Privacy Policy

Last Updated: 3 February 2026
Effective Date: 25 January 2026
Version: 1.2

1. Introduction

Welcome to QTRBK ("we," "our," or "us"). This Privacy Policy explains how QTRBK Pty Ltd, ABN 76 684 810 142, located at 149 Weston Street, Brunswick Melbourne VIC 3057, Australia, collects, uses, discloses, and protects your personal information when you use the QTRBK application ("App"), our website at https://www.qtrbk.com, and related services (collectively, the "Services").

QTRBK is a HubSpot integration application that provides data synchronization and integration capabilities between HubSpot and other business systems. Our Services are designed to help businesses streamline their workflows by connecting HubSpot CRM data with other platforms.

By using our Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use our Services.

2. Information We Collect

We collect several types of information to provide and improve our Services:

2.1 Information You Provide Directly

Account Information: When you create an account, we collect your name, email address, company name, and password.
Billing Information: If you purchase a subscription, we collect payment information through our payment processor (Airwallex). We do not store complete credit card numbers on our servers.
Communications: When you contact us for support or other inquiries, we collect the information you provide in those communications.
Preferences: Your settings, configurations, and preferences for using the Services.

2.2 HubSpot Data

When you connect your HubSpot account to QTRBK, we access and process data from your HubSpot portal, which may include:

HubSpot User Information: Names, email addresses, roles, permissions, and other user details stored in HubSpot.
Company Data: Company names, HubSpot users, and other company-related data.
Business Analytics: Query analytics data and reporting endpoints for measuring goal progress and achievement.
Engagement Data: Meetings, meeting records, call logs, and notes.

The specific HubSpot data we access depends on the permissions you grant and the features you use within QTRBK.

2.3 Automatically Collected Information

Usage Data: Information about how you interact with our Services, including features used, actions taken, timestamps, and frequency of use.
Device Information: Browser type, operating system, device type, screen resolution, and unique device identifiers.
Log Data: IP addresses, access times, pages viewed, referring URLs, and other standard log information.
Cookies and Similar Technologies: Information collected through cookies, pixels, and similar tracking technologies (see Section 10).

2.4 Information from Third Parties

HubSpot: Data from your connected HubSpot account as described above.
Authentication Providers: If you sign in using a third-party service (e.g., Google), we receive basic profile information from that provider.

2.5 Calendar Integration Data

When you connect your calendar service to QTRBK for meeting scheduling and RSVP tracking, we access and process calendar data as follows:

Google Calendar Integration

If you connect your Google Calendar, we access the following data through the Google Calendar API:

Calendar Events: Event titles, descriptions, start and end times, locations, and time zones
Attendee Information: Names, email addresses, and RSVP status of meeting attendees
Calendar Metadata: Calendar names, descriptions, and default time zones
Meeting Details: Video conferencing links (Google Meet), meeting rooms, and recurring event patterns

How We Use Google Calendar Data:

We use Google Calendar data solely for:

Creating and managing quarterly planning session events
Tracking meeting attendance and RSVP responses
Synchronising session schedules with your calendar
Sending meeting invitations and updates on your behalf
Providing session reminders and notifications

We do not:

Access calendar data beyond what is necessary for QTRBK functionality
Store complete copies of your calendar—we only store references to QTRBK-created events
Share your calendar data with third parties except as necessary to provide the service
Use calendar data for advertising, profiling, or purposes unrelated to QTRBK features

Google API Services User Data Policy Compliance:

QTRBK's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We only request access to calendar data necessary for QTRBK's session scheduling and RSVP tracking features
We do not use Google Calendar data for advertising purposes
We do not sell or transfer Google user data to third parties, data brokers, or information resellers
We do not use Google user data for purposes unrelated to providing or improving user-facing features in QTRBK
We limit our use of Google user data to providing and improving the quarterly planning and meeting management features you requested

Microsoft Outlook Calendar Integration

If you connect your Microsoft Outlook calendar, we access the following data through the Microsoft Graph API:

Calendar Events: Event titles, descriptions, start and end times, locations, and time zones
Attendee Information: Names, email addresses, and RSVP status of meeting attendees
Calendar Metadata: Calendar names, descriptions, and default time zones
Meeting Details: Online meeting links (Teams/Skype), meeting rooms, and recurring event patterns

How We Use Microsoft Calendar Data:

We use Microsoft Calendar data solely for:

Creating and managing quarterly planning session events
Tracking meeting attendance and RSVP responses
Synchronising session schedules with your calendar
Sending meeting invitations and updates on your behalf
Providing session reminders and notifications

We do not:

Access calendar data beyond what is necessary for QTRBK functionality
Store complete copies of your calendar—we only store references to QTRBK-created events
Share your calendar data with third parties except as necessary to provide the service
Use calendar data for advertising, profiling, or purposes unrelated to QTRBK features

Microsoft Graph API Compliance:

QTRBK's use and transfer of information received from Microsoft Graph APIs adheres to the Microsoft APIs Terms of Use and Microsoft Privacy Statement. Specifically:

We only request access to calendar data necessary for QTRBK's session scheduling and RSVP tracking features
We do not use Microsoft Calendar data for advertising purposes
We do not sell or transfer Microsoft user data to third parties, data brokers, or information resellers
We do not use Microsoft user data for purposes unrelated to providing or improving user-facing features in QTRBK
We limit our use of Microsoft user data to providing and improving the quarterly planning and meeting management features you requested

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Providing and Maintaining Services

To create and manage your account
To sync and integrate data between HubSpot and connected systems
To process transactions and send related information
To provide customer support and respond to inquiries

3.2 Improving Our Services

To analyze usage patterns and optimize user experience
To develop new features and functionality
To conduct research and analysis
To monitor and prevent technical issues
To power AI features that provide insights and recommendations (see our AI Policy for details)

3.3 Communications

To send service-related notices and updates
To respond to your requests and inquiries
To send marketing communications (with your consent where required)
To provide information about new features or services

3.4 Security and Compliance

To detect, prevent, and address fraud and security issues
To enforce our terms of service and other policies
To comply with legal obligations

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process your personal data based on the following legal grounds:

4.1 Performance of Contract

Processing necessary to fulfill our contractual obligations to you, including:

Providing the Services you requested
Managing your account
Processing payments

4.2 Legitimate Interests

Processing necessary for our legitimate business interests, including:

Improving and developing our Services
Marketing our Services (where not requiring consent)
Preventing fraud and ensuring security
Understanding how our Services are used

4.3 Consent

Where you have provided explicit consent, including:

Marketing communications
Non-essential cookies and tracking
Processing special categories of data (if applicable)

4.4 Legal Obligation

Processing necessary to comply with legal requirements, including:

Tax and accounting obligations
Responding to lawful requests from authorities
Compliance with applicable data protection laws

5. Data Sharing and Third Parties

We do not sell your personal information. We share your information only in the following circumstances:

5.1 Service Providers

We use trusted third-party service providers to help us operate our Services:

Provider	Purpose	Data Shared
Amazon Web Services (AWS)	Cloud hosting and infrastructure	All data processed by our Services
Airwallex	Payment processing	Billing information, transaction data
Google Analytics	Website and application analytics	Usage data, device information, anonymized identifiers
HubSpot	CRM platform and data sync	CRM data as authorized through OAuth permissions
Sentry	Error tracking and monitoring	Technical logs, error reports, device information

Each service provider is contractually obligated to protect your data and use it only for the purposes we specify.

5.2 HubSpot

As a HubSpot integration, we necessarily interact with HubSpot's platform. Your use of HubSpot is governed by HubSpot's own privacy policy and terms of service.

5.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or uses of your personal information.

5.4 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, government agencies).

5.5 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

6. HubSpot Integration

6.1 OAuth and Permissions

QTRBK connects to your HubSpot account using OAuth 2.0 authentication. When you authorize the connection, you grant QTRBK specific permissions (scopes) to access your HubSpot data. You can review and revoke these permissions at any time through your HubSpot account settings.

6.2 Data Access

We only access the HubSpot data necessary to provide the features you use. We follow the principle of least privilege, requesting only the permissions required for our Services to function.

6.3 Data Synchronization

Data synchronized from HubSpot may be:

Processed in real-time for immediate operations
Temporarily cached to improve performance
Stored for the duration necessary to provide our Services

6.4 HubSpot Marketplace Compliance

QTRBK complies with HubSpot's App Marketplace requirements, including:

Adherence to HubSpot's API terms of use
Compliance with HubSpot's data handling guidelines
Regular security assessments and updates

7. Data Storage and Security

7.1 Data Storage

Your data is stored on secure cloud infrastructure provided by Amazon Web Services (AWS). Our primary data centers are located in Europe, with redundancy measures in place for disaster recovery.

7.2 Security Measures

We implement appropriate technical and organizational measures to protect your data, including:

Encryption: Data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
Access Controls: Role-based access controls and multi-factor authentication for system access
Monitoring: Continuous security monitoring and logging
Vulnerability Management: Regular security assessments and penetration testing
Incident Response: Documented procedures for responding to security incidents

7.3 Data Breach Notification

In the event of a data breach affecting your personal information, we will notify you and relevant supervisory authorities as required by applicable law, typically within 72 hours of becoming aware of the breach.

8. Data Retention

8.1 Retention Period

We retain your personal information for as long as your account is active or as needed to provide you with our Services. Specifically:

Account Data: Retained while your account is active and for 90 days after account closure to allow for reactivation
HubSpot Data: Processed in real-time and cached temporarily; not retained beyond what is necessary for synchronization
Usage Analytics: Retained in aggregated, anonymized form for up to 24 months
Billing Records: Retained for 7 years to comply with tax and accounting requirements
Support Communications: Retained for 7 years after resolution

8.2 Account Deletion

When you request account deletion:

Your account is deactivated immediately
Personal data is deleted within 30 days
Backup copies are purged within 90 days
Anonymized, aggregated data may be retained for analytical purposes

8.3 HubSpot Disconnection

When you disconnect your HubSpot account:

Active sync operations are stopped immediately
Cached HubSpot data is deleted within 24 hours
Historical sync logs are retained for 30 days for troubleshooting purposes

9. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information:

9.1 Rights for All Users

Access: Request information about the personal data we hold about you
Correction: Request correction of inaccurate personal data
Deletion: Request deletion of your personal data
Data Portability: Request a copy of your data in a portable format
Withdraw Consent: Withdraw previously given consent at any time

9.2 European Economic Area (EEA), UK, and Switzerland (GDPR)

In addition to the rights above, you have the right to:

Object: Object to processing based on legitimate interests
Restriction: Request restriction of processing
Lodge a Complaint: File a complaint with your local data protection authority

9.3 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

Know: Request disclosure of the categories and specific pieces of personal information collected
Delete: Request deletion of personal information
Correct: Request correction of inaccurate personal information
Opt-Out: Opt out of the sale or sharing of personal information (Note: We do not sell personal information)
Non-Discrimination: Not receive discriminatory treatment for exercising your rights

Categories of Personal Information Collected:

Identifiers (name, email, IP address)
Commercial information (transaction history)
Internet activity (usage data, browsing history on our site)
Professional information (company, job title)

Categories of Sources:

Directly from you
Automatically through our Services
From HubSpot (with your authorization)

9.4 Other Jurisdictions

We comply with applicable privacy laws in all jurisdictions where we operate, including but not limited to:

Brazil (LGPD)
Canada (PIPEDA)
Australia (Privacy Act)

9.5 Exercising Your Rights

To exercise any of these rights, please contact us at:

Email: support@qtrbk.com
Address: 149 Weston Street, Brunswick Melbourne VIC 3057, Australia

We will respond to your request within 7 days (or as required by applicable law). We may need to verify your identity before processing your request.

10. Cookies and Tracking Technologies

10.1 Types of Cookies We Use

Essential Cookies

Required for the Services to function properly
Cannot be disabled without affecting functionality
Include session management and security cookies

Analytics Cookies

Help us understand how users interact with our Services
Provided by Google Analytics
Can be disabled through cookie preferences

10.2 Managing Cookies

You can manage your cookie preferences through:

Our cookie consent banner (for first-time visitors)
Your browser settings
The cookie preferences link in our website footer

10.3 Do Not Track

We currently do not respond to "Do Not Track" browser signals. However, you can control tracking through cookie settings and opt-out mechanisms provided by our analytics partners.

10.4 Third-Party Tracking

Google Analytics: You can opt out using the Google Analytics Opt-out Browser Add-on.

11. International Data Transfers

11.1 Cross-Border Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your jurisdiction.

11.2 Transfer Safeguards

When we transfer personal data from the EEA, UK, or Switzerland, we ensure appropriate safeguards are in place, including:

Standard Contractual Clauses (SCCs): EU-approved contractual terms with our service providers
Data Processing Agreements: Binding agreements ensuring adequate protection
Adequacy Decisions: Transfers to countries recognized as providing adequate protection

11.3 Your Consent

By using our Services, you consent to the transfer of your information to our facilities and to the facilities of third parties with whom we share it as described in this Privacy Policy.

12. Children's Privacy

Our Services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete such information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@qtrbk.com.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.

13.1 Notification of Changes

Material Changes: We will notify you by email and/or prominent notice on our website at least 30 days before significant changes take effect
Minor Changes: Updates will be posted on this page with an updated "Last Updated" date

13.2 Your Continued Use

Your continued use of our Services after any changes to this Privacy Policy constitutes your acceptance of the updated policy.

13.3 Review History

We maintain a history of material changes to this Privacy Policy, available upon request.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

QTRBK Pty Ltd

Privacy Inquiries:

Email: support@qtrbk.com
Address: 149 Weston Street, Brunswick Melbourne VIC 3057, Australia

Data Protection Officer (if applicable):

Email: support@qtrbk.com

We aim to respond to all inquiries within 7 days.

Appendix A: HubSpot Data Access Scopes

The following table describes the HubSpot permissions QTRBK may request:

Required Scopes for QTRBK

Scope	Purpose
`crm.objects.users.read`	View HubSpot user properties and details for team member synchronisation
`crm.objects.owners.read`	View CRM owner details for mapping Quick Assist and/or Ticket ownership to team members
`tickets`	Create, read, and manage support tickets through HubSpot's ticketing system
`content`	Access landing pages, email templates, and campaign data for marketing insights
`business-intelligence`	Query analytics data and reporting endpoints for performance dashboards
`oauth`	Maintain secure OAuth connection and token refresh with your HubSpot account
`crm.objects.companies.read`	View company properties and details for organisation synchronisation
`conversations.read`	View conversation threads in the HubSpot inbox for support context
`crm.objects.deals.read`	View deal properties and pipeline data for sales performance tracking
`crm.objects.contacts.read`	View contact properties and details for contact synchronisation and team assignments

Optional Scopes for QTRBK

These scopes are only requested when specific features are enabled:

Scope	Purpose
`business_units_view.read`	View brand data and logo information for multi-brand portal support
`crm.objects.custom.read`	View custom object data for extended CRM integrations (Enterprise accounts only)
`crm.objects.feedback_submissions.read`	View feedback survey submissions for customer satisfaction tracking
`settings.users.teams.read`	View team structure and assignments for role-based access management

The actual scopes requested depend on the features you enable and your HubSpot subscription tier.

Required Scopes for QTRBK Partner Connect

Scope	Purpose
`crm.schemas.companies.write`	Create, delete, or modify company property configurations for partner data sync
`crm.schemas.companies.read`	View company property settings to understand available data fields
`crm.objects.companies.write`	Create, update, and delete company records for partner organisation management
`crm.objects.companies.read`	View company properties and details for partner organisation synchronisation
`crm.objects.users.read`	View HubSpot user properties and details for partner team member access
`crm.objects.users.write`	Create, delete, or modify user records for partner user provisioning
`content`	Access landing pages, email templates, and campaign data for partner marketing sync
`oauth`	Maintain secure OAuth connection and token refresh with partner HubSpot accounts
`forms`	Access and manage HubSpot forms for partner lead capture integration
`files`	Access File Manager for partner asset and document management
`crm.objects.partner-clients.read`	This scope has been added so that only Certified HubSpot Partners can install Partner Connect

These scopes are required for QTRBK Partner Connect functionality to enable cross-portal collaboration.

Appendix B: Calendar Integration Scopes

Google Calendar API Scopes

When you connect Google Calendar to QTRBK, we request the following OAuth scopes:

Scope	Purpose
`https://www.googleapis.com/auth/calendar.events`	Create, modify, and delete calendar events for QTRBK session scheduling
`https://www.googleapis.com/auth/calendar.readonly`	View calendar events and free/busy information for scheduling conflicts
`https://www.googleapis.com/auth/calendar.settings.readonly`	Read calendar settings like time zone for accurate event scheduling

Limited Use Disclosure: QTRBK's use of Google Calendar data is limited to providing the session scheduling and RSVP tracking features. We do not use this data for advertising, do not sell it to third parties, and do not transfer it to other services except as necessary to provide QTRBK functionality.

Microsoft Graph API Scopes (Outlook Calendar)

When you connect Microsoft Outlook Calendar to QTRBK, we request the following permissions:

Scope	Purpose
`Calendars.ReadWrite`	Create, modify, and delete calendar events for QTRBK session scheduling
`Calendars.Read`	View calendar events and free/busy information for scheduling conflicts
`User.Read`	Read basic profile information for user identification
`offline_access`	Maintain calendar connection without requiring repeated sign-in

Data Use: Microsoft calendar data is used solely for QTRBK's session scheduling and meeting management features in accordance with Microsoft's API Terms of Use.

Appendix C: Subprocessors

Current list of subprocessors:

Subprocessor	Location	Purpose
Amazon Web Services (AWS)	United States	Cloud infrastructure and hosting
HubSpot, Inc.	United States	CRM platform and data synchronisation
Airwallex, Inc.	United States	Payment processing
Google LLC	United States	Calendar integration and analytics
Microsoft Corporation	United States	Calendar integration (Outlook)
Anthropic PBC	United States	AI services (Coach feature)
Sentry (Functional Software, Inc.)	United States	Error monitoring

Last updated: 3 February 2026