Privacy Policy
How Qualify AI collects and uses personal data in connection with the Qualify AI platform and the qualifyai.eu website.
| Controller | Saltvision BV, Waregemsesteenweg 157a, 9770 Kruisem, Belgium — trading as Qualify AI |
| Enterprise & VAT number | BE 0786.771.552 — Crossroads Bank for Enterprises (KBO/BCE), Belgium |
| Contact | sales@qualifyai.eu · +32 56 62 51 95 Waregemsesteenweg 157a, 9770 Kruisem, Belgium |
| Version | 1.3 |
| Effective date | 1 August 2026 |
| Related documents | Terms & Conditions · Data Processing Agreement · Sub-processor list |
Contact: sales@qualifyai.eu · +32 56 62 51 95 · Waregemsesteenweg 157a, 9770 Kruisem, Belgium
1. Who we are
Qualify AI is an AI-assisted B2B outreach automation platform operated by Saltvision BV, a company established in Belgium, registered with the Crossroads Bank for Enterprises under enterprise and VAT number BE 0786.771.552 and having its registered office at Waregemsesteenweg 157a, 9770 Kruisem, Belgium. When this policy says “we”, “us” or “our”, it means Saltvision BV. “Qualify AI” is the trading name and product name under which Saltvision BV provides the Service, and Saltvision BV is the operator of both the qualifyai.eu and saltvision.com domains.
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. Privacy questions and requests go to sales@qualifyai.eu, which is monitored for this purpose.
2. Who this policy is for — and the one important distinction
This policy covers personal data for which we decide the purpose — in GDPR terms, where we act as the controller. That means three groups of people:
- Visitors to qualifyai.eu
- Customers who subscribe to the platform, and the individual users they invite
- Anyone who contacts us — by email, through a form, or about a support matter
If you received a business email sent through Qualify AI
You are probably here because you received an outreach email and traced the platform behind it. That data is not ours, and this policy is not the one that governs it.
Our customers use Qualify AI to run their own outreach. For that data, the customer who contacted you is the data controller and we act only as their processor — we store and transmit it on their instructions and we do not decide who is contacted or why. The company whose name appears in the email is the right place to send a request to access, correct, object to or erase your data, and every message sent through the platform carries an unsubscribe link.
If you cannot identify or reach the sender, write to sales@qualifyai.eu. We will pass your request to the relevant customer without undue delay and confirm to you that we have done so. Where you ask us to, we will also add your address to our platform-wide suppression list so that it stops being contacted through Qualify AI. Keeping that suppression record is itself necessary — deleting it entirely would mean you could be contacted again.
3. What we collect, why, and on what legal basis
| Who | Data | Why we use it | Legal basis | How long we keep it |
|---|---|---|---|---|
| Website visitors | IP address, browser and device type, pages viewed, referring page, approximate location derived from IP, and technical performance measurements | Serving the website securely, diagnosing faults, measuring page performance and protecting against abuse | Legitimate interest (Art. 6(1)(f)) in operating and securing our website | Server and security logs: up to 12 months |
| People who contact us | Name, email address, company, and whatever you write to us | Answering your question, providing support, and keeping a record of what was agreed | Legitimate interest, or steps prior to entering a contract (Art. 6(1)(b) and (f)) | Up to 24 months after our last exchange |
| Customers and their users | Name, business email, job title, company, account credentials, subscription tier and settings | Creating and administering your account, authenticating users, providing support and enforcing plan limits | Performance of the contract (Art. 6(1)(b)) | For the life of the account, then up to 12 months |
| Customers | Billing contact, subscription and payment records, invoices | Taking payment, issuing invoices and meeting accounting obligations | Contract, and legal obligation (Art. 6(1)(b) and (c)) | 7 years, as required by Belgian accounting law |
| Customers and their users | Login times, feature usage, error and audit logs, acceptance records for our Terms | Keeping the service secure, investigating incidents, and evidencing that our Terms were accepted | Legitimate interest in security and in establishing legal claims (Art. 6(1)(f)) | Security logs 12 months; acceptance records for the life of the account plus 10 years |
| Prospective customers | Business contact details and correspondence | Responding to enquiries and sending occasional information about the service | Legitimate interest in B2B marketing, subject to your right to object at any time (Art. 6(1)(f)) | Until you object, or 24 months of no engagement |
We do not seek or want special categories of personal data — health, political opinions, religious beliefs and similar — and you should not send them to us.
4. Data our customers process through the platform
Separately from the above, the platform processes business contact data about the prospects our customers choose to contact: name, job title, business email address, employer, industry, company size, location, professional profile links, the messages sent and any replies received, and engagement records such as opens and clicks.
For all of that we are a processor, not a controller. We process it only on the customer’s documented instructions, under the Data Processing Agreement, and we do not use it for our own purposes, do not sell it, and do not use it to train AI models unless the customer has explicitly opted in.
5. Cookies and similar technologies
The qualifyai.eu website and the customer dashboard use a small number of cookies and equivalent browser storage:
- Strictly necessary — keeping you logged in, remembering your session and subscription state, and protecting forms against cross-site request forgery. These are required for the site to work and are set without consent, as permitted under the ePrivacy rules.
- Functional — remembering interface preferences such as your dashboard theme, and whether you have dismissed a notice.
- Performance monitoring — our hosting provider collects anonymous measurements of page loading speed to keep the site fast. These are not used to profile you or to target advertising.
We do not use advertising cookies and we do not sell or share data with advertising networks. If we ever introduce analytics or marketing cookies, we will ask for your consent first through a cookie banner and update this policy before doing so.
You can delete or block cookies through your browser settings. Blocking strictly necessary cookies will prevent you from logging in.
6. Emails we send you
We send transactional emails — account confirmations, invoices, security notices, service announcements and changes to our Terms — on the basis of our contract with you. You cannot opt out of these while you hold an account, because they carry information you need.
Where we send marketing emails to business contacts, we do so on the basis of legitimate interest and every message includes a one-click unsubscribe. We may record whether such a message was opened so we can stop contacting people who consistently do not engage. You can object to this at any time by replying or writing to sales@qualifyai.eu.
7. Connecting your mailbox — Google and Microsoft account data
Qualify AI sends your outreach from your own mailbox, so that messages come from you and not from us. To do that, you connect your email account to the platform. This section explains exactly what that connection gives us, and what it does not.
7.0 Who you are granting access to
The application that appears on Google’s consent screen as Qualify AI is registered, owned and operated by Saltvision BV — enterprise and VAT number BE 0786.771.552, Waregemsesteenweg 157a, 9770 Kruisem, Belgium — the same company that publishes this policy and operates qualifyai.eu. Saltvision BV is the registered developer of the application, so some Google screens and support correspondence show the address production@saltvision.com; that address and sales@qualifyai.eu both reach the same company. Access to your mailbox connection is not granted, resold or sub-licensed to any other company: the sub-processors listed at qualifyai.eu/sub-processors support the platform, and none of them receives the credential that sends on your behalf.
7.1 What we ask permission for
When you connect a Google account, you are taken to Google’s own consent screen and asked to grant a single permission:
https://www.googleapis.com/auth/gmail.send— permission to send email on your behalf, and nothing else. This scope cannot read, list, search, delete or modify anything in your mailbox.- Alongside it we request
openid,emailandprofile, which tell us only which account you connected — the address and display name — so that we can show it to you in your dashboard and set the correct sender on your messages.
For Microsoft 365 accounts the equivalent permission is Mail.Send through the Microsoft Graph API, granted through Microsoft’s own consent screen.
We do not request read access to your mailbox. We ask for the narrowest permission that allows the service to function.
7.2 What we store, and for how long
- A refresh token issued by Google or Microsoft, held encrypted. This is the credential that lets us send on your behalf. It is treated with the same protection as a password and is never displayed, exported or sent to you or to anyone else.
- A short-lived access token, cached only until it expires — typically about an hour.
- The email address and display name of the connected account, and the connection status.
We never receive or store your password. We do not store the contents of your mailbox. Tokens are deleted when you disconnect the account, when you close your Qualify AI account, or when the provider revokes them.
7.3 What we do with it
The connection is used for one purpose: to send the outreach and follow-up messages that you or your configured campaign have approved, together with a copy retained in your own Sent folder. It is not used for anything else.
Concretely, and without qualification, we do not:
- transfer or sell data obtained through these APIs to advertising platforms, data brokers or any other third party;
- use it to serve advertising of any kind, including retargeting or interest-based advertising;
- use it to assess credit-worthiness or for lending purposes;
- use it to train, fine-tune or improve generalised artificial-intelligence or machine-learning models.
Human access. No one at Qualify AI reads data obtained through these APIs. The only exceptions are the ones the policy permits: where you have given us your specific, affirmative agreement to look at a particular message in order to resolve a support issue; where it is necessary for security purposes or to investigate abuse; where we are required to by law; or where data has been aggregated and anonymised for internal operations such as measuring delivery volumes.
7.4 Reading replies
So that the platform can stop a sequence when someone answers, it needs to see replies to the messages it has sent. Because the read permissions offered by Google are far broader than that purpose requires, we deliberately do not request them. Instead, if you choose to enable reply detection, you supply a separate app-specific password, which you generate yourself and can revoke at any time independently of the sending connection.
That access is used only to read messages in the conversation threads the platform itself started. We do not browse, index, search or store any other part of your mailbox. If you do not enable reply detection, no read access of any kind exists.
7.5 Withdrawing access
You can disconnect at any time, and you do not need to ask us:
- from Disconnect in your Qualify AI dashboard, which deletes the stored token immediately; or
- directly from your provider — myaccount.google.com/permissions for Google, or your Microsoft account’s app permissions — which revokes our access without involving us at all.
Either way, sending stops at once and campaigns on that mailbox are paused rather than failing silently. Disconnecting does not delete the rest of your account data; see Section 10.
7.6 If your organisation controls your account
If your email account belongs to a Google Workspace or Microsoft 365 organisation, your administrator may need to permit the connection, and can withdraw it for the whole organisation at any time. Where that happens, we will show the affected connection as disconnected in your dashboard.
8. Who we share data with
We do not sell personal data. We share it only with:
- Service providers who help us run the platform — hosting, AI models, email delivery, lead data and payments. Each is bound by a written contract restricting them to our instructions. The full list, with the purpose, location and transfer safeguard for each, is published at qualifyai.eu/sub-processors.
- Professional advisers — accountants and lawyers, where necessary and under a duty of confidentiality.
- Authorities, where we are legally required to disclose data. Where we are permitted to tell you, we will.
- A buyer or successor, if the business is sold or reorganised. You will be informed and this policy will continue to apply until replaced.
9. International transfers
We are based in Belgium and prefer providers inside the European Economic Area. Some of our providers are outside it, principally in the United States. Where personal data leaves the EEA, we rely on a European Commission adequacy decision or on the European Commission’s Standard Contractual Clauses, together with any additional safeguards required. The transfer mechanism applying to each provider is listed on our sub-processor page. You may request a copy of the relevant safeguards from sales@qualifyai.eu.
10. How long we keep data
Retention periods are set out per category in the table in Section 3. In general we keep personal data only as long as needed for the purpose it was collected for, plus any period required by law — most notably seven years for accounting records under Belgian law. When a retention period ends we delete the data or irreversibly anonymise it.
Two records deliberately outlive the rest: suppression entries, because deleting them would cause someone who opted out to be contacted again, and records of acceptance of our Terms, because we may need them to establish or defend a legal claim.
11. Automated decision-making and AI
We do not make decisions about you by automated means that produce legal or similarly significant effects, and we do not carry out profiling of that kind.
The platform does use AI to score and prioritise business leads for our customers and to draft outreach text. Those scores rank commercial opportunities at company and role level; they are not assessments of individuals for employment, credit, insurance or any comparable purpose, and they are reviewed by a human or governed by settings the customer controls. AI-generated output is a draft aid, not an autonomous decision. See Section 11 of our Terms & Conditions.
12. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls and authentication, logical separation of each customer’s data, restricted administrative access, and logging of significant actions. No system is perfectly secure, but if a personal data breach occurs that is likely to result in a high risk to you, we will inform you without undue delay, and we will notify the supervisory authority where the law requires it.
To report a suspected vulnerability or security incident, write to sales@qualifyai.eu.
13. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you, and receive a copy;
- Rectify data that is inaccurate or incomplete;
- Erase your data, where we have no overriding basis to keep it;
- Restrict processing while a dispute about accuracy or legitimate interest is resolved;
- Object to processing based on legitimate interest — including, at any time and without needing a reason, to direct marketing;
- Portability — receive data you provided to us in a structured, machine-readable format;
- Withdraw consent, where processing is based on consent, without affecting what was done beforehand.
To exercise any of these, write to sales@qualifyai.eu. We respond within one month, extendable by two further months for complex requests, in which case we will tell you within the first month. We may ask for information to confirm your identity. Exercising your rights is free unless a request is manifestly unfounded or excessive.
If your request concerns data processed by one of our customers rather than by us — see the highlighted section near the top of this page — we will forward it to that customer and tell you we have done so.
14. Complaints
If you are unhappy with how we have handled your personal data, please tell us first at sales@qualifyai.eu so we can put it right. You also have the right to lodge a complaint with a supervisory authority — in Belgium:
| Authority | Gegevensbeschermingsautoriteit / Autorité de protection des données (Belgian Data Protection Authority) |
| Address | Drukpersstraat 35, 1000 Brussels, Belgium |
| Telephone | +32 2 274 48 00 |
| contact@apd-gba.be | |
| Website | www.dataprotectionauthority.be |
You may also complain to the supervisory authority in the EU country where you live or work.
15. Changes to this policy
We may update this policy as the service, our providers or the law change. The version number and effective date at the top of this page always show the current version. For changes that materially affect how we use your personal data, we will give notice by email or in-product before they take effect. Previous versions are available on request.
16. Contact
Saltvision BV, trading as Qualify AI
Waregemsesteenweg 157a, 9770 Kruisem, Belgium
Enterprise & VAT number BE 0786.771.552
sales@qualifyai.eu · +32 56 62 51 95
Qualify AI — Privacy Policy, version 1.3. Changes in this version: the controller is confirmed as Saltvision BV, with its registered office and its enterprise and VAT number stated in full; the “provider details pending” notice is removed; new Section 7.0 identifies Saltvision BV as the registered developer of the Qualify AI Google application and explains the relationship between the qualifyai.eu and saltvision.com domains. No other change. Changes in version 1.2: the controller’s legal name, registered office and enterprise number were shown as pending confirmation; no other change. Changes in version 1.1: new Section 7 describing the Google and Microsoft mailbox connection, the permissions requested, and our commitments under the Google API Services User Data Policy; subsequent sections renumbered.