QEnvy
Privacy

QEnvy Privacy Policy

Effective date: 23 November 2025 — Jurisdiction: Madrid, Spain

This Privacy Policy explains how VeGoVeVO ("QEnvy", "we", "our", or "us") processes personal data when you access the QEnvy workspace, enable plugins, or connect third-party accounts such as Spotify or Google services. QEnvy operates from Madrid, Spain and complies with the European Union General Data Protection Regulation (GDPR) and other applicable laws.

Summary. QEnvy processes only the minimum data necessary to deliver requested functionality. Plugin integrations remain optional. You are solely responsible for ensuring that your use of QEnvy, including audio recording or email automation, complies with the laws of your jurisdiction and with the policies of any third-party service you connect.

1. Data Controller & Contact

VeGoVeVO
Calle de Alcalá 123, 28009 Madrid, Spain
Email: legal@qenvy.cloud

2. Services Covered

This policy covers the core QEnvy workspace and the optional plugins we provide:

  • Spotify voice control.
  • Google Gmail automations (contacts, drafting, sending).
  • Google Drive summarisation and file lookup.
  • Weather queries, Google Search lookups, music identification (QAudiora & VibeIT).
  • Audio recording plugin for on-device capture.
  • Transcriber plugin for transcript storage and summaries.

3. Information We Process

We process only the data strictly required to deliver each feature:

  • Account session data: Encrypted session tokens and identifiers provided by MentraOS or Google for authentication. We do not store your QEnvy password.
  • Plugin authorisations: OAuth tokens issued by Spotify and Google. Tokens are encrypted at rest, stored separately from content, and refreshed only to maintain the connection you request.
  • Gmail content: When you issue commands, we fetch the minimum message metadata or drafts required to fulfil the request. Drafts, summaries and contact entries are stored only to complete your command execution and are not repurposed for analytics or model training.
  • Google Drive content: File names, IDs and excerpts are temporarily cached to generate the requested summary. Full documents are not stored.
  • Spotify data: Playback state, basic profile information, playlists, and device metadata necessary for voice commands.
  • Audio recordings: If you enable the recorder plugin, encrypted five-minute segments are retained for a maximum of 24 hours before automatic deletion.
  • Transcripts: If you enable the transcriber plugin, transcripts and summaries are stored according to the retention window you configure. You may delete entries at any time from the plugin interface.
  • Diagnostic logs: Minimal event metadata (timestamps, error codes, anonymised identifiers) used for service reliability.

4. How We Use the Data

  • Authenticate you into the QEnvy workspace.
  • Execute voice or manual commands you issue via the plugins you enable.
  • Provide contextual displays, summaries, and draft outputs inside your session.
  • Securely refresh OAuth credentials when required by Google or Spotify.
  • Maintain audit logs and detect abuse or misuse.
  • Comply with legal obligations and enforce our Terms of Service.

We do not sell personal data, and we never use plugin content to train foundation models or share it with advertisers.

5. Lawful Basis

We rely on the following GDPR legal bases:

  • Contractual necessity for processing required to provide the services you request.
  • Consent for optional plugins, recordings, and transcript storage. You may withdraw consent by disabling the relevant plugin.
  • Legitimate interests for security monitoring, fraud prevention, and product maintenance.
  • Legal obligations where we must retain records or respond to lawful requests.

6. User Responsibilities

  • You must ensure you have the legal right to record audio, store transcripts, or automate email in every jurisdiction where you use QEnvy.
  • You are solely responsible for the content of emails, files, recordings, and prompts you provide.
  • You must obtain any necessary consents from participants before capturing or transcribing their communications.
  • When connecting third-party accounts (Spotify, Google Drive, Gmail), you remain bound by their respective terms and policies.

QEnvy supplies tooling but does not monitor your content or verify that your use is lawful. Any misuse of the service is entirely your responsibility.

7. Sharing & Subprocessors

We share data only with essential infrastructure providers (e.g., hosting, database, logging, analytics). Each provider is bound by data processing agreements and may process data only on our documented instructions. Where providers operate outside the European Economic Area, we rely on Standard Contractual Clauses or equivalent safeguards.

8. Data Retention

  • Session and OAuth tokens: retained until you revoke access or 90 days of inactivity.
  • Gmail drafts, summaries, and contact metadata: retained only as long as required to complete the command.
  • Audio recordings: automatic deletion 24 hours after capture.
  • Transcripts: retained for the period you configure (default 14 days) or until manual deletion.
  • Diagnostic logs: retained for up to 30 days unless required for security investigations.

9. Security

We employ encryption in transit and at rest, role-based access controls, audit logging, and regular vulnerability assessments. No method of transmission is entirely risk-free; you acknowledge this when connecting third-party accounts or enabling plugins.

10. Your Rights

Subject to local law, you may request:

  • Access to personal data we process about you.
  • Correction of inaccurate personal data.
  • Deletion of data where we have no legal basis to retain it.
  • Restriction or objection to specific processing activities.
  • Data portability for information you provided to us in a structured format.

Submit requests to privacy@qenvy.cloud. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).

11. Children

QEnvy is not directed at children under 16. We do not knowingly process personal data of minors. If you believe we have collected such data, contact us immediately.

12. Updates

We may update this Privacy Policy to reflect operational or legal changes. We will post the revised version at /legal/privacy and update the effective date. Continued use of QEnvy after changes become effective constitutes acceptance of the revised policy.

© 2025 VeGoVeVO. All rights reserved. This Privacy Policy is provided for transparency and does not limit any protections you may have under mandatory law.