Qlink Privacy Policy

Last updated: August 31, 2026

This Privacy Policy explains how Qlink CR S.A. (hereinafter, “Qlink,” “we,” “us,” or “our”) collects, uses, retains, and protects personal data when a person visits our websites, creates an account, or uses Qlink’s web platform, mobile applications, and related services (collectively, the “Services”).

Qlink is based in San José, Costa Rica. For privacy questions or requests, contact privacidad@qlinkcr.com.

1. Scope and data roles

Qlink acts as the database controller for the data needed to manage Qlink accounts, subscriptions, billing, support, security, and communications.

When a business uses Qlink to record data about its customers, suppliers, team members, sales, purchases, or other people, that business determines why and how that data is used. In these cases, the business is responsible for the processing and Qlink processes the data on the business’s behalf to provide the Services. People associated with one of our customers should first direct their requests to that business; we will assist the business when appropriate.

2. Data we collect

Depending on how the Services are used, we may collect:

• Identification and contact data: name, email address, phone number, and business information.
• Account and access data: protected credentials, user identifiers, branch, role, permissions, and preferences.
• Subscription and payment data: selected plan, billing period, payment status, receipts, and transaction identifiers. Full payment-card details are processed by the payment provider, not by Qlink.
• Operational data uploaded by the customer: products, inventory, customers, suppliers, sales, purchases, payments, accounts receivable, documents, images, and other information the customer chooses to record.
• Technical and usage data: IP address, device and browser type, operating system, access logs, security events, errors, and feature usage.
• Communications: support requests, feedback, and other messages sent to Qlink.

Please do not upload sensitive data that is unnecessary for running the business. Qlink is not designed to store medical records, biometric data, information about sexual orientation, religious beliefs, or other sensitive categories unrelated to its commercial purpose.

3. How we use data

We use personal data to:

• create, authenticate, and manage accounts;
• provide the inventory, sales, purchasing, analytics, and other contracted tools;
• process subscriptions, payments, and plan changes;
• provide support and send operational or security notices;
• protect the Services and prevent fraud, abuse, and unauthorized access;
• diagnose errors and maintain and improve product performance;
• comply with legal, accounting, and tax obligations and respond to valid requests from authorities;
• send marketing communications when consent or another legally permitted basis exists, with the option to opt out.

Depending on the circumstances, processing is based on performance of the Terms and Conditions, informed consent, compliance with legal obligations, and our legitimate interests in operating and protecting the Services without overriding people’s rights.

4. Third-party data uploaded by customers

The customer represents that it has permission, consent, or another valid legal basis to record and use data about customers, suppliers, team members, and other third parties in Qlink. The customer must also provide any legally required notices, keep the data current, and handle requests to access, correct, or delete it.

Qlink does not use this data for its own advertising and does not sell it. We process it to provide the Service, follow valid customer instructions, protect the platform, and comply with the law.

5. Service providers and recipients

We may share data, only as needed, with providers that help us with:

• hosting, storage, backups, and technology infrastructure;
• authentication, security, monitoring, and fraud prevention;
• payment processing and billing, including the payment provider available at checkout;
• email, notifications, and customer service;
• error diagnosis and operational analytics.

We require these providers to use data only to deliver their contracted services and to apply appropriate confidentiality and security measures.

We may also disclose information when required by a competent authority, to exercise or defend legal rights, to protect users or third parties, or as part of a merger, acquisition, or corporate reorganization. In the last case, the recipient must honor this Policy or provide notice of any applicable changes.

We do not sell or rent personal data.

6. Payments

Payments for paid plans are processed by an external provider. Payment-card information is entered directly into that provider’s systems and is also subject to its terms and privacy policy. Qlink receives confirmation, status, identifiers, and the limited information needed to manage subscriptions, reconcile payments, and handle claims.

7. Cookies and similar technologies

We may use cookies or local storage that are strictly necessary to sign users in, retain preferences, maintain security, and operate the Services. If we add optional analytics, advertising, or tracking technologies that require consent, we will identify them and provide the appropriate controls before using them where required by applicable law.

You can configure your browser to block or delete cookies, although some essential features may no longer work correctly.

8. International transfers

Some technology providers may store or process information outside Costa Rica. When an international transfer occurs, we will seek appropriate safeguards from the recipient and limit the information transferred to what is necessary to provide the Services or comply with a legal obligation.

9. Retention and deletion

We retain data while an account is active and for as long as needed to provide the Services. After cancellation or a deletion request, we may retain limited information when necessary to:

• comply with accounting, tax, or legal obligations;
• resolve disputes and enforce agreements;
• prevent fraud and maintain security records;
• complete reasonable backup cycles.

When no legitimate purpose remains, we will delete or anonymize the data. Deletion from backups may not be immediate; while data remains there, it will be isolated from ordinary use and protected by security measures.

Before closing an account, the customer must export any information it wants to keep through the features available under its plan or by requesting assistance. Deletion may be irreversible.

10. Security

We use reasonable administrative, technical, and organizational measures to protect data against loss and unauthorized access, alteration, or disclosure. No system can guarantee absolute security. Customers must use strong passwords, protect their credentials, configure permissions correctly, and notify us immediately of any unauthorized use.

If an incident may significantly affect personal data, we will investigate it and provide any notices required by applicable law.

11. Individual rights

Under applicable law, a person may request:

• confirmation of processing and access to their data;
• correction or updating of inaccurate data;
• deletion when appropriate;
• information about purposes and recipients;
• withdrawal of consent for processing based on consent;
• an end to marketing communications.

In Costa Rica, Law No. 8968 recognizes rights of access, correction, and deletion. We will respond to valid requests free of charge and within the period established by law, which is currently five business days.

To exercise a right, email privacidad@qlinkcr.com with your name, the right you wish to exercise, and the information needed to locate the data. We may reasonably verify your identity and, if you act for another person or company, your authority.

You can also review the remedies available through Costa Rica’s Data Protection Agency (Prodhab).

12. Minors

The Services are intended for people aged 18 or older who act for themselves or on behalf of a business. We do not knowingly collect minors’ data to create accounts or direct advertising to them. If you believe a minor created an account or provided personal data without authorization, contact privacidad@qlinkcr.com.

This restriction does not prevent a business from recording strictly necessary data about a minor as part of its operations when it has a valid legal basis and complies with the applicable special protections.

13. Changes to this Policy

We may update this Policy to reflect legal, technical, or Service changes. We will publish the current version with its effective date and, when a change is material, seek to provide reasonable notice before it takes effect.

14. Contact

Qlink CR S.A.
San José, Costa Rica
privacidad@qlinkcr.com