Privacy Policy

QuillAI is a pure AI application. We do NOT collect public user profiles, display names, bios or any social-media data. For account management we only process your e-mail address and a hashed password. An internal username is generated automatically from the e-mail prefix and is not visible to other users.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

In addition to e-mail/password sign-in we offer sign-in with Google. The sign-in flow is operated by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. When you use “Sign in with Google” you are redirected to a login page operated by Google.

Data transmitted

Upon successful sign-in we receive from Google only the following information (scopes openid, email, profile): your e-mail address, a unique Google user ID and — if present in your Google account — your display name and profile picture. We do NOT receive your password, contacts or any access to other Google services.

Of these data, we permanently store only the e-mail address and the internal user ID. Display name and profile picture are not shown publicly and are not shared with third parties.

Auth service provider

The sign-in and session service (including secure storage of the login token) is technically provided via Supabase (Supabase Inc., USA) as part of the Lovable Cloud infrastructure. Data processing takes place in the EU; supplementary transfers to the USA are based on the EU Standard Contractual Clauses (Art. 46 GDPR).

Google as independent controller

During the sign-in flow Google processes its own data (including cookies, IP address, time of sign-in) as an independent controller. Google’s own privacy policy applies to that processing: policies.google.com/privacy.

Legal basis & withdrawal

The legal basis is Art. 6(1)(b) GDPR (performance of contract – providing your account) and — for the sign-in flow at Google — Art. 6(1)(a) GDPR (consent given to Google). You can revoke the connection at any time by deleting your account in the settings or by revoking access in your Google account (myaccount.google.com → Security → Third-party apps with account access).

So that QuillAI can answer you, generate images or analyse documents, your inputs are transmitted in real time to an AI service:

• Processor: Lovable AI Gateway (Lovable AB, Sweden), acting as the AI routing layer.
• Sub-processor & models: Google (Google Ireland Ltd.) — google/gemini-3-flash-preview for text chat and document/image analysis, google/gemini-2.5-flash-image for AI image generation.
• Data transmitted: Your text prompts; with premium features additionally uploaded PDFs, DOCX, TXT, CSV or images (PNG/JPG); with the live voice chat your microphone audio in real time; with the 3D creator your text prompt or reference image.
• Third-country transfer: Processing may take place on servers outside the EU. Transfers are based on the EU Standard Contractual Clauses.
• Encryption: All transfers happen exclusively encrypted via TLS/HTTPS.

Legal basis: Art. 6(1)(b) GDPR (performance of contract – delivering the requested AI response).

For the premium "Live Voice Chat" feature we use OpenAI's Realtime API to process your microphone audio in real time and stream back a spoken response.

• Processor: OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland.
• Model: gpt-4o-mini-realtime-preview
• Data transmitted: Your microphone audio stream and your prompts.
• Third-country transfer: Processing may take place in the USA. Transfers are based on the EU Standard Contractual Clauses.
• No training: Per OpenAI's API policies, content sent through the API is not used for training.

For the premium "3D Creator" feature we use the Tripo3D API to generate a 3D model from your text prompt or a reference image.

• Processor: VAST AI Research (Tripo3D), api.tripo3d.ai.
• Data transmitted: Your text prompt or uploaded reference image, plus technical request metadata.
• Third-country transfer: Processing may take place on servers outside the EU. Transfers are based on the EU Standard Contractual Clauses.
• Result storage: The generated 3D model is stored as a URL in your chat history and can be removed at any time via "Delete account".

Legal basis: Art. 6(1)(b) GDPR.

Optionally you can connect your Google Drive to QuillAI in order to attach your own files as context in the chat. The connection is voluntary and can be revoked at any time.

• Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.
• OAuth scopes: drive.readonly – read-only access. QuillAI cannot create, modify or delete files in your Drive.
• Data processed: Metadata of the files you select (name, type, ID) and the extracted text content of Google Docs, PDF, DOCX, TXT and Markdown files. Only files you explicitly pick in the file browser are loaded (max. 5 per message).
• Forwarding to the AI: The extracted text is passed as context to Google Gemini (see section 2) so that your question can refer to the content.
• Storage: We do NOT store copies of your Drive files on our servers. We only store the OAuth refresh token so that the connection does not need to be re-authorised at every login. The refresh token is stored AES-256-GCM encrypted and is bound to your account via Row-Level Security.
• Revocation: You can disconnect at any time via the integrations popover (Disconnect) inside QuillAI or directly in your Google account (myaccount.google.com → Security → Third-party apps with account access). Stored tokens are then deleted.
• Third-country transfer: Google Drive API calls may take place in the USA. Transfers are based on the EU Standard Contractual Clauses.

Legal basis: Art. 6(1)(a) GDPR (consent via active connection) and Art. 6(1)(b) GDPR (performance of contract).

Per the official business/API policies of the Lovable AI Gateway and the underlying provider (Google), prompts, documents and images sent through the API are NOT used to train future AI models. Inputs are used solely to produce your current response.

Your chat history (conversations and messages) is stored in our database to show the history in the sidebar. Uploaded documents/images are passed to the AI for processing only and are not stored persistently on our servers — at most a text extract or short-lived preview remains in your browser.

Via Settings → Danger Zone → "Delete account" you can permanently erase your account, your entire chat history and all linked data at any time. An active premium subscription is automatically cancelled in the same step.

For the optional premium subscription (€10.00 / $10.00 per month) we use PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal receives transaction metadata and your e-mail. We do NOT store any credit card or bank account data on our servers.

Legal basis: Art. 6(1)(b) GDPR.

The application runs on modern cloud infrastructure (edge hosting). For security reasons, technical log files (browser type, timestamp, IP address) are processed short-term. This data is not used for advertising and is not linked to your account.

Legal basis: Art. 6(1)(f) GDPR.

You have the right at any time to information, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), as well as the right to lodge a complaint with a supervisory authority.

• Fabrathan Hinchan
• Hermann-Balk-Straße 88a, 22147 Hamburg, Germany
• E-Mail: digipoint-online@yahoo.com
• Tel.: 040 18009108
• Tax No.: 44/096/02741