QUOME PRIVACY NOTICE

Last Updated: April 16, 2026

Welcome to Quome — the cloud platform that makes it easy to create and distribute compliant applications. This Privacy Notice explains how Quome, Inc. ("Quome", "we", "us", or "our") collects, uses, discloses, and otherwise processes personal data in connection with our platform, websites, and any other specific product, service, or application that references or links to this Privacy Notice (the "Services").

This Privacy Notice does not address our privacy practices relating to Quome job applicants, employees, and other personnel, nor data that is not subject to applicable data protection laws (such as de-identified or publicly available information). This Privacy Notice is also not a contract and does not create any legal rights or obligations not otherwise provided by law.

1. Our Collection and Use of Personal Data

The categories of personal data we collect depend on how you interact with us and our Services. You may provide us your personal data directly when you register for an account, deploy an application, or contact us. We also collect personal data automatically when you interact with our Services and may collect personal data from other sources and third parties.

1.1 Personal Data Provided by Individuals

We collect the following categories of personal data that individuals provide to us:

Contact Information, including first and last name, email address, and communication preferences. We use this information to fulfill your requests, communicate with you, and send marketing communications in accordance with your preferences.

Account Information, including first and last name, email address, account credentials or one-time passcodes, organization name, and the services you use or have purchased. We use this information to administer your account, provide the Services, communicate with you regarding your account and usage, and for user support.

User Content, including any applications, containers, files, documents, code, configurations, data, or communications you choose to upload to or create through our Services. We use this content to provide the Services, facilitate your requests, and improve the Services.

Feedback and Support Information, including the contents of messages sent through contact forms, chat platforms, email, or other channels we make available (including through automated tools). We use this information to investigate and respond to your inquiries, communicate with you, and improve our Services.

If you contact us, we may need additional information to fulfill the request or respond to your inquiry. We may provide additional privacy disclosures where the scope of the request or personal data required falls outside the scope of this Privacy Notice. In that case, the additional disclosures will govern how we process the information you provide.

1.2 Personal Data Automatically Collected

We, and our third-party partners, automatically collect information about how you access and use our Services. We typically collect this information through cookies, web beacons, pixels, embedded scripts, and similar technologies. Information collected automatically may be combined with other personal data we collect directly or receive from other sources.

Your cookie choices. On your first visit we show a cookie consent banner that lets you accept, reject, or customize non-essential cookies. You can change your preferences at any time from the "Cookie preferences" link in the site footer, the dedicated /cookies page, or the keyboard shortcut Shift+Alt+C. We honor the Global Privacy Control (Sec-GPC) signal — if your browser sends it, we automatically opt you out of marketing and social categories without requiring you to interact with the banner.

Cookie categories we use:

• Strictly Necessary — session authentication, CSRF protection, load-balancer stickiness. These cannot be disabled; the Services will not function without them.
• Functional — UI mode, theme, language preference.
• Analytics — aggregate usage metrics to help us improve the Services. Disabled by default in the EU/UK.
• Marketing — measuring the effectiveness of our outreach. Disabled by default in the EU/UK and when GPC is detected.
• Social — embedded content from social platforms (YouTube, LinkedIn). Disabled by default in the EU/UK.

A full inventory — cookie name, vendor, purpose, duration, and storage type — is published at https://quome.com/cookies. We run an automated scan nightly to keep the inventory accurate. When we add a new cookie category or a material new vendor, the banner re-prompts for consent.

Evidence of consent. When you make a cookie choice, we record your consent ID, the categories you accepted, your IP address (encrypted at rest), user agent, region derived from geo-IP, and the banner version you saw. We retain consent records for five years to satisfy GDPR Article 7 and ePrivacy burden-of-proof requirements. You can reset your consent ID — clearing the association with your prior choices — from the /cookies preference center.

We automatically collect the following categories of data:

Device and Network Information, including device type, manufacturer, model, operating system, IP address, browser type, Internet service provider, and unique identifiers associated with your device or network. We may employ technologies to recognize when two or more devices are likely used by the same individual and may link information collected from different devices.

Usage Information, including how frequently you access our Services, the pages you visit, content you view, actions you take, communications you have through the Services, and links you interact with.

We use this automatically collected information to: (a) remember your preferences; (b) provide personalized content; (c) identify you across devices; (d) monitor and improve the Services; (e) measure aggregate metrics such as visitor counts, traffic, and usage patterns; (f) diagnose technology problems; and (g) plan for and enhance the Services.

1.3 Personal Data from Other Sources and Third Parties

We may receive personal data from the following sources:

Single Sign-On: When you log in through a third-party account (e.g., Google, GitHub), we receive your name and authentication tokens — not your login credentials — to verify your identity and provide access to the Services.

Employers: If you interact with the Services in connection with your employment, we may receive your contact information from your employer to facilitate your employer's customer relationship with us.

Other Users: Other users may provide us with your personal data, such as your contact information as part of a referral or organization invitation.

Social Media: When you interact with us through social networks (such as GitHub, Slack, or Discord), we may receive information you permit the social network to share, such as your profile information and username.

Service Providers: Our service providers that perform services on our behalf, such as analytics providers, may collect and share personal data with us.

2. Customer Content and the BYOSA Model

2.1 Customer Content Stays in Customer Accounts

Quome operates a Bring Your Own Service Account (BYOSA) model. Customer Content — including applications, databases, stored files, and secrets — resides in the customer's own cloud provider account (GCP, AWS, or Azure). Quome does not determine the location of Customer Content storage; the customer selects the cloud provider and region.

2.2 Control Plane Data

Quome's control plane stores only orchestration metadata necessary to provision and manage resources in customer cloud accounts, including resource names, configuration parameters, deployment status, user identity records, and authorization relationships. The control plane is not designed or intended to store Customer Content.

2.3 Data Processing

Quome processes Customer Content only as necessary to provide the Services and as directed by the customer. Quome does not sell Customer Content, use it for advertising, or process it for purposes unrelated to the provision of the Services.

2.4 Credential Access

Quome accesses customer cloud accounts through short-lived delegated credentials (maximum 1-hour lifetime) obtained through the customer's identity federation configuration. Quome never stores long-lived cloud credentials. Customers may revoke Quome's access at any time by modifying the delegation trust in their cloud account.

3. Additional Uses of Personal Data

In addition to the uses described above, we may use personal data to:

• Fulfill the purpose for which the information was provided, including contractual obligations;
• Manage our organization and its day-to-day operations;
• Communicate with you via email, chat, social media, or telephone;
• Facilitate our relationship with you and, where applicable, the company you represent;
• Verify your identity;
• Administer, improve, and personalize the Services;
• Develop, operate, improve, maintain, protect, and provide the features and functionality of the Services;
• Identify and analyze how you use the Services;
• Create aggregated or de-identified information that cannot reasonably identify you, which we may use for purposes outside the scope of this Privacy Notice;
• Conduct research and analytics on our user base and Services;
• Test, enhance, update, and monitor the Services, or diagnose technology problems;
• Maintain the safety, security, and integrity of the Services;
• Defend, protect, or enforce our rights or applicable agreements, resolve disputes, and protect our business interests and the rights of third parties;
• Detect, prevent, investigate, or provide notice of security incidents, fraud, or illegal activity;
• Comply with contractual and legal obligations; and
• Fulfill any other purpose for which you provide your personal data or consent.

4. Our Disclosure of Personal Data

We disclose or make available personal data in the following circumstances:

To Your Employer: If you interact with the Services in connection with your employment, we may disclose information to your employer, such as your usage of the Services.

To Other Users and the Public: We make available personal data designed for sharing through the Services with other users or the public, based on applicable privacy settings and intended recipients.

To Service Providers: We engage third parties to perform services on our behalf. These service providers may process personal data on our behalf or have access to personal data while performing services for us. Our current subprocessor list is maintained at https://quome.com/legal/subprocessors.

In Connection with a Business Transaction: We may disclose personal data to third parties during negotiation of, in connection with, or as part of a merger, acquisition, joint venture, financing, sale of assets, bankruptcy, receivership, or similar transaction.

To Facilitate Legal Obligations and Rights: We may disclose personal data to third parties, including legal advisors and law enforcement: (a) in connection with legal claims; (b) to comply with laws or lawful requests; (c) to protect our rights, property, and safety; (d) to detect or prevent fraud; (e) to collect debts owed to us; or (f) as otherwise required by law.

With Your Consent or Direction: We may disclose personal data to third parties or publicly with your consent or direction.

5. Data Retention

We retain personal data for as long as necessary to fulfill the purposes described in this Privacy Notice, unless a longer retention period is required or permitted by law. Factors we consider in determining retention periods include:

• The duration of our relationship with you;
• Whether there is a legal obligation to retain the data;
• Whether retention is advisable given our legal position (such as statutes of limitations, litigation, or regulatory investigations);
• The sensitivity of the data; and
• The purposes for which we collected the data.

When personal data is no longer needed, we will securely delete or de-identify it.

For Customer Content stored in customer cloud accounts under the BYOSA model, the customer retains full control over retention and deletion. Upon termination of the Services, Quome revokes its delegated access to the customer's cloud account; Quome does not retain copies of Customer Content.

Control plane metadata (resource names, configuration, deployment status) is retained for 90 days after account termination, after which it is securely deleted.

6. Data Security

We implement reasonable and appropriate technical, administrative, and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption at rest using AES-256-GCM via cloud-provider Key Management Services;
• Encryption in transit using TLS 1.3 for all communications;
• Access controls using multi-factor authentication and Zanzibar-style Relationship-Based Access Control (ReBAC);
• Audit logging of all administrative actions, API calls, and data access events;
• Tenant isolation with per-organization cloud accounts and dedicated service account identities;
• Regular security assessments and vulnerability testing.

While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

7. International Data Transfers

Quome is headquartered in the United States. If you access the Services from outside the United States, your personal data may be transferred to, stored, and processed in the United States or other countries where our service providers operate. These countries may have data protection laws that differ from the laws of your country.

Where required by applicable law, we implement appropriate safeguards for international data transfers, such as Standard Contractual Clauses approved by the European Commission.

8. Your Privacy Choices

8.1 Email Communication Preferences

You can stop receiving promotional email communications by clicking the "unsubscribe" link in our emails. You cannot opt out of service-related communications (such as account verification, transaction confirmation, or service update emails).

8.2 Automatic Data Collection Preferences

Certain Services provide the ability to adjust your preferences regarding automatic data collection technologies. You may also use third-party tools to restrict automatic data collection, including browser settings and device settings. Blocking automatic data collection technologies may negatively impact your experience, as some features may not work properly.

8.3 Account Data

You may access, update, or delete your account information through the Settings pages within the Services. You may also request deletion of your account by contacting us at legal@quome.com.

8.4 Partner-Specific Preferences

Google Analytics: We use Google Analytics to understand how users interact with the Services. For information on Google Analytics data practices and opt-outs, visit https://tools.google.com/dlpage/gaoptout/.

9. Children's Personal Data

Our Services are not directed to, and we do not intend to or knowingly collect or solicit personal data from, children under the age of 13. If a child under 13 has provided personal data to us, we encourage the child's parent or guardian to contact us to request removal. If we learn that personal data has been provided by a child under 13, we will promptly delete it.

10. Third-Party Websites and Services

Our Services may include links to third-party websites, plug-ins, applications, and other services. Except where we post, link to, or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to any personal data practices of third parties. Please review the privacy notices of any third-party services you interact with through our platform.

11. U.S. State Privacy Rights

11.1 California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including the right to: (a) know what personal data we collect, use, and disclose; (b) request deletion of your personal data; (c) opt out of the sale or sharing of your personal data; and (d) not be discriminated against for exercising your rights. We do not sell personal data or share it for cross-context behavioral advertising as defined under the CCPA/CPRA.

To exercise your rights, contact us at legal@quome.com.

11.2 Nevada Residents

If you are a Nevada resident, you have the right to opt out of the sale of your personal data. We do not currently sell personal data of Nevada residents as defined under Nevada law. You may submit an opt-out request by emailing legal@quome.com.

11.3 Other U.S. States

Residents of Colorado, Connecticut, Virginia, Utah, and other states with comprehensive privacy laws may have similar rights to access, correct, delete, and opt out of the processing of personal data. To exercise your rights, contact us at legal@quome.com.

12. European Economic Area, United Kingdom, and Switzerland

If you are located in the EEA, UK, or Switzerland, we process your personal data on the following legal bases under the General Data Protection Regulation (GDPR) or equivalent local law:

• Contractual necessity: To perform our obligations under the Agreement and provide the Services.
• Legitimate interests: To operate, improve, and secure the Services, provided our interests are not overridden by your rights and freedoms.
• Consent: Where you have given explicit consent, which you may withdraw at any time.
• Legal obligation: To comply with applicable laws.

You may have the right to: (a) access your personal data; (b) rectify inaccurate data; (c) request erasure; (d) restrict processing; (e) data portability; (f) object to processing; and (g) lodge a complaint with a supervisory authority.

To exercise your rights, contact us at legal@quome.com.

13. Updates to This Privacy Notice

We may update this Privacy Notice from time to time. When we make changes, we will update the "Last Updated" date above. If we make material changes, we will notify you by email to your registered email address, by prominent posting on our website or platform, or through other appropriate communication channels. All changes are effective from the date of publication unless otherwise stated.

14. Contact Us

If you have any questions or requests in connection with this Privacy Notice or other privacy-related matters, please contact us at:

Quome, Inc.
Email: legal@quome.com
Website: https://quome.com/legal/privacy

Document ID: QUOME-LEGAL-PRIVACY-001
Version: 2.0
Classification: Public