Privacy Policy
OQANDA is paused until 2027. Right now this website only shows a holding page, the Impressum and this privacy policy. There are no accounts, sign-ins, payments, emails, cookies or analytics, and the pages load nothing from third parties.
When you visit: our hosting provider Google Cloud (Cloud Run, region europe-west1, Belgium) processes your IP address, the requested address, date and time, and your browser's user agent in server logs, to deliver the pages and keep them secure (Art. 6(1)(f) GDPR). These logs are deleted after 30 days.
Existing accounts: data of existing accounts, Event participation and orders is kept in a stopped database and in encrypted backups in the EU until OQANDA relaunches; order data is kept as long as German tax law requires (§ 147 AO). You can ask for access to, or deletion of, your data at any time at privacy@oqanda.com.
Sections 1 to 12 below describe the platform as it operated until October 2026 and will apply again when OQANDA relaunches.
1. Controller
The controller responsible for data processing on this platform is:
None Records Design Multimedia
Friedhofstr. 23, 63263 Neu-Isenburg, Germany
Email: privacy@oqanda.com
Phone: +49 6102 5746679
2. What Data We Collect
2.1 Account Data
When you register, we collect your name, email address, and a password (stored in hashed form). We also assign you a random display nickname to protect your identity during Events.
2.2 Event Participation Data
When you register for and participate in Events, we record your registrations, the questions you submit, and your interaction timestamps.
2.3 Purchase Data
When you make a purchase in the Store, we collect your name, email address, shipping address, and order details. Payment card data is processed directly by Stripe and is never stored on our servers.
2.4 Partner Data
If you apply to become a partner, we collect your company name, contact name, email address, and any information you provide in your application.
2.5 Technical Data
When you visit the Platform, we may collect your IP address, browser type, operating system, and referring URL. This data is used for security monitoring and service improvement.
2.6 Cookies
We use essential cookies for authentication and session management. Non-essential cookies (analytics, marketing) are only set with your explicit consent. See our Cookie Policy for details.
3. Why We Process Your Data
| Purpose | Legal Basis (GDPR) |
|---|---|
| Providing and maintaining your account | Contract performance (Art. 6(1)(b)) |
| Processing your Event registrations | Contract performance (Art. 6(1)(b)) |
| Processing your Store purchases | Contract performance (Art. 6(1)(b)) |
| Sending transactional emails (order confirmations, password resets, invitations) | Contract performance (Art. 6(1)(b)) |
| Security monitoring and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Platform improvement and analytics | Legitimate interest (Art. 6(1)(f)) or consent (Art. 6(1)(a)) |
| Sending marketing communications | Consent (Art. 6(1)(a)) — only with your explicit opt-in |
4. Who We Share Data With
We share personal data only with the following third-party processors, each of which processes data under a Data Processing Agreement (DPA):
| Processor | Purpose | Data Shared | Location |
|---|---|---|---|
| Google Cloud Platform | Hosting, database, file storage | All application data | EU (europe-west1) |
| Stripe | Payment processing | Email, order details | EU/US (Stripe DPA) |
| Brevo | Transactional email delivery | Email address, name | EU (Brevo DPA) |
| Google Cloud Vertex AI | AI-assisted moderation (quality, deduplication, spam) — advisory only, human decides | User-submitted Event content (questions and answers) | EU (europe-west4) |
We do not sell your personal data to third parties.
5. AI-Assisted Moderation
OQANDA uses Google Cloud Vertex AI (Gemini models, hosted in europe-west4) to assist our human moderators. AI on OQANDA is an assistant. Every consequential decision about your content is made by a human.
5.1 What AI does
- Rates the quality and relevance of submitted questions
- Groups duplicate or near-duplicate questions so moderators don't read the same question many times
- Flags likely spam for moderator review
- During a live Event, may be activated by an Administrator in Emergency Moderation Mode to pre-sort questions when no human moderator is available — with the safeguards described below
5.2 What AI does not do
- It does not delete, hide, or publish your content without a human decision.
- Your data is not used to train Google's AI models. This is enforced by configuration, not just by policy.
- Emergency Moderation Mode cannot activate by itself. It requires explicit Administrator authorization and is time-capped at 30 minutes per activation, with a hard maximum of 105 minutes.
5.3 Legal basis (GDPR)
Art. 6(1)(f) GDPR — legitimate interest in the quality and safety of the Platform.
5.4 Automated decision-making (Art. 22 GDPR)
AI outputs on OQANDA are advisory. Every consequential decision about your content is reviewed by a human moderator. Emergency Moderation Mode includes a "held-for-human" bucket that routes borderline cases to a human as soon as one returns. No decision with legal or similarly significant effect is made by solely automated processing.
5.5 Retention
AI-generated metadata (quality scores, category labels, duplicate-cluster identifiers) is retained for the same period as the content it describes and is deleted when you delete your account.
5.6 Learn more
A plain-language explanation of how we use AI is at oqanda.com/responsible-ai. An Administrator can disable AI at any time; when disabled, no data is sent to Google Cloud Vertex AI for AI purposes.
6. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Until you delete your account |
| Event participation data | Until you delete your account |
| Purchase and order data | 10 years (required by German tax law, §147 AO) |
| Audit logs (security) | 12 months |
| Cookies | As specified in our Cookie Policy |
7. Your Rights
Under the GDPR, you have the following rights:
- Access: You can request a copy of the personal data we hold about you.
- Rectification: You can request correction of inaccurate data.
- Erasure: You can request deletion of your account and associated data ("right to be forgotten").
- Restriction: You can request that we limit how we process your data.
- Data Portability: You can request your data in a machine-readable format.
- Objection: You can object to processing based on legitimate interest.
- Withdraw Consent: Where processing is based on consent, you can withdraw it at any time.
To exercise any of these rights, contact us at privacy@oqanda.com. We will respond within 30 days.
8. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including encrypted database connections (SSL/TLS), hashed passwords, access controls, and regular security reviews. Our infrastructure is hosted on Google Cloud Platform in the EU (europe-west1 region).
9. International Transfers
Your data is primarily processed within the European Union. Where data is transferred outside the EU (e.g. through Stripe's US infrastructure), this is covered by appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.
10. Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for our location is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163, 65021 Wiesbaden
datenschutz.hessen.de
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email. The current version is always available at oqanda.com/legal/privacy.
12. Contact
For questions or data subject requests: privacy@oqanda.com