This policy explains what QuQi collects, why, and what you can do about it. It covers quqi.io, the QuQi application, and the WhatsApp and Telegram assistants operated under the QuQi name.

1. Who we are

QuQi is operated by OhMySaaS, LLC, 1111B S Governors Ave, Suite 43066, Dover, DE 19904, United States. For data protection purposes OhMySaaS, LLC is the controller of the personal data described here.

Questions, requests, or complaints: privacy@quqi.io.

2. What we collect

Account information

Your name, email address, and a hashed password. If you sign in through a third-party provider, we receive your name, email, and provider account identifier. We never receive your password from that provider.

Website and project data

Domains you add, and everything our crawler records about them: page URLs, titles, meta descriptions, headings, status codes, link structure, and the SEO issues we detect. You may also store brand details, target audiences, competitors, and content settings.

Integration credentials

When you connect WordPress, Shopify, a webhook endpoint, or Google Search Console, we store the credentials or tokens required. These are encrypted at rest and are never displayed back to you or included in exports.

Messaging identifiers and message content

If you link WhatsApp or Telegram, we store the identifier for that channel — your phone number in international format, or your Telegram chat ID — along with the display name or username the platform supplies. We store the content of messages exchanged with the assistant so conversations have continuity.

Technical data

IP address, browser type, pages visited, and timestamps, recorded in server logs for security and diagnostics.

What we do not collect. We do not ask for payment card numbers, government identifiers, or special-category data (health, biometrics, political or religious views). Please do not send these to the assistant.

3. How we use it

• To provide the service — crawl your sites, run audits, generate content, and answer you in chat.
• To authenticate you — including verifying a phone number or messaging account before it can reach your data.
• To operate and secure the platform — diagnosing faults, preventing abuse, enforcing rate limits.
• To communicate — service notices, security alerts, and, if you opt in, product updates.
• To meet legal obligations.

We do not sell personal data, and we do not use your content for advertising.

4. Legal bases (EEA and UK)

5. AI processing

QuQi uses third-party AI models to generate audits, articles, and chat replies. To do that, we send the relevant context — your prompt, brand settings, and site data such as detected issues or page titles — to our model provider, currently OpenAI.

Our provider processes this to return a response. Under our API terms, submissions are not used to train their models. We do not control how a model reasons, and outputs may be inaccurate — review anything you intend to publish.

6. WhatsApp and Telegram

Linking a messaging account is optional and entirely under your control.

• Verification is required. We send or display a one-time code that you must return from the account being linked. Until that code is redeemed, we store only the pending code and its expiry, and the assistant will not answer.
• An unverified sender receives no data. Messages from unlinked numbers or chat IDs get only an instruction on how to link.
• The platform sees your messages too. Messages travel through Meta Platforms (WhatsApp) or Telegram Messenger, each of which processes them under its own privacy policy. WhatsApp Business API messages are not covered by end-to-end encryption in the same way as consumer chats, because the business endpoint decrypts them to respond.
• Unlinking from Integrations deletes the binding immediately and the assistant stops responding to that account.

7. Website crawling

Our crawler fetches pages from domains you add, identifying itself in the user agent and respecting configured limits. Crawled content is stored as project data for your account only.

You must have the right to crawl any domain you add. If a page contains personal data, that data enters our systems as part of the crawl record — please avoid crawling pages that expose personal data unnecessarily.

8. Sharing and service providers

We share personal data only with providers that process it on our behalf under contract:

We may also disclose data where legally compelled, to protect our rights or the safety of others, or to a successor in a merger or acquisition — in which case this policy continues to apply until you are notified otherwise.

9. How long we keep it

• Account data — for as long as your account is open.
• Project and crawl data — until you delete the website or your account.
• Chat messages — until you delete the conversation or your account.
• Pending verification codes — 10 minutes, then they expire and are removed.
• Server logs — up to 90 days.

After account deletion we remove or anonymise personal data within 30 days, except where retention is legally required. Backups age out on their own cycle, within 90 days.

10. Security

We encrypt traffic with TLS, encrypt integration credentials at rest, hash passwords, and sign every inbound webhook so forged requests are rejected before they are read. Access to production data is limited to personnel who need it.

No system is perfectly secure. If a breach affects your personal data, we will notify you and any required regulator without undue delay.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time.

If you are in California, you additionally have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA/CPRA.

Exercise any of these by emailing privacy@quqi.io. We respond within 30 days. EEA and UK residents may also complain to their local supervisory authority.

12. International transfers

We operate from the United States, so using QuQi involves transferring your data there. Where we move personal data out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum.

13. Children

QuQi is for business use and is not directed to anyone under 16. We do not knowingly collect their data; if you believe a child has provided us data, contact us and we will delete it.

14. Changes

We may update this policy. The date at the top always reflects the current version, and we will notify you by email or in-app before any material change takes effect.

15. Contact

OhMySaaS, LLC
1111B S Governors Ave, Suite 43066
Dover, DE 19904, United States
privacy@quqi.io