Legal
Privacy Policy
Effective: June 20, 2026 · Last updated: June 20, 2026 · Queldrex LLC, a Colorado limited liability company
1. Who We Are
Queldrex LLC (“Queldrex,” “we,” “us,” or “our”) is a Colorado limited liability company headquartered in Castle Rock, Colorado. We operate queldrex.com and provide AI visibility scanning tools, security tools, subscription monitoring services, and custom software development. Questions about this policy: hello@queldrex.com.
2. What Information We Collect
We collect only what is necessary to deliver our services:
- Trust Layer / “Verified” ($49/month), the MCP server URLs and tool definitions you submit for scanning, your email address, and the governance records we generate: scan verdicts, the cryptographically signed receipts we issue, and continuous-monitoring results. Submitted tool content is processed to produce verdicts and receipts; receipts and monitoring history are retained while your subscription is active and for 12 months after cancellation.
- AI Visibility Scanner ($399 one-time), the domain URL you submit and your email address. Used to run the scan and deliver your report. Paid scan results retained 12 months; free scan data deleted after 48 hours.
- AI Visibility Monitor ($39/month), your email address and monitored domain(s). We store monthly scan scores and history to power alerts and your dashboard. Retained while subscription is active and 12 months after cancellation.
- Agency Plan ($199/month), agency name, email address, client domain list, and scan history for up to 25 client domains per month. Retained while subscription is active and 12 months after cancellation.
- Tool Marketplace and Pro ($39/month), no account is required to try a tool. For a one-time purchase or Pro subscription we store your email and Stripe identifiers to grant access. Code, text, and files you submit to a tool are processed to produce your result and are not stored after the session, unless a tool explicitly saves your work (for example, a link you shorten).
- Directory Extractor, Threat Intelligence Feed, Breach Lookup (Free Tools), no account or email required. URLs submitted to the Directory Extractor are not logged. Breach Lookup password checks use k-anonymity (your password is never sent to our servers or to Have I Been Pwned in full). Domain security queries are not linked to your identity.
- Build for Me (Custom Development), name, email, company, project description, budget, and all project communications. Retained for 7 years for business and tax records.
- Payment data, processed entirely by Stripe, Inc. Queldrex never receives, stores, or has access to your card number, CVV, or full card details. We store: Stripe customer ID, subscription ID, and payment status only.
- Security and server logs, IP addresses of all requests, retained for 30 days for security monitoring, fraud prevention, and rate limiting.
- Cookies, functional session cookies only (e.g., cookie consent preference). No advertising cookies and no cross-site tracking are used on this site. We use Vercel Web Analytics, which is cookieless and measures aggregate page views and product events without building an advertising profile or tracking you across other sites.
3. How We Use Your Information
- Deliver purchased scan reports and tool outputs
- Send monthly AI visibility scan results and score-drop alerts (Monitor/Agency subscribers)
- Send magic-link login emails for dashboard access
- Process subscription billing and send receipts via Stripe
- Respond to support requests and project inquiries
- Fraud prevention and admin security monitoring
- Comply with legal obligations (tax, business records)
- Improve tool accuracy and signal coverage
We do not sell, rent, share, or trade your personal data with any third party for marketing or advertising purposes. We do not send promotional emails unless you explicitly opt in.
4. What We Do NOT Do
- We do not sell your personal data to any third party
- We do not share your data with advertisers
- We do not use Google Analytics, Facebook Pixel, or any advertising or cross-site tracking technology
- We do not use tracking cookies or third-party analytics cookies (the privacy-friendly, cookieless Vercel Web Analytics we do use measures only aggregate page views and product events)
- We do not store your payment card details
- We do not retain submitted code or security scan data after your session
6. Data Retention
- Free scan data, deleted after 48 hours
- Paid scan reports, retained 12 months
- Monitor and Agency scan history, retained while subscription is active + 12 months after cancellation
- Custom development project records, retained 7 years (tax and business records)
- Payment records, retained 7 years as required by law
- Security and server logs, retained 30 days
- Credentials submitted for custom development, encrypted at rest, deleted within 48 hours of project completion and confirmed by email
7. Your Privacy Rights (Colorado, California, and every other US state)
Queldrex LLC is a Colorado company, so the Colorado Privacy Act (C.R.S. § 6-1-1301 et seq., effective July 1, 2023) is our home law. Queldrex currently processes data below the CPA's mandatory applicability thresholds (100,000 consumers/year, or 25,000 consumers/year when deriving revenue from selling data), and below the equivalent thresholds in other states.
Rather than write a different policy for each state, we grant the following rights to everyone, in every state and country, regardless of whether a law requires it of us. That covers residents of states with comprehensive privacy laws, including California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and Florida:
- Right to Access, request a copy of the personal data we hold about you
- Right to Correct, request correction of inaccurate personal data
- Right to Delete, request deletion of your personal data (subject to legal retention requirements)
- Right to Data Portability, receive your data in a portable format
- Right to Opt Out of Sale, we do not sell personal data. There is nothing to opt out of.
- Right to Appeal, if we deny a request, you may appeal by emailing hello@queldrex.com
- Universal opt-out signal (Global Privacy Control), we honor GPC. If your browser sends a GPC signal (or the older Do Not Track), we do not load analytics at all for your visit, so nothing is measured and nothing is sent. You do not have to contact us or fill in a form; the signal is enough.
To exercise any right, email hello@queldrex.com. We will respond within 45 days as required by the Colorado Privacy Act (extendable by an additional 45 days with notice for complex requests). We will not discriminate against you for exercising any of these rights.
For California residents (CCPA/CPRA)
- We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Because we do not sell or share, there is no "Do Not Sell or Share My Personal Information" transaction to opt out of, and we run no financial-incentive programs tied to your data.
- Sensitive personal information, we do not collect it to infer characteristics about you, so there is nothing to limit.
- Automated decision-making, we do not use automated decision-making or profiling to make decisions about you that produce legal or similarly significant effects. Our scanners score AI tools, prompts, and content, not people.
8. Security
We take reasonable measures to protect your information:
- All data is transmitted over HTTPS/TLS
- Credentials submitted for custom development are encrypted at rest using AES-256-GCM
- Payment processing is handled entirely by Stripe, card data never touches our servers
- Admin access is protected by TOTP two-factor authentication and IP-based rate limiting
Security Breach Notification:In the event of a security breach affecting Colorado residents' personal data, Queldrex will notify affected individuals in the most expedient time possible and no later than 30 days after discovery, as required by Colorado Revised Statutes § 6-1-716.
9. Third-Party Services
We use the following services to operate our platform, each subject to its own privacy policy:
- Stripe, payment processing. Card data never reaches Queldrex. stripe.com/privacy
- Upstash / Redis, database for scan results, subscriptions, and tool data. upstash.com privacy
- Resend, transactional email (scan reports, magic links, alerts). resend.com/privacy
- Vercel, website hosting and serverless infrastructure. vercel.com/legal/privacy-policy
- Have I Been Pwned (HIBP), breach lookup uses k-anonymity: only the first 5 characters of a SHA-1 hash are sent to HIBP's API. Your full password or email is never transmitted.
- Vercel Web Analytics, a cookieless, privacy-friendly analytics service that measures aggregate page views and product events. It does not use cookies, does not build an advertising profile, and does not track you across other sites.
We do not use Google Analytics, Facebook Pixel, LinkedIn Insight Tag, or any advertising network technology.
10. Additional Rights, EU/EEA Residents (GDPR)
If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR). We process your personal data on the following legal bases:
- Contract performance, when you purchase a scan, subscribe, or use a paid tool, processing is necessary to deliver the service.
- Legitimate interests, server logs for security, fraud prevention, and abuse detection.
- Legal obligations, tax records and business compliance.
In addition to the rights in Section 7, EU/EEA residents have the right to: object to processing based on legitimate interests; restrict processing in limited circumstances; and lodge a complaint with your local data protection authority (supervisory authority) in your EU member state.
We transfer data to US-based processors (Stripe, Vercel, Upstash, Resend) under standard contractual clauses or their applicable transfer mechanisms. We are not required to designate an EU representative as we do not engage in large-scale processing of EU personal data. Contact: hello@queldrex.com.
11. Email Communications (CAN-SPAM)
Queldrex sends transactional emails only: scan reports, subscription receipts, score alerts, and magic login links. These are not marketing emails. We do not send unsolicited commercial email. All emails include:
- Our identity (Queldrex LLC) and business address (Castle Rock, CO 80104)
- A way to opt out of non-essential email communications
To stop transactional emails, cancel your subscription or email hello@queldrex.com.
12. Children's Privacy (COPPA)
Queldrex tools and services are intended for users 18 years of age and older and are not directed at children. We do not knowingly collect personal information from anyone under 13. If we discover we have inadvertently collected data from a child under 13, we will delete it immediately. If you believe a child has provided us with personal information, contact us at hello@queldrex.com.
13. Copyright / DMCA
Queldrex respects intellectual property rights. If you believe content on queldrex.com infringes your copyright, send a DMCA takedown notice to hello@queldrex.com with: identification of the copyrighted work, identification of the infringing content and its location, your contact information, a statement of good faith belief, and your signature. We will respond promptly.
14. HIPAA and Financial Privacy
Queldrex is not a covered entity under HIPAA and does not handle protected health information. Queldrex is not a financial institution subject to the Gramm-Leach-Bliley Act. These regulations do not apply to our services.
15. Accessibility
Queldrex is committed to making queldrex.com accessible to users with disabilities. We make good faith efforts to comply with WCAG 2.1 Level AA guidelines. If you encounter an accessibility barrier, please email hello@queldrex.com and we will address it promptly.
16. Changes to This Policy
We may update this Privacy Policy when our services or legal requirements change. Material changes will be emailed to active subscribers at least 14 days before taking effect. Continued use of our services after the effective date constitutes acceptance of the revised policy.
17. Contact
For any questions, concerns, or to exercise your rights under this policy or applicable law, contact us at hello@queldrex.com. We respond to general inquiries within one business day and to formal data rights requests within 45 days as required by the Colorado Privacy Act.
Queldrex LLC · Castle Rock, Colorado · hello@queldrex.com · queldrex.com