LEGAL & DATA GOVERNANCE

Privacy
Policy.

Effective Date: 02/10/2026 · Last Updated: 02/10/2026

This Privacy Policy describes how Nevil Biju & Vivek R, doing business as QueueBond, collects, uses, discloses, retains, and protects personal information in connection with QueueBond's website, application and services.

Privacy Contact: queuebondos@gmail.com

1. Scope

This Privacy Policy applies when you:

visit QueueBond websites;
create or use a QueueBond account;
use QueueBond on behalf of a customer organization;
request a demonstration;
contact support;
communicate with QueueBond;
receive transactional communications; or
otherwise provide personal information directly to us.

When QueueBond processes information solely on behalf of a customer organization, that customer may determine the purposes for which the information is processed and may have its own privacy obligations and privacy notice.

2. Our Role

QueueBond may act in different roles depending on the processing.

For information that you provide directly to QueueBond, such as account-registration information or support requests, QueueBond may determine the purposes and means of processing.

For information uploaded by a customer into its QueueBond workspace, the customer may determine why that information is processed, while QueueBond processes it to provide the Service.

Under applicable law, these roles may correspond to concepts such as a Data Fiduciary/Data Processor or organization/service provider.

The exact legal classification depends on the specific processing activity and applicable jurisdiction.

3. Information We Collect

Account Information

We may collect:

name;
email address;
organization;
job role;
account identifier;
authentication details;
workspace membership;
user permissions; and
profile information you choose to provide.

OAuth Information

Where Google OAuth or another external identity provider is used, QueueBond may receive information necessary to identify and authenticate your account.

QueueBond does not ordinarily receive your external provider password through standard OAuth authentication.

Customer Workspace Data

Customers may place information into QueueBond such as:

project records;
business contacts;
vendor information;
operator information;
requirements;
evidence;
documents;
images;
financial/capital information;
project decisions;
workflow records;
communications;
audit records; and
other business information.

Technical Information

We may collect:

IP address;
browser information;
device information;
operating-system information;
timestamps;
request paths;
authentication events;
error information;
security events;
diagnostic information;
performance data; and
approximate location derived from IP address where reasonably necessary for security or service operations.

4. How We Use Information

We may use personal information to:

create and maintain accounts;
authenticate users;
provide the Service;
enforce permissions;
maintain workspace security;
process customer instructions;
provide support;
detect fraud and abuse;
investigate security incidents;
troubleshoot errors;
improve reliability;
administer subscriptions;
send necessary service communications;
comply with law;
establish or defend legal claims;
create aggregated/de-identified service analytics; and
provide enabled AI-assisted features.

5. We Do Not Sell Customer Content

QueueBond does not sell Customer Content or personal information for advertising purposes.

We may use appropriately aggregated or de-identified information for legitimate business purposes such as product improvement, reliability analysis, abuse detection, and service planning.

We do not treat identifiable Customer Content as aggregated information simply because it has been placed into a report or database.

6. Legal Grounds

The appropriate legal basis depends on the jurisdiction and processing activity.

Where applicable law requires consent, QueueBond will seek meaningful consent.

Where law permits processing on another basis, QueueBond may process information where reasonably necessary to provide requested services, perform a contract, comply with law, protect security, prevent abuse, establish legal claims, or for another lawful purpose.

For Canadian processing subject to PIPEDA, the privacy program is designed around principles including accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, access, and complaint handling.

For India, the Digital Personal Data Protection Act, 2023 includes provisions concerning notice, consent, legitimate uses, rights of individuals, security, and grievance redressal. The final 2025 Rules use phased commencement dates, so operational obligations should be assessed according to the relevant provision's effective date.

7. Data Minimization

QueueBond seeks to collect information reasonably necessary for stated purposes.

Customers should avoid uploading personal information that is irrelevant to the relevant workflow.

Users should not put unnecessary sensitive information into:

project notes;
prompts;
documents;
comments;
evidence; or
free-text fields.

8. How We Share Information

Customers and Authorized Users

If you use QueueBond through an organization, that organization may access information associated with your account according to its Workspace configuration, permissions, contractual rights, and applicable law.

Service Providers

QueueBond may use providers for:

hosting;
databases;
authentication;
storage;
email;
security;
logging/monitoring;
support;
payment processing;
AI/model processing; and
other infrastructure.

Legal Disclosures

We may disclose information when reasonably necessary to:

comply with law;
respond to valid legal process;
protect users or customers;
protect the Service;
investigate fraud or abuse;
respond to security incidents; or
establish or defend legal rights.

We seek to limit disclosures to what is reasonably necessary.

9. International Data Processing

QueueBond and its service providers may process personal information in countries other than where the individual or customer is located.

Where cross-border processing applies, we will use reasonable contractual, technical, and organizational safeguards appropriate to the applicable law.

Canadian privacy obligations can vary across jurisdictions. Alberta, British Columbia, and Quebec have substantially similar private-sector privacy statutes, while PIPEDA can continue to apply in particular circumstances, including certain cross-border activities.

India's DPDP Act also contains provisions concerning processing outside India.

10. Retention

QueueBond retains personal information only for as long as reasonably necessary for:

the relevant purpose;
providing the Service;
contractual obligations;
legal obligations;
security;
fraud prevention;
dispute resolution; or
legitimate operational requirements.

Retention periods vary by information type.

Customer Content may be deleted after account termination according to the applicable contract and deletion process.

Some information may remain temporarily in backups, security logs, audit records, or legally preserved records.

11. Access, Correction and Deletion

Depending on applicable law, individuals may have rights to:

access personal information;
obtain information about its use and disclosure;
correct inaccurate information;
request deletion or erasure;
withdraw consent;
submit privacy complaints;
object to certain processing; or
exercise other statutory rights.

Requests should be sent to:

queuebondos@gmail.com

We may reasonably verify identity before fulfilling a request.

Where QueueBond processes personal information only on behalf of a customer, we may refer the request to that organization or assist it in responding, depending on applicable law.

India's DPDP Act expressly includes access, correction/erasure, grievance redressal, and related rights.

PIPEDA also provides access and correction mechanisms and allows individuals to challenge compliance.

12. Consent Withdrawal

Where consent is the basis for processing, you may withdraw consent subject to applicable legal and contractual limitations.

Withdrawal may prevent us from continuing to provide certain functionality.

Withdrawal does not invalidate lawful processing conducted before withdrawal.

13. Cookies

QueueBond may use essential cookies and similar technologies for:

authentication;
session management;
security;
maintaining preferences; and
functionality.

Where optional analytics or similar technologies are enabled, appropriate notice and controls will be provided where required.

QueueBond does not use cookies to sell Customer Content or personal information for targeted advertising.

14. AI Processing

Some QueueBond features may use artificial intelligence.

Depending on the enabled feature, relevant inputs may be processed through third-party model providers.

AI systems may produce inaccurate or incomplete information.

QueueBond does not make an AI-generated record authoritative merely because an AI system produced it.

QueueBond does not intentionally use Customer Content to train general-purpose AI models for unrelated third-party purposes without appropriate authorization.

Customers should use care when providing personal or confidential information to optional AI features.

15. Security

QueueBond uses reasonable administrative, technical, and organizational measures designed to protect personal information.

These may include:

authentication;
access controls;
role-based permissions;
database security controls;
server-side isolation of privileged credentials;
HTTPS/TLS;
security logging;
managed infrastructure;
secrets management;
dependency maintenance; and
incident-response procedures.

No system connected to the Internet can be guaranteed to be completely secure.

PIPEDA expects safeguards to be appropriate to the sensitivity of information and emphasizes ongoing assessment of security controls.

16. Security Breaches

If QueueBond confirms a security incident involving personal information under its control, we will:

investigate;
take reasonable containment measures;
remediate the relevant issue;
assess affected information;
maintain appropriate records; and
notify affected parties where legally or contractually required.

Under PIPEDA, organizations subject to the Act may need to report breaches involving a real risk of significant harm, notify affected individuals, and maintain breach records.

17. Accuracy

We seek to keep information under our control reasonably accurate for the purpose for which it is used.

Customers remain responsible for the accuracy of business information they upload or maintain within their Workspaces.

18. Children's Information

QueueBond is a B2B service and is not directed toward children.

We do not knowingly seek to collect children's personal information for purposes not permitted by applicable law.

If you believe a child has submitted information inappropriately, contact queuebondos@gmail.com.

19. Third-Party Services and Links

QueueBond may link to or integrate with third-party services.

Those third parties have their own privacy practices.

QueueBond is not responsible for the privacy practices of third parties operating independently of QueueBond.

20. Business Transfers

If QueueBond is involved in a merger, financing, acquisition, reorganization, or sale of substantially relevant assets, information may be transferred as part of that transaction subject to applicable law.

A transaction does not automatically authorize a new unrelated use of personal information.

21. Legal Requests

Where legally permitted, QueueBond may notify a customer of a governmental or law-enforcement request concerning Customer Content so that the customer may seek appropriate relief.

QueueBond may withhold notice where prohibited by law or where doing so would create a significant security or legal risk.

22. Customer Responsibilities

Customers are responsible for:

ensuring they have appropriate rights to process information;
giving required notices to individuals;
setting appropriate access permissions;
maintaining accurate data;
following retention requirements;
responding to individual requests where they are the responsible organization; and
using exported data lawfully.

23. Privacy Complaints

Privacy concerns should be sent to: