Privacy Policy

1. Introduction

This privacy policy describes how Quieta SAS handles your personal data, distinguishing between the Quieta software (desktop application) and the quieta.ai website. It applies worldwide, with specific rights for residents of the European Union / EEA, the United Kingdom, and California and other US states set out in section 7.

2. Data Controller

The data controller (and, under the UK GDPR, the data controller) is:

• Quieta SAS, Société par actions simplifiée
• Registered office: 58 rue de Monceau, 75008 Paris, France
• RCS Paris 103 396 552 · SIREN 103 396 552
• Represented by its legal representative (the President)
• Contact for privacy matters: hello@quieta.ai

For California residents, Quieta SAS is the "business" under the California Consumer Privacy Act (CCPA/CPRA).

We have not appointed a Data Protection Officer (DPO) or a UK / EU representative: the volume and nature of personal data we process do not trigger the legal obligation to designate one.

3. Data Collected

3.1 By Quieta Software

Quieta software runs 100% locally on your device:

• ✅ All anonymization operations are performed exclusively on your machine
• ✅ No personal data or content is sent to our servers or third parties
• ✅ No usage statistics are collected
• ✅ No telemetry is used
• ✅ No account creation is required

Only exception: the software communicates with our servers solely for licence verification (validating your licence key). This communication does not transmit any personal data or any data related to your content.

3.2 By the quieta.ai Website

Our website uses:

• Technical cookies strictly necessary for the site's operation (e.g. language preference)
• Google Analytics, a third-party audience measurement service provided by Google, which collects browsing data (pages visited, visit duration, device type, approximate location) in anonymized form

Google Analytics is only activated after you accept it through the consent banner displayed on your first visit. You can change your choice at any time.

3.3 By our payment processor (Paddle)

Purchases and subscriptions are handled by Paddle.com Market Ltd ("Paddle"), which acts as Merchant of Record and as an independent data controller for the personal data strictly necessary to process your payment, comply with tax obligations, and prevent fraud (name, email, billing address, country, IP, payment method details, order history). See Paddle's Privacy Policy.

Quieta SAS receives, from Paddle, only the minimum data required to deliver the licence and provide customer support (email, order reference, product, country for tax reporting).

4. Purposes, Legal Bases and Retention

Purpose	Data	Legal basis (GDPR / UK GDPR)	Retention
Licence verification	Licence key, basic technical metadata	Performance of the contract (Art. 6-1-b)	Duration of the subscription + legal limitation periods
Website audience measurement	Google Analytics cookies	Consent (Art. 6-1-a)	26 months (Google default)
Customer support	Email address, message content	Performance of the contract / legitimate interest (Art. 6-1-b and 6-1-f)	3 years after last contact
Billing and accounting (via Paddle)	Identity, billing address, order details	Legal obligation (Art. 6-1-c)	10 years (French commercial and tax law)
Fraud prevention (via Paddle)	IP, payment method data	Legitimate interest (Art. 6-1-f)	As defined by Paddle

Under California law, these categories correspond to the "business purposes" of providing the service, processing payments, security, and compliance.

5. Data Sharing

5.1 Software

Quieta software does not sell, share, or transmit your data to any third party. The only external communication concerns licence verification.

5.2 Website

Browsing data collected via Google Analytics is transmitted to Google in accordance with its privacy policy. Beyond this, we do not share website data with third parties.

5.3 Paid subscriptions

Billing data is shared with Paddle (our Merchant of Record) and, where required by law, with French, European, UK or US tax authorities.

5.4 No sale of personal information (California)

We do not sell and do not share personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA), the Virginia CDPA, the Colorado CPA, or similar US state privacy laws. We have not done so in the preceding twelve months.

6. Storage and Security

6.1 Local Storage (Software)

Quieta software stores locally on your device:

• Your configuration preferences
• Your personalized blocklist (terms to anonymize)

This data remains ONLY on your device and is never synchronized with our servers.

6.2 Security

We implement reasonable technical and organizational measures to protect your data: regularly audited source code, security updates, encrypted storage of local configuration data, and access controls on our internal systems.

7. Your Rights — by jurisdiction

To exercise any right below, email hello@quieta.ai or write to Quieta SAS, 58 rue de Monceau, 75008 Paris, France. We reply within the timeframe required by the applicable law (typically one month under GDPR; 45 days under CCPA, extendable once).

We will not discriminate against you for exercising any of these rights: no denial of service, no different prices, no different quality of service.

7.1 European Union / EEA (GDPR)

You have the right to:

• Access your personal data (Art. 15)
• Request rectification (Art. 16) or erasure (Art. 17)
• Restrict processing (Art. 18) or object to it (Art. 21)
• Request data portability (Art. 20)
• Withdraw your consent at any time, where processing is based on consent (Art. 7-3)
• Define directives regarding the fate of your data after death (French Data Protection Act, Art. 85)

You may lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with your local EEA supervisory authority.

7.2 United Kingdom (UK GDPR and Data Protection Act 2018)

UK residents have the same rights as under the EU GDPR. You may lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

7.3 California (CCPA / CPRA) and other US states

If you are a California resident (or a resident of Virginia, Colorado, Connecticut, Utah or another US state with a comprehensive privacy law), you have the right to:

• Know / access what personal information we have collected, the sources, the purposes, and the categories of recipients
• Delete personal information we hold about you, subject to legal exceptions
• Correct inaccurate personal information
• Opt out of the sale or sharing of your personal information (not applicable — we do not sell or share, see section 5.4)
• Limit the use of sensitive personal information (not applicable — we do not use sensitive personal information for purposes that would trigger this right)
• Non-discrimination for exercising your rights

You may designate an authorized agent to submit a request on your behalf, by providing signed permission or a power of attorney.

California residents under 16 cannot have their personal information sold or shared without opt-in consent — but again, we do not sell or share.

7.4 Other jurisdictions

If your country or state grants you similar privacy rights, we will honour them to the extent required by law. Email us and we will work with you in good faith.

8. Cookies

8.1 Website

• Technical cookies: language preference (FR/EN). Duration: 1 year maximum.
• Google Analytics cookies: audience measurement. Only set after your consent (in the EU, UK, and jurisdictions requiring opt-in).

8.2 Software

Quieta software does not use any cookies.

9. International Transfers

As Quieta SAS is based in France, personal data processed for EU/EEA users generally stays in the EU. For users outside the EU, processing may occur in your country or in France.

• EU/EEA → third countries: Google Analytics data may be transferred to Google's servers outside the EU/EEA, subject to the European Commission's standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.
• UK → third countries: transfers are covered by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses.
• Paddle operates from the United Kingdom and the United States; transfers to third countries are covered by appropriate safeguards.

Quieta software itself does not transfer any data internationally.

10. Minors

Quieta software can be used by minors. Since no personal data is collected by the software, no parental consent is required for its use.

Paid subscriptions through Paddle require users to be of legal age in their jurisdiction. We do not knowingly collect personal information from children under 13 (US, COPPA), under 16 (EU/UK), or under 16 (California, CCPA) via our website. If you believe we have, email us and we will delete it.

11. Policy Changes

We reserve the right to modify this privacy policy at any time. Significant changes will be announced on our website or in the application.

Last modified: 20 April 2026.

12. Transparency and Source Code

To back up our privacy commitment, we plan to release the source code of the Quieta anonymization engine under an open-source licence, so anyone can verify that no data collection is performed.

13. Contact

• Email: hello@quieta.ai
• Postal mail: Quieta SAS, 58 rue de Monceau, 75008 Paris, France
• Website: https://quieta.ai