Privacy Policy

Effective date: 28 July 2026

This Privacy Policy explains what personal data Quik.mn collects, why we collect it, how long we keep it, who we share it with, and what rights you have. In short: we run a link-management platform; we record account details you give us and technical event logs (clicks, scans, page views, email opens) in which your IP address is replaced by a keyed hash; we use an offline geolocation dataset, so your IP address is never sent to a third party for location lookup; we set no advertising cookies, use no analytics or advertising SDKs, and we do not sell personal data. Where our customers collect data through forms and pages they build on Quik, the customer is responsible for that data and we process it on their behalf. Please read the full policy — especially Section 4 (what we collect), Section 11 (how long we keep it) and Section 12 (your rights).

1. Who we are

The Quik service (the "Service") is operated by two affiliated companies. Which company you contract with — and which company is the controller of your personal data — depends on the commercial region recorded on your account:

• Mongolia region: Заалт ЭйАй ХХК (Zaalt AI LLC), a company incorporated in Mongolia, is the controller for accounts in the mn region.
• Global region: QuikMN LLC is the controller for accounts in the global region.

Your region is determined once, at signup, from the approximate country associated with your IP address, and is then recorded on your account. It does not change automatically afterwards; only our administrators can change it, on request. Your region determines your contracting entity and billing currency. It does not determine the language of the user interface, which you may choose freely at any time.

In this policy, "Quik", "we", "us" and "our" mean the entity that is the controller for your account (or, for visitors without an account, the entity operating the page you visited). You can contact us — including to request the registered address of the relevant entity — through our contact page at /contact. Billing enquiries: billing@quik.mn.

The Service is provided at quik.mn (public site, short-link redirects and the API), app.quik.mn (customer application) and admin.quik.mn (administration panel).

2. Scope of this policy

This policy covers personal data processed through the Service: our websites, the customer application, the REST API, short-link redirects, and the public pages our customers publish through the Service (Quik Bio pages, Menu QR pages, Countdown pages, Quik Forms, and link interstitial, password and expiry pages).

This policy does not cover:

• Destination websites. A short link forwards you to a destination chosen by the person who created the link. Once you leave our redirect, the destination site's own privacy practices apply. We do not control them.
• Our customers' own data practices. Where a customer collects personal data through a Quik Form or another page they publish on the Service, the customer decides what to collect and why. We act only as their processor (see Sections 3, 17 and 18). The customer's own privacy notice governs that collection.
• Other third-party services you reach through the Service.

3. The roles we play

We process personal data in three distinct roles. This allocation matters, because it determines who is legally responsible for what:

• Quik as controller. We are the controller for the personal data we collect for our own purposes: your account and profile data, authentication data, our security and abuse-prevention logs, the pseudonymised analytics events we generate (clicks, scans, views, opens), billing records, and messages you send us. Sections 4–16 of this policy describe this processing.
• Quik as processor. Where a customer uses the Service to collect data from other people — above all through Quik Forms submissions, and more generally through the pages the customer publishes and the analytics generated about the customer's audience — the customer is the controller of that data and we process it only on the customer's behalf and instructions. The customer is responsible for having a lawful basis, for providing a privacy notice to their audience, and for answering data-subject requests about that data. Section 18 contains our processor terms.
• Neither. For destination websites reached through a short link, and for content on third-party sites, we are neither controller nor processor.

4. Personal data we collect

We list every category below, organised by source. We collect no categories beyond these.

4.1 Data you give us when you create and use an account

• Account data: name, email address, chosen UI language (locale), account role and status, whether your email is verified, your commercial region and a record of who set it and when, your plan and plan expiry for each product, and the time of your last login.
• Profile preferences: settings you save, stored as a preferences record — this may include a phone number if you choose to enter one, your theme, language, numeral style, notification toggles and default redirect type. The phone number is optional and provided by you.
• Authentication data: a bcrypt hash of your password (we never store the password itself); if you enable two-factor authentication, the shared secret for your authenticator app; hashed session keys, hashed remember-me tokens and hashed API keys (for API keys we retain only a SHA-256 hash and a 12-character prefix); and one-time tokens for email verification and password reset.
• Signup attribution (captured once, at registration): the approximate country and city derived from your IP address at signup (with the dataset's city-centroid coordinates — see Section 6), the external URL that referred you to us, the first page you landed on including its query string, any UTM parameters (source, medium, campaign) in that URL, and, where you arrived through a Quik link, the identifier of that link. We use this to understand how people find the Service. It is captured only at that one moment.

4.2 Data generated when the Service is used

• Click analytics: one record per click on a short link, containing a keyed hash of the visitor's IP address (see Section 4.4), device type, operating system, browser family, the referring URL (truncated to 255 characters) and its source category, country code, city name, city-centroid coordinates from our geolocation dataset, a bot flag, a unique-visitor flag, and the timestamp. We also keep daily aggregate counters per link.
• Page-view and scan logs: Bio page views, Menu QR scans (including the table number encoded in the QR, where used) and Form views, each recording an IP hash and device type.
• Email-open events (Email Counter): when an email containing a Quik Email Counter image is opened, loading the image records an IP hash and the mail-client family derived from the User-Agent. This is open tracking: a customer who embeds an Email Counter in an email is thereby tracking opens by their recipients (see Section 17). The image endpoint sets no cookie.
• API request logs: user ID, API key ID, HTTP method, endpoint, response status and IP hash for each API request.
• Session records: for each login session, a hashed session key, an IP hash, the raw User-Agent string of your browser, and the last-seen time.
• Webhook data: the endpoint URL you configure, the signing secret used to authenticate our requests to your endpoint, and delivery records containing the JSON payloads we sent (link or timer metadata, including destination URLs).
• Uploaded images: Bio avatars, Countdown backgrounds, signature logos and Email Counter expiry images. Uploads are re-encoded server-side and stored outside the web root.
• Notifications generated for you inside the app.

4.3 Data from specific interactions

• Contact messages: the name, email address and message you submit at /contact, plus an IP hash.
• Abuse reports: the reason, any free-text detail, and an IP hash of the reporter.
• Payments ledger: for paid plans (currently recorded manually by an administrator after an offline payment), we keep the user, region, contracting company, product, plan, amount, currency, payment method (bank transfer, QPay, cash or other), provider and provider transaction reference, status, invoice number, period and payment date. We store no card numbers and no bank account numbers.
• Administrative audit records: when our administrators act on an account, we log the administrator, the action, the target and contextual metadata (which may include a customer email address), plus an IP hash.
• Rate-limit records: see Section 4.4 — this is the one place a raw IP address is briefly held.

4.4 IP addresses — pseudonymisation, stated precisely

We designed the Service so that the raw IP address of a visitor is never written into any analytics or log table. Instead, we store an IP hash: an HMAC-SHA256 of the IP address computed with a secret key held on our server. This is pseudonymisation, not anonymisation. Because the key is a single server-wide secret with no per-record salt and no rotation, the same IP address always produces the same hash. That stability is deliberate: it is what allows us to count unique visitors and detect repeated abuse without keeping the address itself. It also means the hash remains personal data under the GDPR and similar laws — with access to the server key, the mapping could in principle be reproduced — and we treat it as personal data accordingly. We do not claim it is anonymous.

One exception: our rate-limiting system stores the raw IP address in cleartext as part of the rate-limit bucket key for sensitive actions (login, registration, contact, abuse reports, anonymous link creation, and link-password attempts). These records are deleted after one day.

The raw IP address is otherwise used only transiently in server memory — to compute the hash and to look up approximate location in our offline dataset — and is then discarded. We read the IP from the direct connection only; we do not trust forwarded-for headers.

4.5 Data our customers collect through the Service (customer-controlled)

Form submissions: when someone submits a Quik Form, the submitted answers are stored for the customer who owns the form. The customer decides what the form asks; submissions routinely contain third parties' names, email addresses and phone numbers (field types: short text, long text, email, phone, select, checkbox; there is no file-upload field). For this data, the customer is the controller and Quik is the processor. More broadly, the content a customer publishes on their Bio, Menu, Countdown and Form pages is the customer's content.

5. What we deliberately do not collect

The following is a factual description of the Service as built, and part of its design:

• No raw IP addresses in analytics. No analytics or log table contains a cleartext IP address (sole exception: the one-day rate-limit records described above).
• No precise or device location. We never collect GPS or device location. Browser geolocation is affirmatively disabled on our pages by a Permissions-Policy: geolocation=() header. Location in our analytics is country and city only, taken from an offline dataset (Section 6).
• No third-party GeoIP lookups. Your IP address is never sent to any external service to determine location.
• No payment card or bank account numbers. We store no card numbers, no PAN, no IBAN and no billing address.
• No advertising or cross-site tracking cookies. All our cookies are strictly necessary or preference cookies (Section 8). We set no third-party cookies.
• No analytics, advertising or error-tracking SDKs. No Google Analytics, no Meta pixel, no comparable third-party tracker runs on our pages.
• No sale of personal data. We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising.

6. Geolocation, explained precisely

All geolocation in the Service is performed offline, on our own server, using locally stored copies of the DB-IP Country Lite and DB-IP City Lite datasets, refreshed monthly. No visitor IP address ever leaves our server for geolocation. The result is a country code, a city name, and coordinates — and the coordinates are the dataset's centroid for that city, not the visitor's actual position. Private and reserved IP addresses yield no location at all. We also use the APNIC delegation registry, downloaded to our server, solely to suggest a default interface language to first-time visitors; nothing is sent to APNIC.

Attribution required by the dataset licence (CC BY 4.0): IP Geolocation by DB-IP (db-ip.com).

7. Purposes and legal bases

Where the GDPR, the UK GDPR or a similar law applies, we rely on the following legal bases. Where another law applies, we process for the same purposes under the closest equivalent basis that law provides.

Purpose	Data used	Legal basis (GDPR Art. 6)
Providing the Service: accounts, links, QR codes, hosted pages, redirects, API, notifications	Account, profile, authentication, content and configuration data	Performance of a contract (Art. 6(1)(b))
Analytics for link owners: click, scan, view and open statistics shown to the customer who owns the link or page	Pseudonymised event records (Section 4.2)	Performance of a contract with the customer; legitimate interests (Art. 6(1)(f)) — providing the reporting the Service exists to provide — for events about non-account visitors
Security and abuse prevention: bot detection, rate limiting, blocking malicious links, SSRF protection, session security, investigating abuse reports	IP hashes, one-day raw-IP rate-limit records, session records, API logs, audit records, reports	Legitimate interests (Art. 6(1)(f)) — protecting the Service, our customers and the public from fraud, abuse and attack
Unique-visitor counting and deduplication	Stable IP hash	Legitimate interests (Art. 6(1)(f)) — accurate, privacy-reducing measurement without storing IP addresses
Product improvement and understanding acquisition	Signup attribution (Section 4.1), aggregate usage counters	Legitimate interests (Art. 6(1)(f)) — understanding and improving the Service
Transactional email: verification, password reset, one-time codes, link-expiry notices, form-submission notices	Email address, related event data	Performance of a contract (Art. 6(1)(b))
Weekly digest email	Email address, your analytics summary	Consent (Art. 6(1)(a)) — opt-in, off by default, withdrawable at any time
Marketing email (occasional announcements)	Email address	Consent / your email preferences (Art. 6(1)(a)); sent only to active, verified users with the email toggle on, always with one-click unsubscribe
Billing and records of payments received	Payments ledger	Performance of a contract; legal obligation (Art. 6(1)(c)) — accounting and tax record-keeping
Responding to your messages and legal requests	Contact messages, account data	Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) where a law compels us
Establishing, exercising or defending legal claims	Relevant records, including records surviving account deletion (Section 13)	Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c))

8. Cookies and local storage

We set the following cookies. All of them are first-party. Every one is either strictly necessary for the Service or stores a preference you chose. We set no third-party cookies, no advertising cookies and no cross-site tracking cookies. Because strictly necessary cookies are exempt from consent requirements under the EU ePrivacy rules, and the preference cookies are set only as a direct result of your own action (choosing a language or theme, or dismissing a hint), we do not show a cookie consent banner.

Cookie	Purpose	Lifetime	Attributes
quik_sess	Login session	Browser session; session ID rotated every 30 minutes	httpOnly, SameSite=Lax, Secure
quik_remember	"Remember me" login	30 days	httpOnly, SameSite=Lax, Secure
quik_lang	Your chosen interface language	1 year	SameSite=Lax
quik-theme	Light/dark theme choice	1 year	SameSite=Lax
quik_langhint	Remembers that you dismissed the "switch language?" hint	1 year	SameSite=Lax

We also use browser localStorage for two keys: quik-theme (theme choice) and quik-app-banner-hide (you dismissed the app banner). These stay in your browser and are not transmitted as cookies.

No cookies on redirects or tracking images: the short-link redirect path and the Email Counter image path set no cookie at all. Clicking a Quik link or opening an email with a Quik Counter does not place anything in your browser.

9. Sharing and recipients

We share personal data only as follows. This list is complete.

• Hosting provider — Hostinger. The Service, including its database and uploaded files, runs on infrastructure provided by Hostinger. As our hosting provider, it processes all Service data on our behalf.
• Email delivery — our SMTP mail host (Hostinger SMTP). When we send you an email, the recipient address and message content pass through our mail host over a TLS-verified connection.
• cdnjs (Cloudflare). Our pages load the Font Awesome icon stylesheet from cdnjs.cloudflare.com on every page. As with any resource your browser fetches, Cloudflare's CDN receives your IP address and User-Agent when serving that file. We send it nothing else.
• jsDelivr. Pages that display charts or generate QR codes load the Chart.js and qrcode.js libraries from cdn.jsdelivr.net; the CDN likewise receives your IP address and User-Agent for those requests, on those pages only. Our fonts are self-hosted and are not fetched from any third party.
• DB-IP and APNIC. Download-only: our server fetches their datasets. No visitor or user data is ever sent to them.
• Customer-configured webhook endpoints. If a customer configures a webhook, we send HMAC-signed JSON containing that customer's own data (link and timer events) to the URL the customer chose. The customer is responsible for the endpoint they configure.
• Link-checker targets. If you paste a URL into our free link checker, our server sends a single guarded HEAD request to that URL to test it. The target site sees a request from our server, not from you.
• IndexNow. We notify search engines of our own public marketing pages. No user data is included.
• Legal and regulatory disclosure. We may disclose personal data where we believe in good faith that a law, regulation, court order or enforceable governmental request requires it, or where disclosure is necessary to protect the rights, safety or property of Quik, our users or the public.
• Business transfers. If we are involved in a merger, acquisition, reorganisation or sale of assets, personal data may be transferred as part of that transaction. This policy will continue to apply to it, and we will notify you of any change of controller.

We do not sell or rent personal data, and we do not share personal data for cross-context behavioural advertising. No payment processor currently receives any data from the Service; paid plans are recorded manually after offline payment.

10. International transfers

The Service is provided by two entities — Заалт ЭйАй ХХК (Zaalt AI LLC) in Mongolia and QuikMN LLC — and is hosted on infrastructure provided by our hosting provider, which may be located outside your country. This means your personal data may be stored or processed in a country other than your own, whose data-protection laws may differ from those of your country. Where a law such as the GDPR requires safeguards for such transfers, we rely on appropriate safeguards recognised by that law — including, where required, standard contractual clauses with our service providers — and on the security measures described in Section 16. You may contact us at /contact for more information about the safeguards applicable to your data.

11. Retention

Our general rule: we keep personal data no longer than necessary for the purpose it was collected for, and longer only where a legal obligation, an unresolved dispute, or an abuse or security investigation requires it. The specific periods implemented in the Service are:

Data	Retention
Email-verification / password-reset tokens	Deleted on expiry, or 7 days after use
Rate-limit records (the only place a raw IP is held)	1 day
Login sessions	30 days after last activity
Anonymous short links (created without an account)	Active for 7 days, then a purge grace period of up to a further 7 days, then permanently deleted together with their click records — unless claimed into an account (Section 13)
Registered short links	Plan-dependent: up to 30 days on the Free plan, up to 365 days on paid plans (per-link, renewable)
Raw click records	Retained indefinitely by default; the retention window is configurable by our administrators and may be shortened
Email-open events (Email Counter)	90 days
Email Counter image cache files	2 hours
Email Counter timers	Automatically deactivated 60 days after they end (record retained until account deletion)
API keys	Expire after 90 days by default; maximum lifetime 1 year

Records with no automatic purge. The following are currently retained until the related account is deleted, or indefinitely where they are not tied to an account: contact messages, API request logs, administrative audit records, abuse reports, form submissions (until the owning customer or account deletes them), Bio view / Menu scan / Form view logs, daily aggregate click counters, in-app notifications, and the payments ledger. We keep these for security, abuse-prevention, record-keeping and legal-defence purposes. We review our retention practices and may introduce shorter automatic purges; we will not extend the periods above without updating this policy.

12. Your rights

Your rights depend on the law that applies to you. We honour the rights below for everyone to the extent the relevant law grants them, and we do not discriminate against you for exercising them.

12.1 EU / EEA and UK (GDPR and UK GDPR)

• Access to your personal data and a copy of it;
• Rectification of inaccurate data;
• Erasure ("right to be forgotten"), subject to the retained records described in Section 13;
• Restriction of processing;
• Portability of data you provided, in a machine-readable format;
• Objection to processing based on legitimate interests, including the processing described in Section 7 — we will stop unless we have compelling legitimate grounds; objection to direct marketing is absolute;
• Withdrawal of consent at any time, without affecting prior processing;
• Complaint to your supervisory authority (see Section 20).

12.2 Mongolia

Under Mongolia's Law on Personal Data Protection, you have rights to be informed about the processing of your personal data, to access it, to demand correction or deletion of unlawfully or inaccurately processed data, to withdraw consent, and to complain to the competent Mongolian authority. Requests go through /contact.

12.3 India (Digital Personal Data Protection Act)

You have the right to access a summary of your personal data and its processing, to correction and erasure, to grievance redressal (use /contact; we will respond within the period stated below), and to nominate another individual to exercise your rights if you die or are incapacitated.

12.4 Brazil (LGPD)

You have the rights to confirmation that we process your data, access, correction, anonymisation or deletion of unnecessary or non-compliant data, portability, information about sharing, information about the consequences of refusing consent, revocation of consent, and petition to the ANPD.

12.5 Indonesia (PDP Law)

You have rights to information about processing, access and a copy, correction, deletion or destruction, withdrawal of consent, objection to solely automated decisions, restriction, and compensation for violations, as provided by Law No. 27 of 2022.

12.6 California (CCPA/CPRA)

• Right to know what personal information we collect, use and disclose — this policy is that disclosure, and you may request the specific pieces we hold about you;
• Right to delete, subject to statutory exceptions (security, legal compliance — see Section 13);
• Right to correct inaccurate personal information;
• Right to opt out of sale or sharing — we do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of;
• Right to limit use of sensitive personal information — we use no sensitive personal information for purposes requiring a limitation right;
• Right to non-discrimination for exercising any of these rights.

12.7 How to exercise these rights, and when we respond

Use the self-service tools in your Settings page for most requests (Section 13), and /contact for everything else. We may ask you to verify your identity — normally by contacting us from your account email or confirming control of the account. We respond within 30 days, extendable where the applicable law allows (for example, by two further months under the GDPR for complex requests, with notice). Where a request concerns data our customer controls (Section 17), we will refer you to the customer and assist them as their processor.

13. Self-service, and what account deletion does and does not remove

From your Settings page you can, at any time: edit your profile and preferences (including removing an entered phone number), download your analytics as CSV, revoke individual sessions or log out all other devices, revoke API keys, and delete your account (password re-entry required).

Anonymous links: a link created without an account lives 7 days and is then purged. If you register or log in from the same browser session, you can claim the link into your account, making it owned and long-lived.

Account deletion permanently removes: your tokens, sessions, API keys and tags; your links together with their click records, daily counters, targets, QR codes and related reports; your notifications; your timers and their open events; your Bio pages with their links and view logs; your menus with items and scan logs; your forms with their submissions and view logs; your signatures; your webhooks and delivery records; and your payments-ledger rows.

What survives account deletion — stated honestly:

• API request logs — retained as security and abuse-investigation records;
• Administrative audit records — retained as an integrity record of administrative actions; entries may contain your email address;
• Contact messages you sent us — retained as correspondence records;
• Uploaded image files on disk — the database records are removed, but the underlying files are not currently swept from storage.

We retain these on the legal bases of legitimate interests (security, abuse prevention, record integrity, defence of legal claims) and, where applicable, legal obligation. You may ask us at /contact to review and, where no such interest or obligation stands in the way, delete specific surviving records — including uploaded files.

14. Children

The Service is not directed at children. You must be at least 16 years old to use the Service, or the lower age at which local law permits use with the consent of a parent or guardian, in which case that consent is required. We do not knowingly collect personal data from children below that age, and we do not verify age by technical means — your age is a representation you make to us. If you are a parent or guardian and believe a child has provided us personal data, contact us at /contact and we will delete the account and associated data.

15. Automated decision-making

We do not carry out automated decision-making that produces legal effects or similarly significant effects on you within the meaning of GDPR Article 22. The Service does run automated security heuristics: bot detection (honeypot, timing checks, JavaScript proof, User-Agent checks), rate limits, and destination-URL safety checks. These can result in a request being refused, a link being blocked, or an account being restricted. If you believe an automated measure has affected you wrongly, contact us at /contact and a human will review the decision.

16. Security

Measures we have actually implemented include:

• The Service is served over HTTPS, and we enforce HSTS (max-age one year, including subdomains) so that returning browsers connect over HTTPS;
• Passwords hashed with bcrypt (cost 12), with constant-time verification that also defeats account-enumeration probing;
• Optional two-factor authentication (TOTP, RFC 6238) with replay protection;
• API keys stored only as SHA-256 hashes with a short prefix; remember-me tokens hashed and rotated on every use; session revocation ("log out other devices"); session IDs rotated every 30 minutes;
• Session cookies flagged httpOnly, Secure and SameSite=Lax; CSRF tokens with constant-time comparison on every state-changing request;
• IP pseudonymisation by keyed HMAC throughout analytics and logs (Section 4.4);
• Security headers: content-type sniffing protection, frame-embedding restrictions, referrer-policy, a Content-Security-Policy defaulting to our own origin, and a Permissions-Policy denying geolocation, microphone and camera;
• SSRF hardening on every destination URL (blocking private, carrier-grade-NAT and tunnelling ranges; full DNS resolution with rebinding protection);
• Parameterised database queries throughout; email header-injection scrubbing; TLS-verified outbound mail;
• Uploaded images re-encoded server-side and stored outside the web root;
• Layered rate limiting on login, registration, contact, reporting, link creation, form submission and the API.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal-data breach occurs, we will notify the competent supervisory authority within 72 hours where the applicable law requires it, and will inform affected users without undue delay where the breach is likely to result in a high risk to them.

17. Notice to our customers' end users

This section is addressed to you if you interact with something a Quik customer created: you clicked their short link, scanned their Menu QR, viewed their Bio or Countdown page, submitted their form, or opened an email containing their Email Counter.

• What is recorded: a pseudonymised event as described in Section 4.2 — a keyed hash of your IP address (never the address itself), your device/browser family, approximate country and city from an offline dataset, and a timestamp. For a menu scan, the table number in the QR code. For a form view or Bio view, an IP hash and device type. Opening an email that contains an Email Counter records an open event (IP hash and mail-client family) that the sender can see in aggregate; if you block remote images in your mail client, no open is recorded.
• No cookies: clicking a link or opening a counter image places no cookie in your browser.
• Form submissions: whatever you type into a customer's form goes to that customer. The customer is the controller of your submission; we only store it for them. Their privacy notice applies.
• Who to contact: for anything you submitted to a customer, or about a customer's page or emails, contact that customer first — they control the data and the content. If you cannot reach them, or your concern is about our own processing, contact us at /contact and we will help, including passing your request to the customer where we act as their processor.

18. Processor terms (data-processing terms for customer-controlled data)

These terms apply between Quik (as processor) and each customer (as controller) for the personal data described in Section 4.5 — above all Quik Forms submissions — and form part of our agreement with the customer under the Terms of Service.

1. Instructions. We process customer-controlled data only to provide the Service as configured by the customer and per the customer's documented instructions given through the Service, and not for our own purposes, except where a law requires otherwise (in which case we will inform the customer unless the law forbids it).
2. Customer responsibilities. The customer warrants that it has a lawful basis for the data it collects through the Service, that it provides its audience the legally required privacy notice, and that its instructions comply with applicable law. The customer indemnity in the Terms of Service applies to breaches of these warranties.
3. Confidentiality. We limit access to customer-controlled data to personnel who need it to operate the Service and who are bound by confidentiality obligations.
4. Security. We apply the measures in Section 16 to customer-controlled data.
5. Sub-processors. The customer authorises the sub-processors listed in Section 9 (our hosting provider and mail host; content-delivery networks serve only static assets). We will update Section 9 before adding a sub-processor that processes customer-controlled data; if the customer objects on reasonable data-protection grounds and we cannot resolve the objection, the customer may terminate the affected service.
6. Assistance. Taking into account the nature of the processing, we will assist the customer with data-subject requests (including through the export and deletion tools in the app) and, insofar as information is available to us, with the customer's security, breach-notification and impact-assessment obligations. We will notify the customer without undue delay after becoming aware of a personal-data breach affecting their data.
7. Deletion and return. The customer can export form submissions and delete forms, submissions, pages and links at any time through the Service; deleting the account deletes all customer-controlled data we hold for the customer (Section 13). This satisfies deletion/return on termination, subject to the residual records in Section 13.
8. Audit. We make available the information in this policy, and such further information as we can reasonably provide on request through /contact, to demonstrate compliance with these terms.

19. Changes to this policy

We may update this policy from time to time. When we do, we will change the effective date at the top and publish the new version on this page. For material changes — new categories of data, new purposes, new recipients, or reduced rights — we will give registered users advance notice by email or an in-app notice before the change takes effect. Continued use of the Service after the effective date of a revised policy means the revised policy applies. Translations of this policy are provided for convenience; if a translation conflicts with the English version, the English version prevails to the extent the applicable law allows.

20. Contact and complaints

For any question, request or complaint about this policy or your personal data, contact us at /contact. Billing enquiries: billing@quik.mn. We will tell you which entity — Заалт ЭйАй ХХК (Zaalt AI LLC) or QuikMN LLC — is the controller for your account and provide its registered address on request.

If you are unsatisfied with our response, you have the right to lodge a complaint with a data-protection supervisory authority — in the EU/EEA, the authority of your habitual residence, workplace or the place of the alleged infringement; in the UK, the Information Commissioner's Office; in Brazil, the ANPD; in India, the Data Protection Board; in Indonesia, the competent PDP authority; in Mongolia, the authority competent under the Law on Personal Data Protection; in California, the California Privacy Protection Agency or Attorney General. We would, however, welcome the chance to resolve your concern directly first.