Quoridea Privacy Policy
Draft for review. This document may change before paid plans open.
Version 0.1, 2026-10-28. Provider: Mitikasha LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States ("Quoridea", "we", "us"). Privacy contact: privacy@quoridea.com.
This policy explains what personal data Quoridea handles, why, and the choices you have.
1. Two roles
- For the data organizations put into Quoridea (ideas, reviews, decisions, files, and the people named in them), the organization is the controller and we are its processor. We handle that data only on the organization's instructions, under our Data Processing Agreement. If you are a member of an organization that uses Quoridea, please send requests about that data to the organization; we will help it answer them.
- For our own website, accounts and billing, Mitikasha LLC is the controller. The rest of this policy is mainly about that processing.
2. What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Name, email address, password hash | You, when you create an account or accept an invitation | To create and secure your account and to let you sign in |
| Organization memberships and roles | The organization's administrators | To decide what you may see and do |
| Session and sign-in records, IP address | Your browser, when you sign in | To keep you signed in, to rate-limit sign-in attempts and to protect the service |
| Request logs (URL, time, IP address, browser) | Every request to the service | To run, debug and secure the service; kept for a short period set by our hosting provider |
| Notification preferences | You | To send the emails you chose |
| Partner registration and referral code | You, if you register as a partner | To attribute referrals |
| Billing contact and payment details | You, at checkout, directly to Paddle | Paddle, our merchant of record, processes payments and invoices. We receive the billing contact and subscription status, never card details |
| Messages you send us | You | To answer you |
We do not use analytics, advertising, tracking or session-recording services, and we do not buy personal data.
3. Cookies
Quoridea uses only cookies needed for the service: a session cookie that keeps you signed in, a cookie that remembers which organization you are working in, a cookie that remembers whether you chose the light or dark theme (it holds only that choice), and, if you arrive through a partner's referral link, a cookie that remembers that referral for 30 days. There are no advertising or analytics cookies, so there is no cookie banner.
4. Legal bases (EU and UK)
We process account data to perform our contract with you or your organization, security and request logs for our legitimate interest in a secure, working service, and billing data to meet our legal obligations. Where we rely on legitimate interests, you may object (section 7).
5. Who we share it with
- Cloudflare, Inc., which hosts the whole service (see our subprocessors).
- Paddle, our merchant of record, for payments, invoices and sales tax, once paid plans are live.
- The administrators of the organizations you belong to see your name, email address and roles.
- Authorities, where the law requires it.
We do not sell or rent personal data and do not share it for cross-context behavioral advertising.
6. Where it is stored, and for how long
Account data (the directory) is stored in Cloudflare's EU jurisdiction for every organization. Each organization's own data is stored in the region it chose (EU or US). Cloudflare is a US company and participates in the EU-US Data Privacy Framework; transfers are covered by the Standard Contractual Clauses in Cloudflare's data processing terms.
We keep account data while you have an account. Organization data is deleted within 30 days after the end of the organization's contract, and backups expire within a further 30 days. Billing records are kept as long as tax law requires.
7. Your rights
Depending on where you live, you may ask to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent where we relied on it. Write to privacy@quoridea.com; we answer within one month. You may also complain to your data protection authority. California residents: we do not sell or share personal information as those terms are defined in California law.
8. Security
How we protect data is described on our security page.
9. Children
Quoridea is a business service and is not meant for children under 16.
10. Changes
We will post any change here with a new date, and tell account holders by email about material changes.