Privacy policy
Quandify AB – Privacy Policy
Last updated: November 2025
Quandify AB (“Quandify”, “we”, “our”, “us”) is committed to protecting your privacy.
This Policy explains what data we collect, how we use it, and what rights you have when using Quandify devices, the Quandify App, and the Quandify Platform (“Services”).
1. Who we are
Quandify AB
Gustavslundsvägen 151E
167 51, Bromma, Sweden
Organisation No. 559134-5904
Support 📧 support@quandify.com
Privacy 📧 privacy@quandify.com
Website 🌐 https://quandify.com
Quandify acts as:
- Data Controller for consumer accounts;
- Data Processor for Business Customers who control end-user data (under a Data Processing Agreement).
2. Personal data we collect
We collect the minimum information necessary to provide the Services.
Category - Examples - Legal basis (GDPR Art.)
Account data - Name, email address, password (hash), username - Art. 6 (1)(b) – Contract
Device data - Sensor measurements (e.g., flow, temperature, diagnostics, alerts), firmware version, serial number - Art. 6 (1)(b) – Contract
App & usage data - App settings, notification preferences, connectivity status, logs (≤ 30 days) - Art. 6 (1)(f) – Legitimate interest (ensure security & function)
Support & communication - Emails or chat messages with Quandify support - Art. 6 (1)(b)/(f)
Business Customer data - Company name, VAT, billing details, contact persons - Art. 6 (1)(b) – Contract
Marketing (optional) - Email address for updates or newsletters (if opt-in) - Art. 6 (1)(a) – Consent
We do not collect payment-card data directly; payments are processed through certified third-party providers.
3. Why we process your data
We use data only for legitimate purposes:
- Provide and operate the Services – device connectivity, analytics, and user interface.
- Detect and notify events – such as leak alarms, abnormal readings, or system faults.
- Maintain security and integrity – authentication, logging, and fraud prevention.
- Improve performance – anonymised statistics and aggregated analysis.
- Customer support – troubleshooting and service communications.
- Legal and compliance – warranties, record-keeping, and regulatory requests.
- Marketing (only with consent) – product updates and surveys.
Quandify does not sell, rent, or trade personal data.
4. How data is stored and secured
- Hosting region All personal and device data are stored within the European Economic Area (EEA) in secure cloud data centres.
- Encryption Quandify uses industry-standard encryption and security measures to protect information during transmission and storage. This includes established methods for encrypting data, authenticating users and devices, and monitoring system integrity.
- Backups & redundancy Encrypted backups are maintained regularly within to ensure service continuity and disaster recovery.
- Access controls Data access is limited to authorised personnel following role-based permissions and logged administrative actions.
- Device security Each Quandify device communicates through secure, authenticated channels and is designed to prevent unauthorised access or tampering.
5. Data retention
Data type - Retention period - Action after expiry
Account identifiers (email, username) - While account is active - Deleted or anonymised
Device logs - ≤ 30 days - Deleted automatically
Sensor / usage data - Life of account, then anonymised for aggregate analytics - Anonymised
Support tickets - > 24 months - Deleted or archived for legal claims
Business billing records - 7 years (as required by Swedish law) - Archived / deleted after limit
We retain personal data no longer than necessary for the purposes stated, in line with GDPR Art. 5(1)(e).
6. Data sharing and recipients
We share data only when necessary:
Recipient type - Purpose - Safeguard -
Cloud service providers - Hosting, storage, data transfer (EEA) - GDPR Art. 28 DPAs in place
Technical support partners - Maintenance and troubleshooting - Restricted access
Business Customers - Where they control end-user data (e.g., property deployments) - Data Processing Agreement
Public authorities - Legal obligations or lawful requests - Only if required by law
We do not transfer personal data outside the EEA unless adequate protection is ensured (Art. 46 GDPR Standard Contractual Clauses).
7. User rights
You have the following rights under GDPR:
- Access – request a copy of your data.
- Rectification – correct inaccurate data.
- Erasure – delete data when no longer needed (Art. 17).
- Restriction – temporarily limit processing.
- Portability – receive data in a structured format.
- Objection – opt out of processing based on legitimate interest.
- Withdraw consent – at any time for optional features.
To exercise these rights, contact privacy@quandify.com. Quandify will respond within 30 days (extendable by 2 months for complex requests). If you believe your rights are violated, you may lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or your local EU Data Protection Authority.
8. Business Customers and controllers
For corporate deployments:
- Quandify acts as processor; the Business Customer is controller.
- A Data Processing Agreement (DPA) specifies roles, retention, and security measures.
- Business Customers must ensure their end-users receive privacy information and can exercise rights.
9. Cookies and tracking
Our website and app use essential cookies for security and session management. Non-essential analytics or marketing cookies are used only with consent. You can change preferences at any time in your browser or device settings.
10. Children’s privacy
Quandify Services are not intended for children under 16. We do not knowingly collect data from minors. If you believe a child has provided data, contact us for immediate deletion.
11. Data Act information obligations
In accordance with EU Data Act Article 3(2), Quandify provides clear information on:
- categories and formats of data generated by Quandify devices,
- access and retrieval methods via the Quandify App and support channels,
- storage location (EEA cloud centres), security measures, and retention periods,
- users’ rights to port, delete, and share data with third parties at their request.
12. Changes to this Policy
Quandify reserves the right to modify this Privacy Policy at any time. Any changes will be posted on this page and will apply to all new orders placed after the changes are published. We recommend that you review these terms periodically to stay informed.
13. Relationship with Shopify
The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services for you. Information you submit to the Services will be transmitted to and shared with Shopify as well as third parties that may be located in countries other than where you reside, in order to provide and improve the Services for you. In addition, to help protect, grow, and improve our business, we use certain Shopify enhanced features that incorporate data and information obtained from your interactions with our Store, along with other merchants and with Shopify. To provide these enhanced features, Shopify may make use of personal information collected about your interactions with our store, along with other merchants, and with Shopify. In these circumstances, Shopify is responsible for the processing of your personal information, including for responding to your requests to exercise your rights over use of your personal information for these purposes. To learn more about how Shopify uses your personal information and any rights you may have, you can visit the Shopify Consumer Privacy Policy . Depending on where you live, you may exercise certain rights with respect to your personal information here Shopify Privacy Portal Link.
14. Third Party Websites and Links
The Services may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites. Information you provide on public or semi-public venues, including information you share on third-party social networking platforms may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.
15. Contact us
Gustavslundsvägen 151E 167 51, Bromma Sweden