Privacy Policy

Version 2026-10-06 · in effect from 6 October 2026

1. About this policy

This policy explains how Quantamsecure Private Limited ("we", "us"), the company that provides QureMail, handles personal data. It applies from 6 October 2026. It is written for the organisations that use QureMail, their admins and users, and anyone whose mail passes through the service.

QureMail is an email security service for businesses. An organisation (our customer) signs up and asks us to check its incoming mail. Words such as "admin" and "your users" have the meaning given in our Terms of Service.

2. Our two roles

We handle personal data in two different roles, and your rights depend on which one applies.

As a service provider to our customer. When we check an organisation's mail, we process the mail and the personal data in it on that organisation's behalf and on its instructions. The organisation decides why its mail is checked and is responsible to its people for that decision. In the language of India's Digital Personal Data Protection Act, 2023, the organisation is the Data Fiduciary and we are its Data Processor.
For our own purposes. For the account details of the people who sign in to QureMail, for billing, for support requests and for the records we keep to run and protect the service, we decide how the data is used. For this data we are the Data Fiduciary.

3. Data we process for our customers

Depending on how the organisation connects and which features it turns on, we process:

Mail sent to the organisation's protected domains and mailboxes: the message, its attachments and its details, such as sender, recipients, subject, date, sending server and the results of our checks.
Mail records: a log of each message we checked, with sender, recipients, subject (shortened) and what we did with it.
Held mail: messages we hold in quarantine, with a list entry showing sender, recipient and subject. Admins can open a safe preview and release, block or delete held mail. Every preview and action is recorded.
Link clicks: when link checking is on, each click on a checked link creates a record with a reference to the message, a coded reference to the recipients (not their addresses), a fingerprint of the link and the name of the site it points to, the result of the check and the time. The address of the device that clicked is used for about an hour to detect misuse of a link and is not stored with the record.
Link fingerprints: fingerprints of the links in each message and the names of the sites they point to, so that a link later found to be harmful can be blocked in mail already delivered.
Reports: messages that admins or users report to us as missed or wrongly held, and who reported them.
Directory data from Microsoft 365, where the organisation connects it: the names and addresses of people, aliases, groups and shared mailboxes, so we accept mail only for real addresses.
Mailbox data from Microsoft 365, where the organisation uses our Microsoft API connection: the messages and folders of protected mailboxes, which we read to check new mail and in which we move held mail to a hidden folder.
Correspondence history, only if an admin agrees in QureMail: from Microsoft 365, the sender, date and sender authentication results of the last 120 days of inbox mail, and the outside addresses users send mail to and when. We never read the subject or body for this, and we store the addresses only as coded fingerprints.
AI check data: for the small share of uncertain mail sent to the AI check, the headers, a shortened text, attachment names and types, the names of linked sites and our own check results, and the result and reasoning that come back.

4. Data we decide about

Account data: the name, work email address, role and organisation of admins and users who sign in, their password (stored only in a protected, one-way form) and their two-step sign-in settings.
Sign-in records: each sign-in session, with the device's IP address and browser details, used to keep accounts secure.
Audit records: what admins, users and our staff did in each organisation, such as changing settings, releasing mail or looking at mail records.
Billing data: the organisation's billing contact, plan, invoices, GST details and payment status. Card and bank details are handled by our payment provider, not stored by us.
Support requests: the email address, topic and message you send us, and the organisation and domain you choose.
Your agreement: who agreed to our Terms of Service and this policy, which version, and when.
Cookies and similar storage in your browser (see section 13).

5. Why we use personal data

For our customers, we use their mail and related data only to provide the service they ask for:

to check mail and deliver it, warn about it or hold it.
to show admins and users their mail records, held mail and reports, and to send digests and notices.
to check links when clicked and to block links found to be harmful.
to keep our detection accurate. We learn from mail reported as missed or wrongly held and from patterns in the mail we check, and we keep what we learn as fingerprints and statistics rather than whole messages where we can.
to investigate and fix problems and to protect the service and our customers from attacks.

For the data we decide about, we use it to create and secure accounts, let people sign in, run and bill the service, answer support requests, send service notices, keep records the law requires, and show that notice was given and agreement recorded. We process it with the consent given when you sign up, and for the uses the law allows for data you give us for a stated purpose. You can withdraw consent at any time (see section 11), but we cannot run an account without the data needed for it.

We do not sell personal data. We do not use it for advertising. We do not use customers' mail to train an outside AI provider's models.

6. Where your data is stored and processed

For organisations in India, scanning, storage and quarantine stay in India. Our backups are stored in India too, with a different provider from the one that runs the service. If we serve customers in another country, their scanning, storage and quarantine stay in their own country.

Two things happen outside India:

The AI check is sent to an AI model provider outside India. It is not covered by the statement above. An admin can turn the AI check off, or exclude some mail from it, in Settings.
The emails we send, such as digests, reports, invitations, sign-in links and billing notices, are delivered by a mail delivery provider in the United States. These emails carry details of held mail such as sender and subject, but never the held message itself.

We transfer data outside India only as Indian law permits.

7. Who we share data with

We share personal data only with:

Service providers who help us run QureMail, under contracts that limit them to our instructions and require them to protect the data: cloud hosting providers in India, a backup storage provider in India, a mail delivery provider in the United States, an AI model provider outside India and a payment provider. We give customers the names of these providers under their agreement with us, on request.
Public reputation services, which we ask whether a sending server's address or a website name is known to be harmful. These questions carry no message content.
Microsoft, where the organisation connects its Microsoft 365 tenant. Microsoft is the organisation's own provider, and we act in that tenant only with the permissions the organisation grants.
The customer organisation itself: admins see mail records and held mail for their organisation, and users see their own.
Authorities, when the law requires it or a court orders it. Where the law allows, we tell the customer first.
A buyer or successor, if our business is sold or reorganised, under the same protections as this policy.

8. How long we keep data

Mail records (details of each message checked): 90 days.
Held mail (the message itself): 30 days, unless released or deleted sooner.
List entries for held mail (sender, recipient, subject): 90 days.
AI check results and reasoning: 90 days.
Link fingerprints from mail: 135 days.
Click records: 12 months.
Known-correspondent records (coded fingerprints of addresses): 120 days after the last mail with that person.
Monthly totals for each organisation: the counts are kept for the life of the account and are never reset. They contain no personal data. The names of top recipients inside them are removed after 12 months.
Audit records: 12 months.
Support requests: 12 months.
Undelivered email addresses: when our mail delivery provider stops delivering our emails to an address, the address and the reason are kept while delivery is stopped and for up to 90 days afterwards.
Sign-in sessions, with IP address and browser details: deleted within a day after the session ends. A session ends after 8 hours without activity, and at most 3 days after sign-in.
Sign-ups never confirmed by email: 7 days.
Account data: for as long as the account exists, then erased with the organisation's data.
Reports of missed or wrongly held mail: while they help keep detection accurate, and no longer than the organisation's other data.
Billing and invoice records: kept as part of our financial and tax records.
Records of our staff's access to an organisation's mail: kept after the organisation's other data is erased.
Records of agreement to our terms and this policy: kept for as long as we may need to show that notice was given and agreement recorded, including after the organisation's other data is erased.
Backups: daily backups for 30 days. Monthly backups for 12 months, holding only the records listed in section 9 as kept after erasure.

9. When an organisation leaves

An admin can close the organisation in Settings. We erase the organisation's data 30 days after it is closed. After erasure we keep only its audit records (for their normal 12 months), its monthly totals (counts only, with names and addresses removed), billing records, records of our staff's access to its mail and the record of agreement to our terms.

Erased data can remain in our encrypted daily backups for up to 30 days after erasure, until those backups expire. With our Microsoft API connection, held mail also sits in the organisation's own mailboxes. We erase our copy, and the copy in those mailboxes stays with the organisation.

10. Security

We protect personal data with reasonable security measures suited to an email security service. These include encryption in transit where the other side supports it, encrypted storage of held mail and backups, strict separation of each organisation's data, two-step sign-in, limited and recorded staff access, safe previews that never run content from held mail, and backups we test by restoring them.

If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires. If it affects data we process for a customer, we tell that customer without undue delay so it can meet its own duties.

11. Your rights

If we decide about your data (section 2), you can:

ask for a summary of the personal data we hold about you and how we use it, and who we have shared it with.
ask us to correct, complete or update it.
ask us to erase it, where we no longer need it for the purpose or by law.
withdraw your consent, as easily as you gave it.
nominate another person to exercise your rights if you die or cannot act.
complain to us about how we have handled your data.

To use these rights, write to support@quantamsecure.com. You can also update your own account details in the dashboard. We may need to confirm your identity first. We respond within the time the law sets.

If you are not satisfied with our answer to your complaint, you can complain to the Data Protection Board of India. The law asks you to raise the complaint with us first.

12. If your employer uses QureMail

If your work mail passes through QureMail because your employer or another organisation uses it, that organisation decides how your mail is handled, including whether its admins may review your held mail. Please contact that organisation first about your rights. If you contact us, we will pass your request to it and help it answer.

13. Cookies

QureMail uses only the cookies and browser storage it needs to work. We do not use advertising or analytics cookies, and we do not let other companies track you through QureMail.

Sign-in cookies: keep you signed in and protect sign-in. They end when you close your browser or your session ends.
Preference cookies: remember your display theme and date range (180 days), and whether the side menu is pinned and which domain you last selected (1 year).
Browser storage: remembers the layout of some screens, such as the size of the reading pane. It stays on your device.

If you block these cookies, you will not be able to sign in, or your preferences will not be remembered.

14. Children

QureMail is a service for organisations and is not meant for children. We do not knowingly collect personal data from anyone under 18 for our own purposes. Mail sent to a customer's mailboxes is handled for that customer.

15. Changes to this policy

We may update this policy. Each version has a date and is published at /privacy, with earlier versions kept. If a change is material, we will tell admins at least 30 days before it takes effect and ask them to review it at their next sign-in. Other changes take effect when published.

16. Language

You can ask us for this policy in English or in any language listed in the Eighth Schedule to the Constitution of India by writing to support@quantamsecure.com.

17. Contact and grievances

Quantamsecure Private Limited, 898, Block H, 10th Street, Chennai, Tamil Nadu 600040, India.

For questions about this policy, to use your rights or to make a complaint, contact the person responsible for privacy and grievances, Suresh, Director, at support@quantamsecure.com. For anything else, write to support@quantamsecure.com.