Privacy notice — Quasar

For your account and for running the service, we are the controller.

For what an organization puts into Quasar — its projects, issues, documents, files and work logs — the organization is the controller. We process that content on its behalf, as its processor under Article 28 of the GDPR, according to the terms for Quasar. If your organization uses Quasar, it decides what goes in and who sees it, and questions about that content go to its administrators first.

Your place in each organization: your name, email address, roles and settings.

The content you and your colleagues create: projects, issues, documents, comments and files.

Who did what, and when. Every change records the person and the credential behind it, in audit and event logs that the application itself cannot alter.

Time: work sessions and work logs, with the hours a person confirms.

The technical logs needed to run the service and keep it secure.

You can connect an assistant — ChatGPT, Claude, Codex or another MCP client — by signing in through your browser and approving it. It acts with your permissions, never more.

What Quasar's tools return to the assistant — issues, documents, comments — is sent to that assistant's provider and handled under your agreement with them. Those providers are not our processors: you choose them.

For every call an assistant makes, Quasar records the tool, the outcome and, for a refusal, its reason; the name and version of the client; and the model and token counts the client reports.

You can see and revoke the assistants you connected from your Quasar profile, under Connected agents.

To provide the service you or your organization signed up for (contract, Article 6(1)(b) GDPR).

To keep the service secure and to be able to show who did what (legitimate interest, Article 6(1)(f)).

To keep the invoices and records the law requires (legal obligation, Article 6(1)(c)).

Quasar sends email only for the service itself: deadline reminders, password resets, notices about your keys and your access.

Deleted items stay in the project's trash for the period the organization sets, from 7 to 365 days, and are then purged with their history.

Records of assistant calls, and work sessions nobody confirmed, are kept for 90 days.

Database backups and disk snapshots are kept for 7 days. A deleted file stays recoverable from its second copy for 30 days.

Everything else stays for as long as the organization uses Quasar.

Every person can export their own data as JSON.

Erasing a person anonymizes them in place: histories stay consistent, without naming them.

An organization that leaves gets a complete export on request, and is deleted after a 30-day grace period.

In AWS's Ireland region, with a second copy of the files in Frankfurt. Email goes through Amazon SES, in Ireland.

Files are served only through Quasar or through short-lived signed links, never at a public address.

We look at an organization's content only to run the service, when the organization asks us to, or when the law requires it.

If your organization runs Quasar on its own servers, it is the controller of everything in that installation, and this notice does not describe it.