Privacy Policy

We collect the following categories of data:

• Account data: Name, email address, organization name, role
• Client documents: Passports, employment letters, bank statements, and other documents you upload for form filling
• Extracted data: Passport numbers, names, dates of birth, addresses, employment history, and other information extracted by our AI from your documents
• Usage data: Pages visited, features used, form fills completed
• Billing data: Managed by Stripe — we do not store credit card numbers

Immigration-specific data: We understand that immigration documents contain sensitive personal information including passport numbers, visa status, family details, and personal history. This data receives the highest level of protection in our system.

• Extracting data from your documents using AI
• Filling forms with extracted data
• Managing your account, organization, and subscriptions
• Sending service emails (verification, password reset, invoices)
• Improving our AI extraction accuracy (anonymized, aggregated data only)

We use the following third-party services to operate QkFill:

• Supabase (database, authentication, storage) — hosted on AWS US regions
• Stripe (payment processing) — PCI DSS compliant
• Azure Document Intelligence (document OCR and extraction)
• Google Gemini (AI classification and understanding)
• Vercel (frontend hosting)
• Railway (backend API hosting)
• Sentry (error tracking — no PII captured)

Each provider processes only the minimum data necessary. Full sub-processor list available in our DPA.

Your data is retained while your account is active. After account deletion:

• Personal data is anonymized within 30 days
• Billing records are retained for 7 years (legal requirement)
• Audit logs are retained in anonymized form

Under PIPEDA (Canada), GDPR (EU), and CCPA (California), you have the right to:

• Access: Request a copy of all your data
• Correction: Update inaccurate information
• Deletion: Delete your account and all associated data
• Export: Download your data in a portable format (JSON)
• Objection: Object to processing of your data

Exercise these rights through your account settings or by contacting support@qkfill.com.

QkFill uses only essential cookies required for authentication and session management. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. No cookie consent banner is required because we only use strictly necessary cookies.

Your data is processed and stored on servers in the United States (AWS US regions via Supabase). If you are located outside the US, your data is transferred to and processed in the US. We rely on standard contractual clauses and service provider agreements to ensure adequate data protection.

QkFill is not intended for use by individuals under 18 years of age. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us immediately.

We may update this policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email. The "Last updated" date at the top of this page indicates the latest revision.

For privacy inquiries, contact our Privacy Officer at support@qkfill.com or visit our contact page.