Operated by Away HR Opportunities Ltd, HE 351183, Themistokli Dervi 3, Julia House, 1066, Nicosia, Cyprus
Last updated: 22 September 2026
This document covers two related things.
Part C applies before you have an account: our public pages, the waitlist, and the first steps of onboarding up to the point where you sign in with Google.
Part B applies from the moment your Qanola account is created — that is, when you complete Google sign-in and we create your user record — and covers everything that follows, including the remaining onboarding steps and the Qanola mobile app.
Our Terms and Conditions are published separately at qanola.com/terms. For anything related to this document, write to privacy@qanola.com.
This part explains what data we handle on your behalf, where it lives, and what we don’t do with it.
Away HR Opportunities Ltd acts as the data controller for account data and usage data, and as your data processor for work data. You are the data controller for the work data you bring into Qanola; we process it on your instructions for the purposes described below.
Account data. What you give us to have an account: your email, your name if you choose to share it, your password (stored as a salted hash, never in clear), and your billing details if you’re on a paid plan. We are the controller for this data.
Work data. Everything you bring into Qanola so it can be useful to you: emails, calendar events, documents, notes, tasks, contacts, voice memos, and any content you paste into a conversation. This may include personal data about third parties — for example, the people you email. You are the controller for this data; we are your processor. Except where expressly stated otherwise, Away processes Work Data solely on your behalf and under your instructions and does not independently determine the purposes or means of processing such Work Data.
Usage data. A record of how you use Qanola, including features or screens opened, actions taken, approximate timing, error codes and limited device or browser information. Some usage data is processed on our behalf by Amplitude, Inc., as described in B5. It is linked to your Qanola user ID but does not include the content of your work data. We do not use this usage data for advertising and we do not sell it. Advertising measurement is a separate thing, runs on its own consent, and is described in Part C.
Special categories of personal data. Work Data may include special categories of personal data within Article 9 GDPR — for example where information relating to health, political opinions or other protected matters appears in emails, documents, calendar events or other content that you choose to connect or provide to Qanola.
To the extent that you act as controller of such Work Data, you are responsible for ensuring that its processing has a valid legal basis under Article 6 GDPR and, where applicable, an appropriate condition under Article 9(2) GDPR. Away processes such data only on your documented instructions, solely to provide the functionality requested by you, and not for its own independent purposes.
If Away proposes to process special-category data for an additional purpose determined by Away, we will provide appropriate information and identify the applicable legal basis and Article 9 condition before that processing begins.
You authorise Away to process, transmit, format, store, and technically interact with connected systems and third-party services solely as necessary to provide the functionality requested by you through Qanola.
We only process your data for purposes that are obvious from the product:
To run the features you asked for — reading what you connected, suggesting actions, drafting messages, scheduling, organising.
To keep your account working — authentication, billing, support when you ask for it.
To keep the service safe and reliable — preventing abuse, fixing bugs, recovering from incidents. This includes essential security and operational logging.
To improve Qanola. With your consent, we analyse account-linked usage data to understand how the product is used, identify errors and points of friction, and improve features. This usage data does not include the content of your work data. We use work data to provide the functions you request and do not use raw work data to improve the product unless you expressly choose to share a specific example with us. Any metrics published or shared outside Away are aggregated so that they do not identify an individual.
Legal bases under GDPR: performance of our agreement with you (Art. 6(1)(b)) for everything needed to deliver the product; our legitimate interests (Art. 6(1)(f)) for essential security and operational logging; and your consent (Art. 6(1)(a)) for optional product analytics and anything else you clearly asked for, never bundled.
We do not train AI models on your work data. Not ours, not anyone else’s. Your emails, documents, contacts, and conversations are not used to train, fine-tune, or evaluate any model — by us or by the AI providers we rely on. We require this contractually from every model provider we work with.
When Qanola needs to call an AI model to do its job (summarise a thread, draft a reply, plan your week), your data is sent to that model only for the time needed to produce the answer. The model providers we work with are bound to not retain your inputs or outputs beyond what’s strictly needed to serve the request and meet their own short abuse-prevention windows.
You can ask us at any time which model providers are in the loop for a given feature, and we’ll tell you.
We host Qanola’s databases and file storage in the EEA by default. Some service providers are established outside the EEA, or may permit limited authorised access to EEA-stored data from outside the EEA where necessary to provide or support the service, maintain security or comply with law. Where this constitutes a restricted transfer, we rely on an adequacy decision where applicable or on the European Commission’s Standard Contractual Clauses, together with appropriate supplementary safeguards. B5 sets out the categories of provider involved.
You may contact privacy@qanola.com for further information about the safeguards used for international transfers or to request a copy of the relevant safeguards. Copies may be redacted where reasonably necessary to protect confidential or commercially sensitive information.
To run Qanola we rely on a small number of trusted providers, each handling a specific job under a written agreement with us. They fall into these categories:
cloud infrastructure, where your databases and files are stored
AI model providers, used for inference when a feature needs a model
an authentication provider — Google. If you connect a calendar in our Booking feature, Google also provides that access; see B11
a product analytics provider — Amplitude, Inc., see below
a consent management provider — CookieYes Limited, United Kingdom, which displays our cookie banner and holds the record of the cookie choice you make. The United Kingdom benefits from a European Commission adequacy decision
a payment processor, on paid plans
an email provider, for account and product email
push notification services, to deliver mobile notifications if you enable them; see B12
error monitoring and observability tools
Every provider handling work data is bound by a written agreement restricting them to processing on our instructions. The one exception is the platform notification services described in B12: where a notification is delivered to your device, Apple and Google operate that delivery under their own developer terms rather than under an agreement we negotiate. Where a provider is established outside the EEA, or can access EEA-stored data from outside it, the safeguards in B4 apply.
We maintain a current list of the specific companies behind these categories, including the sub-processors that process Work Data. Write to privacy@qanola.com and we’ll send it to you. Business customers can request it as part of vendor review.
Meta Platforms Ireland Limited is deliberately not one of these providers: it does not process data on our instructions, so it is not a processor or a sub-processor of ours. Our relationship with Meta for advertising measurement is a different one, and it is described in C3A.
Product analytics. Amplitude, Inc. — product analytics provider and processor for usage data only. Amplitude processes usage events, device identifiers, Qanola user IDs and limited device and browser information in its EU data region; it does not receive Work Data. Where a restricted transfer occurs, it is protected by the EU–U.S. Data Privacy Framework while applicable, with the 2021 Standard Contractual Clauses (Module 2) under Amplitude’s DPA as the contractual fallback.
We’ll give you advance notice by email before adding or replacing a provider that processes your work data. If you object to a new provider for good reason, we’ll work with you to find a path forward, including ending the agreement and giving you your data back if no other option exists.
We follow the standard set of practices a serious product is expected to follow: encryption in transit (TLS) for everything; encryption at rest for databases and file storage; least-privilege access for the team, with logged and reviewed access to production systems; secrets stored in a dedicated vault; regular dependency and vulnerability scanning; backups with tested restore procedures.
We won’t pretend to certifications we don’t have. We’ll add the concrete details — encryption schemes, audit reports, certifications — as we earn them.
If Away becomes aware of a personal data breach affecting Work Data that we process on your behalf, we will notify you without undue delay and provide the information and reasonable assistance available to us to help you comply with your obligations under Articles 33 and 34 GDPR. As controller of the Work Data, you are responsible for determining whether notification to a supervisory authority or to affected individuals is required.
For personal data for which Away acts as controller, including Account Data and Usage Data, Away will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals. Where required by applicable law, we will also notify affected individuals.
While we implement reasonable technical and organisational measures designed to protect data, no system can be guaranteed completely secure or immune from unauthorised access, attack, failure, or compromise.
While your account is active, we keep your work data for as long as you want us to.
When you delete something inside the product, it goes to a trash state for 30 days so you can recover it, then it’s permanently deleted from active live systems. It may persist in encrypted backups for up to 90 days before being overwritten.
When you close your account, we delete your work data within 30 days, and your account data within 90 days, unless we’re legally required to keep something — for example, invoices for accounting purposes, which we keep for the legally required period.
Usage data. We retain identifiable usage data for 12 months from collection and then delete it or irreversibly aggregate it. If you close your account, we delete or de-identify account-linked usage data within 30 days where technically feasible, subject to limited backup and legal-retention requirements. Withdrawing analytics consent stops future analytics collection; you may separately request deletion where the right to erasure applies.
You can export your data at any time in a portable format. We’ll never hold your data hostage to keep you on the product.
Because you’re the controller of your work data and we hold account and usage data about you, you have the full set of GDPR rights:
access the data we hold
correct it if it’s wrong
delete it (we honour this by default — see above)
object to or restrict how we use it
receive a copy in a portable format
withdraw any consent you gave, including your analytics choice
Most of these you can do yourself from inside the product. For anything that needs a human, email privacy@qanola.com. We’ll aim to reply within 30 days, usually much faster. If you feel we haven’t done right by you, you can also lodge a complaint with a supervisory authority. Our lead supervisory authority is the Cyprus Commissioner for Personal Data Protection. You may also complain to the data protection authority of the EU member state where you habitually reside or work.
You represent and warrant that you have all rights, permissions, consents, and legal bases necessary to provide data, content, prompts, instructions, and connected accounts to Qanola for processing in accordance with these terms.
Tell us what to do. Qanola acts on your instructions. If you connect a data source, you confirm you have the right to share that data with a processor like us.
Keep your credentials safe. Don’t share your account with someone else; create proper invitations instead, once that feature exists.
Mind third parties. When you bring in data about other people (the people you email, your contacts, your clients), you’re the one with the relationship to them — including any duty to inform them, where the law requires it. We’ll give you the tools to do this honestly; the obligation stays with you.
Where Away processes Work Data on your behalf, the following terms apply:
The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects involved, are described in Sections B1 and B2. Processing will continue for the duration of your use of Qanola and any limited deletion or backup period described in Section B7.
Away will process Work Data only on your documented instructions, including with respect to transfers of personal data outside the EEA, unless processing is required by applicable EU or Member State law. Where legally permitted, Away will inform you before carrying out processing required by law.
Away will ensure that persons authorised to process Work Data are subject to appropriate confidentiality obligations.
Away will implement and maintain appropriate technical and organisational measures in accordance with Article 32 GDPR.
You provide Away with general written authorisation to appoint sub-processors. Away maintains a current list of sub-processors that process Work Data, available to you on request at privacy@qanola.com, and will provide advance notice of any intended addition or replacement. You may object on reasonable data-protection grounds within 10 business days after receiving notice. Away will impose data-protection obligations on each sub-processor that are no less protective than those applicable to Away under these terms and will remain responsible for the performance of its sub-processors’ obligations.
Taking into account the nature of the processing, Away will provide reasonable assistance through appropriate technical and organisational measures to help you respond to requests by data subjects exercising their rights under the GDPR.
Taking into account the nature of the processing and the information available to Away, Away will provide reasonable assistance with your obligations under Articles 32–36 GDPR, including security, personal data breach notifications, data protection impact assessments and prior consultation with supervisory authorities.
At the end of the Services, Away will, at your choice, delete or return Work Data and delete existing copies, unless applicable law requires continued retention. Applicable deletion and backup periods are described in Section B7.
Away will make available the information reasonably necessary to demonstrate compliance with Article 28 GDPR and will permit reasonable audits, including inspections, by you or an independent auditor acting on your behalf. Audits must be conducted on reasonable prior notice, during normal business hours, subject to appropriate confidentiality and security requirements, and without unreasonable disruption to the Services.
Away will inform you without undue delay if, in its reasonable opinion, an instruction infringes the GDPR or other applicable EU or Member State data-protection law.
If we make meaningful changes — for example, if we add a provider that handles your data, or something material about how your data is used — we’ll update this document and the date at the top, and we’ll email you before the change takes effect. For minor edits (wording, links, typos) we’ll just update the page.
If you don’t agree with a material change, you can close your account and export your data before it takes effect, at no cost.
The data processing terms in Section B9A form part of the agreement between you and Away where Away processes Work Data on your behalf. Where a legally approved transfer mechanism is required, the parties will enter into the applicable European Commission Standard Contractual Clauses or other required transfer terms.
This section governs Away’s handling of data obtained through Google APIs when you connect your Google account to Qanola.
What we access. When you connect your Google account, Qanola requests access to:
Where a feature only requires knowing whether a time slot is free or busy, we access only that information and do not read event titles, descriptions, or attendee details.
How we use this data. We use Google Calendar data exclusively to provide Qanola’s features that require calendar access:
What we do not do with Google Calendar data:
Data minimisation. We request only the level of access necessary for the functionality you use. We do not access calendar settings, sharing configurations, or any data beyond what is described above.
Storage. Google Calendar data is accessed in real time and is not permanently stored on our servers beyond what is required to complete a requested operation. The credentials that maintain your connection are stored encrypted at rest and used solely for that purpose.
Limited Use. Away HR Opportunities Ltd’s use of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
Strict limitation. Notwithstanding any other provision of this Privacy Policy, Google user data obtained via Google APIs is used solely to provide the calendar-related features you have explicitly enabled. It is not used for advertising, analytics, benchmarking, product improvement, AI model training, or any other purpose beyond operating the specific feature you requested.
Revoking access. You may revoke Qanola’s access to your Google Calendar at any time via your Google Account at myaccount.google.com > Security > Third-party apps & services > Qanola > Remove access. Revoking access will disable calendar-dependent features but will not affect other Qanola functionality. We will delete any stored credentials within 30 days of revocation.
The Qanola app for iOS and Android processes the account, work and usage data described above.
Analytics. If you consent to product analytics, the app uses an identifier generated by our analytics provider to recognise the same installation and sends the usage data described in B1. We do not use an advertising identifier or permit tracking across other companies’ apps or websites. You can change your analytics choice at any time in Settings > Privacy, and declining analytics does not restrict product features.
Push notifications. If you enable push notifications, we process a device push token solely to deliver them. The token identifies your installation to the notification services described below and is not used for any other purpose. We retain it while notifications are enabled and delete it within 30 days after you turn notifications off or delete your account. You can disable notifications at any time in your device settings.
Notifications are delivered through Apple Push Notification service and Firebase Cloud Messaging, as applicable to your device. Where we use a notification service provider to send them, that provider acts on our behalf and falls within the categories set out in B5.
Notification content. A notification tells you about something that has happened in your account, so its text can contain a limited amount of your work data — for example a client’s name, the time of a booking, or the subject of an appointment. That content is transmitted to your device through the notification services named above, which process it solely to deliver the message. Where the content is Work Data, those services act as our sub-processors for that transmission and we do not permit them to use it for any other purpose. We do not store notification text separately from the underlying record already held in your account. If you would rather booking details did not appear on a locked screen, you can turn off notification previews in your device settings.
Device permissions. We do not collect your precise location, your contacts, your photos, or microphone input. If a future feature needs any of these, we will update this notice and your device will ask for permission before anything is collected.
The app stores. Apple and Google independently process information relating to downloading, installing and updating the app under their own policies. Away remains responsible for personal data that it chooses to send through its analytics, push-notification or other service providers.
Away HR Opportunities Ltd is the data controller for data collected from site visitors, waitlist subscribers and people using the pre-account part of onboarding. This part covers you until your Qanola account is created; from that moment, Part B applies.
Our public pages and the pre-account part of onboarding collect the following.
Information you give us. Your email address, if you join the waitlist. Your name or other details, if you include them in a message to us. Your answers to the onboarding questions, including the average deal size you enter — which we store as a range, not as the exact figure you typed.
Sign-in information. We use Google as our authentication provider. When you sign in with Google, we receive your Google account identifier, your email address and whether Google has verified it, your name, and your profile picture URL. We do not receive your Google password.
Signing in does not give us access to your Google Calendar. If you later use our Booking feature, we ask separately for calendar access, in its own Google permission screen, and you can decline without losing anything else. What we do with calendar data — and what we never do with it — is set out in B11.
Usage data. If you consent to analytics, we collect information about how you use our public pages and pre-account onboarding flow, including pages or screens viewed, onboarding steps completed or abandoned, actions taken, timestamps, error codes and limited device and browser information. We use Amplitude, Inc. to process this data on our behalf in its EU data region. The data is associated with an identifier stored on your device and, if an account is created during the journey, with your internal Qanola user ID. After account creation, Part B applies to product usage data. We do not send names, contact details, work content, calendar content, document or file names, payment data, precise location or free-text error messages to Amplitude.
Away is the controller for this usage data; Amplitude processes it on our instructions.
Advertising measurement. If you accept advertising cookies, our pages load the Meta Pixel, which tells Meta Platforms Ireland Limited that you visited a page on our site and which of a short list of actions you took there — for example opening the sign-up flow. The Pixel stores two cookies on your device, _fbp and _fbc, which Meta uses to connect that visit to an advertisement you may have seen or clicked. They expire after 90 days.
We do not send Meta your name, your email address, your phone number, or any content you create in Qanola, and we have switched off the Pixel’s optional features that would do so. Advertising measurement runs on our website and the pre-account part of onboarding only — it does not run inside the product and it does not run in the Qanola app. If you decline advertising cookies, the Pixel is not loaded at all and neither cookie is set.
Once you sign in with Google and your account is created, Part B applies to everything that follows, including the rest of onboarding and the Qanola app.
We do not collect your IP address for analytics. IP collection is disabled in our analytics configuration before transmission, and we do not derive or store location from it. Our hosting provider separately logs technical information (including IP address and browser type) for up to 30 days to serve the site securely and prevent abuse; we don’t link this to your email or build a profile from it.
We use your email for two things:
To tell you when Qanola is ready, or to share occasional updates about the product. Legal basis: your consent (GDPR Art. 6(1)(a)), given when you join the waitlist. You can withdraw it at any time by replying “unsubscribe” or emailing us.
To answer you, if you’ve written to us. Legal basis: our legitimate interest in responding to people who contact us (GDPR Art. 6(1)(f)).
We use your sign-in information and onboarding answers to create your account, authenticate you, and set the product up for your situation. Legal basis: performance of our agreement with you (Art. 6(1)(b)) and steps taken at your request before entering into it.
Analytics. With your consent, we use usage data to understand how our website and onboarding flow are used, identify errors and points of friction, and improve Qanola. You may withdraw your consent at any time through Cookie settings, without affecting the lawfulness of processing carried out before withdrawal.
Storing the analytics identifier on your device also requires your consent under the ePrivacy rules, which is what our banner asks for.
Advertising measurement. With your consent, we use the Meta Pixel to measure how well our advertising works — which advertisements bring people to the site and how far they get. Legal basis: your consent (Art. 6(1)(a)), given separately from your analytics choice. Storing the Pixel’s cookies on your device also requires your consent under the ePrivacy rules. You may withdraw it at any time through Cookie settings, without affecting the lawfulness of processing carried out before withdrawal.
We don’t sell your data and we don’t use it to train AI models. If you accept advertising cookies, we share limited information about your visit with Meta to measure our advertising, as described above. We never share the content you create in Qanola with advertisers.
To run the site, the waitlist and the sign-up flow, we rely on a small number of trusted providers who handle your data on our instructions:
a hosting provider, to serve the website
an email tool, to store the waitlist and send updates
Google LLC, as our authentication provider
Amplitude, Inc., which processes consented website and onboarding usage data on our behalf in its EU data region. Amplitude does not receive the content you create in Qanola
CookieYes Limited, which provides our cookie banner and Cookie settings and holds the record of the choice you make
Meta Platforms Ireland Limited also receives data, if you accept advertising cookies — but not on our instructions, and so not as one of the providers above. See C3A.
When these providers are established outside the European Economic Area, or can access EEA-stored data from outside it, we make sure the transfer is covered by appropriate safeguards — an adequacy decision where one applies, otherwise the European Commission’s Standard Contractual Clauses. B4 and B5 above set out the categories of provider and the safeguards that apply; write to privacy@qanola.com if you want to know which companies they are.
For the collection of advertising-measurement information on our website and its transmission to Meta, Away and Meta Platforms Ireland Limited decide together why and how it happens. That makes us joint controllers for that step, under Art. 26 GDPR.
Our arrangement with Meta is Meta’s standard Controller Addendum. Under it, Away is responsible for having a lawful basis for the collection and the transmission and for telling you about it — which is what this section and C1 do — and Meta is responsible for what it does with the information afterwards, under its own privacy policy.
This joint responsibility covers the collection and the transmission only. It does not make Away responsible for Meta’s later processing, and it does not make Meta responsible for anything else Qanola does with your data.
You can exercise your data protection rights against either of us. Write to privacy@qanola.com and we will handle what is ours and point you to Meta for the rest.
We keep your email for as long as you want to hear from us. If you unsubscribe, we remove your address from the active list within 5 business days. If you ask us to delete your data entirely, we will — unless we’re legally required to keep something.
Usage data is retained for 12 months from collection, then deleted or irreversibly aggregated. Withdrawing analytics consent stops future collection; you may separately request deletion where the right to erasure applies.
Advertising cookies. The Meta Pixel’s _fbp and _fbc cookies expire 90 days after they are set. What Meta retains after receiving the information is governed by Meta’s own privacy policy, not by ours.
Your cookie choice is kept as a record of what you accepted and what you refused, together with the date and the version of this document it was given against, for as long as needed to honour and evidence that choice.
Under the GDPR, you have the right to access, correct, delete, restrict, port, and withdraw consent over your data. Email privacy@qanola.com and we’ll handle it. We aim to reply within 30 days, usually much faster. If you feel we haven’t done right by you, you can also lodge a complaint with a supervisory authority. Our lead supervisory authority is the Cyprus Commissioner for Personal Data Protection. You may also complain to the data protection authority of the EU member state where you habitually reside or work.
We use cookies and local storage that are strictly necessary to operate the site, maintain your session, protect the security of the Services and remember the cookie choice you have made. These technologies do not require your consent where they are strictly necessary.
Beyond that, there are two optional groups, and they are separate choices — you can accept one and refuse the other:
| Group | Provider | Purpose | Storage duration |
|---|---|---|---|
| Analytics | Amplitude, Inc. | understand how our website and onboarding flow are used | 12 months |
| Advertising | Meta Platforms Ireland Limited | measure how well our advertising works | 90 days (_fbp, _fbc) |
We do not activate either group, or send anything to either provider, unless you have affirmatively accepted that group. Refusing one does not affect the other.
Our cookie banner and Cookie settings are provided by CookieYes Limited on our behalf.
You can accept or reject each group when first asked, and change or withdraw either choice at any time by reopening Cookie settings, which is available from the footer of every page of our website. In the Qanola app, the equivalent control is in Settings > Privacy. Refusing or withdrawing either consent does not affect your ability to use Qanola.
Cookie settings provide further information about the relevant provider, purpose and storage duration. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Qanola isn’t aimed at children. We don’t knowingly collect data from anyone under 16. If you think we have, write to us and we’ll delete it.
If we make meaningful changes — if we add a product or start using new tools — we’ll update this document and the date at the top. For material changes that affect how your data is used, we’ll let you know by email before the change takes effect.
| Matter | Address |
|---|---|
| General and legal | legal@qanola.com |
| Privacy and data | privacy@qanola.com |
| Security | security@qanola.com |
| Billing | billing@qanola.com |
A real human reads each of these inboxes.
Privacy · Terms · © 2026 AWAY HR OPPORTUNITIES LTD