supported.
Authentication controls.
Role-based access controls.
Database access policies.
Secure development practices.
Logging and security monitoring.
Backup and recovery procedures.
Vendor assessments.
Data-processing agreements.
Incident-investigation and response procedures.

No internet-based service can guarantee absolute security.

You are responsible for protecting access to your email account, devices and authentication methods. You should notify us promptly if you suspect unauthorised access to your Qualma account.

Where a personal-data breach creates a legal notification obligation, we will notify the relevant supervisory authority and affected individuals as required by applicable law.

15. Your Data-Protection Rights

Subject to applicable law, you may have the right to:

Obtain confirmation of whether we process your personal data.
Access your personal data.
Correct inaccurate or incomplete personal data.
Request deletion of personal data.
Restrict processing.
Object to processing based on legitimate interests.
Receive eligible personal data in a structured, commonly used and machine-readable format.
Request transmission of eligible personal data to another controller where technically feasible.
Withdraw consent at any time.
Object to direct marketing.
Request not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
Lodge a complaint with a data-protection supervisory authority.

Requests may be submitted to legal@qualma.tech.

We may request information reasonably necessary to verify your identity before completing a request.

We will normally respond within one month. This period may be extended where permitted by law because of the complexity or number of requests. We will inform you if an extension is required.

Exercising these rights is generally free of charge. We may charge a reasonable fee or decline to act where a request is manifestly unfounded or excessive, as permitted by law.

You may lodge a complaint with your local supervisory authority. MazeWorks' principal supervisory authority is:

Agencia Española de Protección de Datos — AEPD
Calle Jorge Juan 6
28001 Madrid
Spain

We encourage you to contact us first so that we have an opportunity to investigate and address your concern.

16. Marketing Communications

Marketing communications are optional.

You may unsubscribe by:

Using the unsubscribe link included in the communication.
Changing available communication preferences.
Contacting legal@qualma.tech.

Unsubscribing from marketing does not prevent us from sending essential communications concerning:

Authentication.
Account security.
Subscriptions.
Payments.
Legal updates.
Service operation.
Customer-support requests.

We do not sell personal data or use Qualma account information for third-party cross-context behavioural advertising.

17. Third-Party Websites and Services

Qualma may contain links to websites, applications or services operated by third parties.

This Privacy Policy does not govern independent third-party services. You should review the relevant third party's privacy information before providing personal data or using that service.

18. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

Changes to the Service.
New features.
New service providers.
Changes to our processing activities.
Legal or regulatory developments.
Security or operational changes.

The updated version will be published through the Service with a revised "Last updated" date.

Where a change is material, we may provide additional notice through the Service or by email.

Where a new processing activity requires consent, we will request that consent separately. Continued use of Qualma will not be treated as consent where applicable law requires a specific affirmative choice.

19. Contact Us

For privacy enquiries, GDPR requests, account-deletion requests or questions about this Privacy Policy, contact: