Quotien Application: Privacy Notice

1. Scope

This notice covers the Quotien application: the signed-in product where organizations run AI process interviews, build maps, generate reports, upload documents, and (optionally) connect cloud storage, connect an operational system such as Zendesk, Jira or ServiceNow, connect a team chat workspace (Slack), or use voice. It is distinct from and supplements the quotien.com website privacy policy, which covers only the marketing site. Where they conflict for application data, this notice governs.

2. Controller and processor

Quotien's role differs by data type:

• Customer content: interview transcripts, captured process data, maps, uploaded documents and their extracts, connected-drive files, the records we read from a connected operational system, and the excerpts we keep from a connected Slack workspace. These belong to and are controlled by the customer organization (the controller). Quotien acts as a processor, handling this content only on the customer's documented instructions to provide the service, under a Data Processing Agreement (§13).
• Account & operational data: a user's name, work email, company, role, authentication data, and technical/usage logs. For this, Quotien is the controller.

Customer content may include personal data about the customer's own employees or third parties (e.g. named in an SOP or interview). The customer is responsible for having a lawful basis to provide it; Quotien processes it as instructed.

3. Information we process

We do not use tracking cookies and do not sell personal data.

4. Why we process it, and legal bases

We process personal data on the following bases (GDPR Art. 6; the equivalent grounds apply under the Swiss FADP):

• To provide the service (run interviews, generate maps/reports, retrieval, account management): performance of a contract, Art. 6(1)(b); for customer content, on the controller's instructions under the DPA.
• Optional features you switch on (voice, cloud storage, operational-system and team chat connectors): consent, Art. 6(1)(a). Voice is used only when you start a voice session or dictate, so withdrawing means not using it. A connector can be disconnected by an administrator in the product, and anyone who authorised one can also revoke Quotien's access directly with the provider. An administrator can also stop Quotien reading a single Slack channel (§7).
• Security, abuse prevention, and service reliability (logs, rate limiting): legitimate interests, Art. 6(1)(f).
• Transactional email (verification, invites, resets): contract necessity.

5. AI processing and model training

Quotien uses AI models to conduct interviews, generate maps and reports, extract the text of documents you upload, and create embeddings for retrieval. Document extraction sends the file itself to the model, so a PDF or image you upload is processed by the AI provider configured for your workspace. Where an operational system is connected, each record's own summary line is also sent to our embedding provider (§8) so that related work can be matched. Where Slack is connected, no Slack message text is sent to any AI model (§7). Neither Quotien nor its AI subprocessors use your content to train their models: each approved provider's API terms contractually exclude API inputs and outputs from model training. Content is sent to these providers only to produce your results, then discarded by them per those terms. This covers Slack data as it covers the rest of your content, as Slack's own terms also require.

Product lookup. When an administrator adds a tool to the register, Quotien searches the public web for that product and asks the model to summarise what it does, so that reports can be specific about the software you already own. Only the product name leaves the workspace; the pages that come back are public vendor documentation. A tool marked as built in house is never searched, because the name of an internal system is itself sensitive.

6. Voice (audio) processing

Voice is an optional feature, used only when you start a voice session or dictate. When used:

• Realtime path (primary): audio streams directly between your browser and OpenAI's Realtime API over a peer-to-peer connection. Quotien's servers broker only the connection setup; we do not receive or store your audio.
• Dictation fallback: if the direct connection can't be established, your recording is sent to Quotien's EU servers and immediately forwarded to OpenAI for transcription. It is processed transiently to return text and is not stored.

In both cases OpenAI processes the audio as a subprocessor (§8) and only the resulting transcript is retained as workspace content.

7. Connected systems

Cloud storage (Google Drive). An administrator can connect a drive for the whole organization, and a member can connect their own. In both cases Quotien accesses only the specific files that person explicitly selects through Google's file picker (the drive.file permission), never the full drive. We read selected files solely to extract their text (§10) to ground your workspace.

What disconnecting does, and does not do. Disconnecting deletes the credentials Quotien stored for the connection, so nothing further is read from the source. For Google Drive, Zendesk and ServiceNow, Quotien also asks the provider to revoke the access it was granted, and tells the person disconnecting whether the provider confirmed it. If the provider did not confirm it, or could not be asked, that person is shown where to revoke the access with the provider and, if the request failed, can ask again from the same page for up to 15 minutes; for that retry, the page keeps an encrypted copy of the token, which only Quotien can open, for at most 15 minutes. For Jira, Quotien cannot revoke that access itself, because Atlassian gives apps no way to do so: it is withdrawn by removing Quotien from the connected apps of the Atlassian account that authorised it. Anyone who authorised a connection can also revoke Quotien's access directly with the provider. Disconnecting does not delete text already extracted from the files that were selected: that extract is your organization's own content and stays in the workspace until the document is deleted, or the workspace is. Removing or unsharing a file inside Google Drive likewise does not delete an extract already taken from it. To remove the extract, delete the document in Quotien; §10 sets out what that does and does not remove.

Operational systems (Zendesk, Jira, ServiceNow). An administrator can connect a service desk or issue tracker so that Quotien can measure how work actually flows. We read records and their history only; we do not create, modify or close records in your systems. From each record we store its own summary line, the sequence of actions taken on it, and an identifier for the person who acted. That identifier is stored once per person so it can be found and erased on request; on the individual event records the actor is held only as a pseudonym. These records commonly describe people who are not Quotien users (your staff and the people who contacted them), and they are customer content, controlled by your organization (§2). Where Jira is connected, Atlassian requires us to report the account identifiers we hold back to Atlassian periodically so that deletions on their side reach us; we do this on a weekly cycle and it carries no other content.

Team chat (Slack). An administrator can connect a Slack workspace, and a Workspace Admin or Owner of that workspace must complete the installation in Slack. Quotien asks Slack for three read-only permissions (to see the workspace's public channels, to read the messages of a public channel its app has been added to, and to look up a member) and accepts no other. Quotien reads only a public channel that a member of the channel added the Quotien app to and that an administrator nominated. It never reads direct messages, group messages, private channels, files, or the workspace's member directory. It stops reading a channel within about an hour of the channel being shared with another organization, and never keeps a message by a person from outside the workspace; once the channel is no longer shared, Quotien reads on from where it stopped (after 7 days, only once an administrator approves a new dry run), including what the workspace's own members posted while it was shared. Before anyone approves a nominated channel, a dry run reads the channel's latest 15 messages and looks up their authors, and keeps only the resulting figures. Once an administrator approves it, Quotien reads the channel's messages and thread replies back to the start of the approved window (30 days unless the administrator chooses fewer or more, and at most 90), then its new messages about every hour; every day it reads the channel's last 7 days again, and every week it checks the older messages it holds, to find what was edited or deleted. It looks up each author in Slack to confirm that they are a full member of the workspace. Quotien gives the administrator a short notice to post in each nominated channel, so that the people in it know.

What Quotien keeps from Slack, and who sees it. Only a message that states the key of a work item your organization already holds in Quotien (a Jira issue key, or a link to one of your Zendesk tickets or ServiceNow records) is kept: as an excerpt of at most 2,000 characters on that work item, with its channel, time and thread, a link to the message in Slack, and a pseudonym for its author. Nothing of any other message is kept: it is read and discarded. Nor are these kept: a message by a bot, an app, a guest, a person from outside the workspace, or a person erased as below; a message that names more than three work items; and anything posted before the channel was last made public. Beside each excerpt Quotien keeps a record that the message named that work item. That record holds no text and no author, but it does point to the message in Slack (its channel and time); it stays until the workspace is deleted, it does not shape how your processes are mined, and once its excerpt is gone it is shown to no one. Quotien also keeps each nominated channel's name, its settings in Quotien and counts of what it read from it, none of which holds message text or names an author, until the workspace is deleted, including after the channel is un-nominated or Slack is disconnected. An excerpt can be read in Quotien only by the members of the team (called a function in Quotien) that an administrator assigned to its channel, or by everyone in the organization once an administrator widens the channel; there is no exception for administrators, and who wrote a message is not shown. No Slack message text is sent to any AI model, and Slack data is never used to train one.

How long Slack excerpts are kept. An excerpt is kept at most 12 months after its message was posted, and less where Slack's limits on how often Quotien may read allow it to check older messages again only over a shorter period, which the Slack page in Quotien states. A message deleted in Slack has its excerpt deleted within about a week, and within about two weeks at worst where the channel was paused, or Slack could not be read, meanwhile. An edit to a message is reflected within about a week in the same way, and a message edited so that it no longer names the work item loses its excerpt. Quotien stops reading a channel, and pauses it, when the Quotien app is removed from it, it is shared with another organization or archived, more of its messages are kept in a day than its approved limit allows, Slack refuses Quotien's access or reports more permissions than the three, or Quotien cannot complete its daily check against Slack for two days, or its weekly check for eight; a channel still paused after 7 days loses its excerpts then. When a channel is un-nominated or Slack is disconnected, its excerpts are deleted at once, and when Quotien finds that a channel was made private or deleted, they are deleted as soon as it finds it: unlike the operational connectors, disconnecting Slack deletes the excerpts Quotien kept from it. What stays after a disconnect holds no message text, and stays until the workspace is deleted: the records without text and each channel's name, settings and counts described above, and the list of erased people below. Disconnecting also asks Slack to revoke Quotien's access and tells the administrator what Slack answered; if Slack did not confirm it, the Quotien app may still be installed in the workspace, and the administrator is told to remove it there.

Erasing a person who posted in Slack. A person who posted in a nominated channel can ask the organization that connected the workspace to have the excerpts of their messages erased (§12). Quotien then deletes every excerpt of their messages in that organization, and puts a pseudonym of them on the organization's list of erased people, so that no later reading collects their messages again; the pseudonym holds no name, no Slack identifier and no text, and it is kept until the organization is deleted. The records without text that their messages named a work item stay, as described above. An erasure finds a person by what they posted, not by what others wrote about them: an excerpt of someone else's message that names them goes when that message is deleted or edited in Slack, when its channel is un-nominated, or when its 12 months pass. This notice is also the privacy policy of Quotien's Slack app.

Google API Limited Use. Quotien's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not allow humans to read it except as necessary for security, to comply with law, or with your explicit consent.

8. Subprocessors

We engage the following processors to run the service. The current list is also published at quotien.com/subprocessors.

9. International transfers and EU data residency

Stored data and application compute are EU-domiciled (Neon Frankfurt; Vercel fra1; a background worker on OVHcloud in Frankfurt). As a Swiss controller, transfers between the EU/EEA and Switzerland are covered by the European Commission's adequacy decision for Switzerland.

Our LLM subprocessors (Anthropic and optional OpenAI), and the web-search subprocessor used for the product lookup (Tavily), process in the United States; those transfers rely on appropriate safeguards: the EU Standard Contractual Clauses (with the Swiss addendum recognized by the FDPIC) and, where a provider is certified, the Data Privacy Framework. Customers requiring EU-only inference can ask us to approve an EU AI endpoint for their organization (§8, last row), for example Azure OpenAI in the EU. We review and allowlist the host before it can be used, so this is arranged with us rather than self-served. Two limits matter: this covers text generation, and voice and dictation always run against our own OpenAI endpoint in the United States, so an organization that needs EU-only processing should not use them. Email (Resend) is processed in the EU.

10. Retention and deletion

• Uploaded/connected files: we keep only the derived extract; the original file content is discarded after extraction (extract-then-discard). An uploaded original is held in our EU database only until extraction runs, normally seconds to minutes. If extraction cannot run yet (for example, the workspace has used its monthly AI allowance), the file is kept until it can be processed, which may be until the allowance renews; deleting the document removes it immediately. Files read from a connected drive are never stored in original form.
• Voice audio: not stored (§6); only transcripts are retained.
• Workspace content: retained while the workspace is active, and deleted (or returned) on request. Deleting the organization deletes the workspace and everything in it, including maps, documents and their extracts, reports, and records imported from connected systems; audit records are kept beyond it, as set out below. Disconnecting a connector does not delete content already imported (§7), with one exception: disconnecting Slack, or un-nominating one of its channels, deletes the excerpts Quotien kept from it at once, and a Slack excerpt is otherwise kept at most 12 months (§7).
• Account data: deleted or pseudonymised on request. Erasing an individual removes their sign-in credentials, sessions, connector tokens and workspace memberships, and replaces their name and email with a pseudonym. It does not delete the work they authored: maps, interviews, documents and reports belong to the customer organization that controls them (§2). A document can be deleted by the person who added it, or by an administrator who sees it in their list of documents. Once that person is no longer a member of the workspace, a document that appears in no administrator's list, such as one that person kept private, is removed when the organization asks us to remove it, or when its workspace is deleted. A map, together with its interview and reports, can be deleted individually in Quotien only by the member it is assigned to; once that person is no longer a member of the workspace, for example after erasure, the map is removed when the organization asks us to remove it, or when its workspace is deleted, unless it is waiting in the queue of a team (called a function in Quotien) and a member of that team takes it over first. A minimal placeholder record is kept so that the organization's own history stays intelligible.
• Audit records (who did what, and when) are kept as evidence for at least twelve months, including after the workspace they relate to has been deleted. Routine maintenance deletes them once they are more than twelve months old; because that maintenance can be delayed, a record may be kept for longer. They cannot be edited, with one exception: an older record of a Google Drive connection can hold the email address of the Google account that was connected, and erasing an individual removes that address where it matches the email address they use for Quotien. This does not reach the records of a workspace that has already been deleted.
• Deleting a document deletes the document, its extract, the chunks and embeddings made from it, and any original file still waiting to be processed; the document is then no longer retrieved. What was already made with it is not deleted with it. Interviews, maps and reports that drew on the document keep what they took from it, such as excerpts recorded as evidence in an interview, until the map they belong to, or the workspace, is deleted; some of it can outlast the map as well, as the next point sets out.
• Content that outlasts a map or document: some content made from maps and documents stays in the workspace after the map or document it came from has been deleted. The written summary that Quotien draws from all of a workspace's reports keeps what it took from a deleted map's report until an administrator regenerates the summary (which needs at least one remaining report), or the workspace is deleted. Where an operational system has been connected, Quotien can compare a written procedure with the process it describes, and can record whether a map describes a process observed in that system. A finding from that comparison may quote the document and the map, and is kept until the workspace is deleted. A record of a proposed match keeps the map's name, the steps that matched and the reason given for the match until the map is deleted. Deleting the map deletes a proposed match that nobody has answered. Where an administrator has already answered it, none of the map's content is kept: the record keeps the answer (whether the map describes that process, who answered and when), the score and step counts the match rested on, which matcher proposed it, and the deleted map's internal identifier. When Quotien removes a map at the organization's request, the records of its proposed matches are treated in the same way at the next daily maintenance run, or at a later one if that run is delayed.
• Facts about your processes: Quotien is introducing a structured record of what your content says about your processes. Once the record is in use, each fact in it is tied to the content it was read from: a step, for example, to the map that shows it, and a document's title to the document and to the map it is attached to. When that content is deleted, the facts read from it are withdrawn: they are no longer shown or used, but they are kept until the workspace is deleted. The exception is a rule for how a process must run, such as a step that a person must approve, or one process governing another. Deleting the content such a rule was read from does not by itself remove the rule, and does not show it to anyone who could not already see it. The rule can be removed only when an administrator, or the member assigned to the map that holds the rule (for one process governing another, the governing process's map), confirms the removal, which is recorded as their review. A map that holds such a rule, or that such a rule refers to, can therefore be deleted individually in Quotien only once the person deleting it confirms the rule's removal; someone who cannot confirm the rule's removal cannot delete the map while the rule stands. If such a rule was read from a connection between two processes, and that connection is deleted on its own while both processes' maps remain, the rule stays in force and visible to those who could already see it, marked as having lost its source, until it is removed in this way. A rule that has been removed is then withdrawn like any other fact.
• Deleted data can remain in database backups and recovery copies until they expire or are removed.

11. Security

We protect data with encryption in transit (TLS) and at rest, logical isolation of each organization's data enforced at the data-access layer, and least-privilege access to AI providers through platform-held credentials that are never exposed to other tenants. The access tokens Quotien holds for any connector, Slack's included, are encrypted at rest. We restrict internal access to production data to authorized personnel and will notify affected customers of a personal-data breach without undue delay, as required by the GDPR and the Swiss FADP.

12. Your rights

Under the GDPR and the Swiss FADP you may request access, rectification, erasure, restriction, portability, and objection. Because Quotien is a processor for workspace content, end-users (e.g. a customer's employees) should exercise these rights through the customer organization that controls that data; we assist the customer in responding. A person who posted in a connected Slack channel, who is often not a Quotien user, can have the excerpts of their messages erased in this way, as §7 sets out. For account data (where Quotien is controller), contact us directly at hello@quotien.com; §10 sets out exactly what an erasure removes and what stays with the customer organization. You may also lodge a complaint with your data protection authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU/EEA, your national supervisory authority.

13. Data Processing Agreement (DPA)

For customer content, Quotien acts under a DPA that incorporates the GDPR Art. 28 processor terms, this subprocessor list (with a mechanism to object to new subprocessors), and the EU Standard Contractual Clauses (with the Swiss addendum) for onward transfers. A DPA is available to customers on request at hello@quotien.com.

14. Changes and contact

We will post changes here with an updated version and date, and notify customers of material changes (including new subprocessors) in advance where required.

Controller: Quotien Switzerland, 1950 Sion, Switzerland Contact: hello@quotien.com