How Quantum processes customer data.

For personal data submitted to, stored in, or generated by the platform in the course of providing services, the customer acts as the controller and Quantum Connect AI, LLC acts as the processor. Where we determine the purposes of processing, for example for our own billing, security, and product operations, we act as a controller and our Privacy Policy governs that processing.

This DPA applies in addition to the Terms of Service. If there is a conflict on data protection matters, this DPA controls.

Processing is limited to what is required to deliver the contracted services.

• Subject matter: operation of the AI revenue layer across lead, communication, inventory, and CRM workflows.
• Duration: the term of the agreement, plus any agreed retention window.
• Categories of data subjects: dealership staff, prospective buyers, and existing customers.
• Categories of personal data: identifiers, contact details, communication content and metadata, vehicle and shopping interest data, and system activity records.
• Special categories: not requested and not required. Customers should not submit them.

We process personal data only on documented instructions from the customer, including the configuration choices made in the platform such as agent enablement, ownership rules, consent settings, and quiet hours. We will inform the customer if an instruction appears to conflict with applicable data protection law.

• Encryption in transit using TLS, and encryption at rest for stored data.
• Row level security and tenant scoping so each rooftop can reach only its own records.
• Role based access control and least privilege for internal personnel.
• Append only event history for auditability of automated and human actions.
• Secret management for third party credentials, with rotation on request.
• Logging and monitoring of platform and integration activity.

We use vetted service providers to deliver hosting, communications, and model inference. Each provider is bound by written terms no less protective than this DPA. We remain responsible for their performance. Customers may request the current provider list and advance notice of material changes by contacting us.

Taking into account the nature of the processing, we assist the customer in responding to access, correction, deletion, restriction, portability, and objection requests. If a request reaches us directly, we forward it to the customer rather than responding on their behalf, unless legally required to do so.

We notify the customer without undue delay after becoming aware of a personal data breach affecting their data, and in any case within seventy two hours where feasible. Notification includes the nature of the incident, categories and approximate volume of records involved, likely consequences, and the measures taken or proposed.

Primary processing and storage occur in the United States. Where personal data is transferred from a jurisdiction requiring a transfer mechanism, the parties rely on Standard Contractual Clauses or another lawful mechanism, together with appropriate supplementary measures.

Personal data is retained for the term of the agreement and any configured retention window. On termination, and at the customer's election, we delete or return customer personal data within thirty days, except where retention is required by law or for the resolution of disputes. Backups age out on their normal cycle.

We maintain records of processing activities and make available the information reasonably necessary to demonstrate compliance with this DPA. Customers may request a security review no more than once per year, or following a confirmed incident affecting their data, subject to reasonable notice and confidentiality.

To request a countersigned copy of this DPA, the current provider list, or a security review, contact legal@quantumconnectai.com or write to Quantum Connect AI, LLC, 1120 S Rackham Way, Suite 300, Meridian, ID 83642.