Privacy Policy

This Privacy Policy describes how q5m.ai Inc., a corporation incorporated in Canada and the operator of q5m, handles personal data, agent profiles, conversations, and connected integrations today. q5m.ai Inc. (“we,” “us,” or “our”) is responsible for the personal data we handle through the service. We keep this policy aligned with current product behavior and update it as the service changes. This policy covers the q5m web UI, including chat and in-chat interfaces, the q5m command-line interface (CLI), our software development kit (SDK) and APIs, and Model Context Protocol (MCP) connections.

• Account and auth data (for example email and auth identifiers) via Supabase.
• Per-agent profile data you save (free-form profile context, preferences, onboarding state).
• Web chat conversations and messages, attachments you submit, and data you enter through in-chat forms and controls. We also process tool requests and results, profile and memory updates, and application data sent to q5m through the CLI, SDK, APIs, or MCP. What we receive depends on the operation and the data the client sends; connecting a client does not by itself send us its entire conversation history.
• Integration data when you connect external services (for example Google Calendar, Intervals.icu, Strava, Home Assistant, Monarch Money), including OAuth tokens or API credentials needed to make requested calls.
• Operational metadata (request ids, model token usage, cost accounting, diagnostics, and service logs) needed for allowance enforcement, reliability, and support.

• Authenticate users and secure access to protected agent features.
• Run agent tool calls on your behalf using your saved profile, recent conversation context, and connected integrations.
• Maintain q5m conversation history, saved profiles, memory, and application state so you can resume chats and use agent data across supported access methods, subject to your permissions.
• Monitor product reliability, troubleshoot failures, and improve agent quality.

We share data only as needed to run requested product functionality:

• Supabase for authentication and application database storage.
• DeepSeek, Anthropic, OpenAI, or another model provider selected through your q5m model configuration for agent inference and generated outputs. In web chat, this can include your prompt, relevant conversation history, instructions, profile context, tool results, and supported attachment content needed for the request. Applications calling q5m chat APIs, including the OpenAI-compatible chat endpoint, also use q5m-hosted inference and send relevant request context to the configured model provider.
• Connected third-party integrations (for example Google Calendar, Intervals.icu, Strava, Home Assistant, Monarch Money) when you authorize them and request actions that touch them.
• Resend for transactional email such as account verification and notifications.
• Google Analytics (GA4) for aggregate pageview and conversion metrics on the marketing site and the product. We do not send personal identifiers to Google Analytics. You can opt out from the in-product Settings page.
• Optional monitoring and analytics tools (for example Sentry and PostHog when enabled).

With an MCP client, CLI-connected agent runtime, or SDK/API application, data returned by q5m becomes available to that client or application. This may include tool results, saved memory, or integration data you are authorized to access. If it uses a model provider, it may send that data to the provider under its own settings and privacy policy. Review those policies before connecting a client. Direct data or tool access does not by itself require q5m-hosted chat inference, but requested tools may use external services, and memory or recall features may use embeddings as described below.

q5m Basic uses DeepSeek V4 Flash. We send your prompt, relevant conversation history, agent instructions, and relevant agent context to DeepSeek. DeepSeek states that personal data may be processed and stored in the People's Republic of China and that inputs may be used to train or improve its technology. Do not submit sensitive personal data through q5m Basic. See DeepSeek's privacy policy.

After you acknowledge q5m Basic, we may also send message text and recall queries from your chats, including BYOK chats, to OpenAI's API to create semantic-search embeddings for memory and recall. See the OpenAI privacy policy.

• Integration credentials (OAuth tokens, API keys) are stored encrypted at rest in application storage.
• Access to protected data depends on authenticated sessions or API credentials and authorization checks in the service and database. These checks apply across the web UI, CLI, SDK/API, and MCP.
• We avoid logging raw API credentials and keep observability payloads focused on operational metadata.
• MCP clients connect over OAuth 2.0 or API keys. The CLI uses a dedicated API key issued after browser approval, or a key you configure. SDK applications use authenticated user sessions. Protect credentials and any locally saved data on your devices; sign out or revoke keys when you no longer trust a client.

You can update your data and connected integrations from product settings. You can also remove account data from the account reset flow.

• Update per-agent profile information from each agent's settings surface.
• Manage your connected integrations from the integrations page.
• Revoke the manually generated connect-page API key from that page, including if you configured that key in the CLI. This control does not revoke browser-approved CLI credentials or MCP OAuth tokens. The CLI logout command revokes and removes its saved credential. If you cannot access a device or need help revoking other client access, contact [email protected].
• Delete your account using the account reset flow, which removes saved profiles, conversations, and connected integrations.

Data retention windows for logs and third-party processors can vary by environment and provider policy. Removing data from q5m does not automatically remove copies already held by third-party clients, SDK applications, or model and integration providers; use their controls or contact them for those copies.

For privacy requests or questions, contact [email protected].

Legal review status: alpha draft aligned to current implementation; formal legal review may update wording.