Privacy Policy

Last updated: 22 October 2026

This policy covers the Quinine Cybersecurity website (quininecybersecurity.com) and the Q9 Continuous platform. Q9 Continuous is a security-testing platform operated by Quinine Cybersecurity Ltd ("Quinine Cybersecurity", "we", "us"). This policy explains what personal data we process, why, who we share it with, how long we keep it, and your rights. Access to the platform is by invitation only: it is used by our staff and by people our client organisations invite.

Who we are

Quinine Cybersecurity Ltd is the controller of the personal data described in this policy. Our address is Level39, One Canada Square, Canary Wharf, London E14 5AB, United Kingdom, and you can reach us at contact@quininecybersecurity.co.uk. Where we process testing records on behalf of a client organisation, we do so under our agreement with that organisation.

What we collect

Website enquiries

If you send an enquiry through our contact form, we receive the name, company (optional), email address, topic and message you enter, together with the date and time and the status of our response. Enquiries are read only by authorised Quinine Cybersecurity staff. To limit abuse, the number of enquiries from one network address is restricted: the address is stored only as a keyed hash (a pseudonymised form), kept separately from your enquiry, used only to apply that limit and kept only for a short period. We do not use enquiry details for advertising, and submitting an enquiry does not sign you up to any mailing list.

Q9 Continuous accounts

Sign-in information from Google: your name, email address, whether Google has verified it and, for workplace accounts, your organisation's domain. We request only the basic openid, email and profile scopes. We never receive your Google password and do not access your Gmail, Drive or any other Google data. Your sign-in details are held in a signed session cookie for up to 8 hours; your email address is also used to identify you in the records below.
Account and organisation records: the organisation you belong to, your role, invitations you send or receive, and when access was granted, suspended or removed, including who made the change.
Testing records your organisation creates: the systems registered for testing, evidence of ownership, the written authorisation to test (including the authoriser's name, email address and job title), test-run requests and results, and findings with their review decisions.
Billing records: plans, invoice records and payment references entered by our staff. We do not take or store card details on the platform.
Preferences and notifications: a display preference such as your theme, if you choose to save it to your account, and in-platform notifications addressed to you.

Security and technical records

Audit and access logs: a tamper-evident audit log of significant actions on the platform (who did what and when, which can include the email address of a person affected, for example someone invited or removed), and a record of who viewed, published, reviewed or launched each test run. These logs do not record IP addresses or browser details.
Server logs: our hosting provider records standard technical information about requests to the website, such as IP address, browser type and the page requested. Our own application logs record errors and the address of the request, not the content of forms you submit.

AI assistant

Our public pages include the Quinine AI Assistant, which answers questions about Quinine Cybersecurity and Q9 Continuous from the information published on this website. Nothing is sent unless you type a message and send it.

What is sent: the messages in your current conversation (your questions and the assistant's earlier replies), together with our fixed instructions and published website content. We do not add your name, email address, IP address, cookies or account details.
Who receives it: our application function passes the conversation to Groq, Inc., a company based in the United States, through its API, to generate a reply. This is an international transfer; see International transfers.
Why: to answer the question you asked. Legal basis: our legitimate interest in answering questions that visitors choose to ask about Quinine Cybersecurity and our products.
How long it is kept: We do not store your conversation. It is kept only in the memory of the page you are on and is gone when you leave or reload the page. Groq handles the messages it receives under Groq's terms of service. To limit abuse and cost, we count requests per network address using a keyed hash (never the address itself); these records are deleted automatically by a daily clean-up once they are more than a day old. Our logs for the assistant record only the status and error type of each request, never message text or network addresses.
Please do not share personal data, credentials or confidential information, such as security findings, in the chat. If you need to tell us something personal or confidential, email us instead.

The assistant gives general information and can make mistakes. Our published pages, and what we confirm to you in writing, take precedence over its answers.

Cookies and browser storage

The public website sets no cookies. Q9 Continuous uses two strictly necessary cookies, set only when you sign in. Display preferences such as theme and sidebar layout are saved in your own browser only when you choose them. The AI assistant sets no cookies and never saves your conversation; it keeps one session-only note (qchat-intro-seen) so its short introduction appears at most once per visit, which your browser deletes when you close the tab. We do not use analytics, advertising or tracking technologies. Our cookies page lists each item and lets you clear your saved preferences.

How we use your data and our legal bases

To respond to your enquiry and follow up about the products you asked about. Legal basis: our legitimate interest in answering enquiries about our products, or taking steps at your request before entering into a contract.
To provide Q9 Continuous: to sign you in, show you only your own organisation's information, run security tests your organisation has explicitly authorised, and report the results. Legal basis: performance of our contract with your organisation and our legitimate interest in providing the service to the people it authorises.
To keep the website and platform secure: to prevent abuse, investigate misuse and keep an accountable record of actions. Legal basis: our legitimate interest in operating a secure service, and compliance with our legal obligations where they apply.
To answer questions you ask the AI assistant. Legal basis: our legitimate interest in answering questions that visitors choose to ask about Quinine Cybersecurity and our products.
To administer client agreements and billing. Legal basis: performance of our contract, and compliance with legal obligations such as accounting and tax requirements.

We do not sell personal data, use it for advertising or make decisions about you based solely on automated processing.

Platform records are visible to members of your organisation and to the Quinine Cybersecurity staff assigned to it. Organisations cannot see each other's data. Website enquiries are visible only to authorised Quinine Cybersecurity staff. We use the following service providers (processors), who act on our instructions:

Vercel: website and application hosting. Application functions, which handle every form submission and platform request, run in Sydney, Australia.
Neon: managed PostgreSQL database, configured in the London (UK) region.
Amazon Web Services: isolated test workers, encrypted result storage and secret management, in Sydney, Australia.
Google: sign-in to Q9 Continuous.
Groq, Inc.: generates the AI assistant's replies from the messages you send it, through its API, under Groq's terms of service. Based in the United States.

We do not currently send email notifications from the platform. If we enable them, we will add the email provider to this list before doing so.

We may also disclose information where the law requires it, or to professional advisers under a duty of confidentiality.

International transfers

Some of our providers process personal data outside the UK. In particular, our application functions and test workers run in Australia, so information you submit to the website or platform, including contact enquiries, is processed there; Google may process sign-in data in the United States, and messages you send to the AI assistant are sent to Groq in the United States. Where they do, we rely on appropriate safeguards recognised by UK law, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can contact us for more information about these safeguards.

How long we keep it

Confidential test-run results are deleted automatically after 30 days unless a different period is agreed with your organisation.
Website enquiries are kept until they are deleted at your request or at the end of the retention period we set for enquiries. You can ask us to delete yours at any time.
Rate-limiting records (hashed network addresses) are kept only for a short period and then deleted automatically.
AI assistant conversations are not stored by us. Rate-limit records for the assistant are deleted automatically once they are more than a day old.
Sign-in sessions expire after 8 hours or when you sign out.
Account, authorisation, billing, audit and access records are kept for as long as your organisation uses the platform and afterwards only as long as needed for legal, security or accounting purposes. The audit log is designed to be tamper-evident, so entries are not edited once written.
Server logs held by our hosting provider are kept for the period set by that provider.

Security

Data is encrypted in transit (HTTPS) and at rest. Confidential results are additionally encrypted per run. Access is role-based and limited to your organisation, and significant actions are recorded in a signed audit log.

Your rights

Under UK data protection law you have the right to:

access the personal data we hold about you and receive a copy;
have inaccurate data corrected;
have your data erased;
restrict how we use your data;
object to processing based on our legitimate interests;
receive data you provided to us in a portable format, where processing is based on contract.

Some rights apply only in certain circumstances, and some records, such as security logs, may need to be kept for legal or security reasons. Where your organisation controls the data (for example, testing records), we will handle your request together with them.

How to exercise your rights

Email contact@quininecybersecurity.co.uk or write to us at the address above. We may need to confirm your identity before acting on a request. We will respond within one month, or tell you within that time if we need longer. Platform users can also contact us through their organisation's Quinine Cybersecurity account contact.

If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk (opens in a new tab)).

Changes

We will update this page if our practices change and revise the date above.