This policy explains what personal data the operator of the Qiao platform ("we") processes when you use Qiao, and why. We are the controller of this data. Our details are in the Contact section.
Account: your email address or Telegram ID (whichever you sign in with), your name, your country if you add it, the app language and reading language you choose, and who invited you.
Profile: your roles, languages, countries, bio, social networks with follower counts and verification status, portfolio links and offers. For clients also the project name, website and X and Telegram links.
Activity: campaigns and applications, recommendations, messages and attachments, deals and deliveries, reviews, reports and blocks, and the notifications we send you.
Waitlist: if you ask for an invite, your email and the note you write.
Technical data: your IP address and request details in technical logs, and cookies. Qiao uses only the cookies it needs to work: a session cookie that keeps you signed in for 30 days, a cookie that remembers your language, and a cookie that keeps an invite code for 7 days while you sign up. We do not use advertising or analytics cookies.
To create an account you need an email address or a Telegram account. Everything else in your profile is optional, but without a basic profile you cannot apply to campaigns or publish offers.
To provide Qiao under the Terms (Art. 6(1)(b) GDPR, performance of a contract): your account and sign-in, showing your profile, campaigns and offers, delivering and translating messages, translating campaigns, profiles and offers for other readers, recording deals and reviews, and sending notifications in the app, by email and on Telegram. A waitlist request is handled on the same basis, as a step you ask for before a contract.
Our legitimate interest in keeping Qiao safe and working (Art. 6(1)(f) GDPR): preventing fraud, spam and abuse (rate limits, scam warnings in chat, handling reports and blocks, keeping track of who invited whom), securing the service and investigating incidents with technical logs, making backups, and establishing or defending legal claims. You can object to this processing (see Your rights).
Where the law requires it, for example to answer a lawful request from an authority, we process data to meet that obligation (Art. 6(1)(c) GDPR).
We do not sell your data and do not use it for advertising. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The scam warning in chat only shows a notice.
We use these processors. They handle data only to provide their service to us:
Anthropic: AI translation of messages, campaigns, profiles and offers. Only the text to be translated is sent.
Resend: sending emails, such as sign-in codes and notifications.
Cloudflare: CDN and DNS. All traffic to Qiao passes through Cloudflare, which protects the site against attacks and sees your IP address and requests.
Hosting: Qiao runs on a VPS in the EU, where the database, uploaded files and backups are stored.
Telegram is a separate service, not our processor. If you connect it, we use it for sign-in with Telegram and for notifications to your Telegram account. Notifications contain names and titles, not the text of your messages. Telegram handles this data under its own privacy policy.
Other users see what you publish and what you send them (see What is public). We disclose data to authorities or courts only when the law requires it.
Anthropic, Resend and Cloudflare may process data outside the EU, mainly in the United States. For these transfers we rely on the standard contractual clauses approved by the European Commission or, where a provider is certified, on the EU-US Data Privacy Framework. You can ask us for a copy of these safeguards.
Telegram is used only if you connect it. It processes your data under its own privacy policy, which may include processing outside the EU.
Sign-in codes: 10 minutes. Sessions: 30 days, or until you log out. Files you upload but never send in a message or a delivery: 24 hours. Backups: 14 days, so data you delete disappears from backups when they expire. Technical logs are rotated automatically and old logs are deleted, normally within a few weeks. Waitlist entries stay until you ask us to remove them or delete the account you created with that email. Everything else stays as long as your account exists.
When you delete your account, we delete your email, Telegram link, name, country, profile, social networks, portfolio, offers and sessions, and cancel unused invites. Your campaigns are closed. Messages, deals and reviews stay in anonymised form because the other side needs its record: they show "Deleted user" and are no longer linked to your email, Telegram account or profile. The text of messages you sent stays visible to the other person. Reports and blocks are kept while needed to protect other users.
Profiles and campaigns on Qiao are visible only to signed-in users. They can see your profile: name, country, roles, languages, bio, social networks, portfolio, active offers, reviews, completion rate and who invited you to Qiao. Open campaigns are visible to all of them.
Messages are visible only to you and the other person in the conversation. Admins see what they need to handle verifications, reports and disputes, such as the text of a report or the terms and deliveries of a disputed deal.
Under the GDPR you have the right to access your data, have it corrected or deleted, restrict its processing, receive it in a portable format and object to processing based on our legitimate interest. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work or where you think the infringement took place.
You can do much of this yourself: edit your profile and settings at any time, delete your account in Settings, and report or block other users. For anything else, contact us (see Contact). We reply within one month.
We update this policy when our processing changes and tell you about important changes in the app or by email.
Privacy questions and requests go to the operator of the Qiao platform:
[Operator details: legal name, registered address and contact for questions and privacy requests. To be added before launch.]