Privacy policy
We want the way Qalu handles information to be clear, and limited to what the service needs. Read this policy together with the terms of use and any contract or purchase order between us and the subscribing organization. Where they conflict, the contract prevails.
This English version is provided for convenience. The Arabic text of this document governs unless the parties agree in writing to use another language.
1. Scope of this policy
This policy applies to Qalu, its public website and its API, and to related services provided by InfoTimes, a company registered in Canada (“we” in this policy). It explains what personal information we collect, why we collect it, how we use and protect it, when we disclose it, and the rights of the people it concerns.
We handle personal information in line with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), any applicable provincial legislation, and the ten fair information principles the Act sets out.
2. Our role and the subscribing organization’s role
The service is provided to organizations (government bodies, companies and agencies), not to individuals in a personal capacity. Our role depends on the type of information:
- Account, subscription and usage data: we are responsible for it, and we process it to run, manage, bill and protect the service.
- Content Qalu collects for an organization’s projects: the subscribing organization decides what is monitored (keywords, accounts, sources and period). We process that content on its behalf, on its instructions and only as far as needed to provide the service. The organization is responsible for the lawfulness and proportionality of its monitoring.
3. Information we collect
a. Information you give us
- Account details: name, email address, job title, password (we keep only an encrypted hash) and two-step verification settings.
- Organization and billing details: legal name, address, billing contacts and, where needed, a purchase order number.
- Requests sent from the public website: name, job title, organization name and type, email address, country, the monitoring you need, and anything written in the optional fields.
- What team members add inside Qalu: corrections, notes, cases, reports, and questions asked through Ask your data.
b. Information created when you use the service
- Logs of searches, runs and exports, and of administrative actions, with who performed them and when.
- Session and security data: IP address, browser type, sign-in times and active devices.
- API key usage: number of requests, endpoints and time of last use. We do not keep the key itself, only an encrypted hash of it.
c. Public content Qalu monitors
Depending on how an organization sets up its projects, Qalu collects content published for the public: news articles, public posts and comments on social platforms, reviews on maps and app stores, and video transcripts where available. This content may include publishers’ names and account names, their text and engagement counts. Qalu does not collect content from private groups or accounts, direct messages, or anything that requires signing in with a personal account.
4. How we use information
We use information for these purposes only:
- Providing the service: collecting and classifying content and showing it in dashboards, reports and alerts, and delivering it through the API and the notifications the organization chooses.
- Managing accounts, permissions, quotas, subscriptions and billing.
- Protecting the service: verifying identity, preventing misuse, limiting request rates and investigating security incidents.
- Communicating about the service: notifications the user has chosen, security messages, and replies to service and support requests.
- Improving classification within an organization’s own account, based on its team’s corrections.
- Meeting legal and accounting obligations.
We do not sell personal information. We do not use one organization’s data to serve another, we do not use monitored content for advertising, and we do not build profiles of individuals from it outside the projects of the organization that asked for the monitoring.
5. Automated processing and human review
Qalu classifies monitored content automatically (sentiment, topic, relevance and comment type) using rules and language models, which may be provided by specialist service providers who process the text on our behalf, on our instructions, and may not use it for their own purposes. Each label is shown with a confidence score, the organization’s team can correct it, and every correction is logged with who made it and when.
Qalu makes no decisions with legal effect on individuals and publishes nothing on an organization’s behalf. Replies and statements are drafts that are published only if the organization’s team decides to.
7. Transfers outside Canada
Some information may be stored or processed by service providers in countries other than Canada, including the United States. It is then subject to the laws of those countries, and their authorities may have access to it under those laws. We take contractual and technical measures to protect it in transit and afterwards.
8. How long we keep information
- Account and organization data: for the length of the subscription, then as long as needed to close the account and meet legal and accounting obligations.
- Monitored content and its labels: for the retention period set for the organization’s account, after which it is deleted automatically, except where it appears in reports the organization has approved. A deleted project is removed permanently thirty days after deletion.
- Search, action and security logs: as long as needed for record-keeping, audit and protection.
- Requests sent from the public website: as long as needed to follow up and contract, after which they are deleted or anonymized.
An organization can export all of its data at any time during the subscription.
9. How we protect information
- Each organization’s data is kept separate from others’, with role-based permissions and the option to restrict projects and workspaces to named members.
- Encrypted connections. Passwords, API keys and recovery codes are stored as encrypted hashes and shown only once, when they are created.
- Two-step verification, remote sign-out of sessions, and logging of sensitive actions.
- Automatic notifications are never sent to internal network addresses, and each one is signed so the recipient can verify it.
11. Your rights
Anyone may ask to see the personal information we hold about them, ask for it to be corrected, and withdraw consent where processing is based on consent, subject to legal and contractual limits. If a request concerns content Qalu monitored for a subscribing organization, we may refer it to that organization, as the party that set up the monitoring, and help it respond.
We respond to requests within thirty days of receiving them, as the law requires. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.
12. Minors
The service is intended for organizations and their staff, not for people under the age of majority, and we do not knowingly collect their information as users.
13. Changes to this policy
We may change this policy to reflect changes in the service or in the law. We will show the change by updating the “last updated” date above, and we will tell account administrators in advance about any material change.
14. Contacting our privacy officer
For privacy questions and requests, write to the InfoTimes privacy officer at privacy@qalu.ca. You can also reach us through the request form.